Every developer knows this feeling.
You need a vector database. Or a job queue. Or a .dwg parser for Node.js. You open a browser tab, search GitHub, open five more tabs, try to compare stars and last-commit dates, get distracted by a Medium post from 2019, and 45 minutes later you've picked something based on vibes.
There's a better way. I built it.
SKILLmama finds, scores, and ranks the best library, SDK, or tool for your exact stack — no tab-hopping, no outdated blog posts, just ranked picks with scoring math you can audit.
It works with Claude Code, Claude.ai, OpenAI Codex, and Antigravity.
The Problem With How We Pick Libraries
Most library selection looks like this:
- Google "best [thing] for [framework]"
- Find a Reddit thread from 3 years ago
- Pick the one with the most upvotes
- Discover 6 months later that it hasn't been maintained since 2021
The real question isn't "what's popular" — it's "what fits my stack, has active maintenance, won't take a week to integrate, and is popular enough to have community support?" Those are four separate signals, and you need all four weighted correctly.
The Scoring Formula
SKILLmama scores every candidate on four dimensions:
Score = (Compatibility × 0.40) +
(Popularity × 0.30) +
(Maintenance × 0.15) +
(Simplicity × 0.15)
| Factor | Weight | What it measures |
|---|---|---|
| Compatibility | 40% | Language/framework fit, official SDK, integration effort |
| Popularity | 30% | GitHub stars, npm/PyPI weekly downloads |
| Maintenance | 15% | Days since last commit, release cadence |
| Simplicity | 15% | Setup effort, documentation quality |
Compatibility is weighted highest because a library built for Java won't help you in a Python project, no matter how popular it is. Popularity comes second because the ecosystem around a library matters. Maintenance and simplicity round it out.
Every score is 1–10 per dimension. No black box. You can see exactly why something ranked #1.
The 5-Tier Search Hierarchy
SKILLmama doesn't just search one place. It works through five tiers in order, stopping when it has 8+ candidates:
| Tier | Source | What it finds |
|---|---|---|
| 1 | skills.sh | Reusable skills and capability patterns |
| 2 | GitHub | Open-source libraries, frameworks, SDKs |
| 3 | Smithery / MCP Ecosystem | AI-native tools installable as MCP servers |
| 4 | npm / PyPI / pkg.go.dev | Package registries with download signals |
| 5 | Curated Templates | LangGraph, OpenHands, cookbook examples |
Tier 3 is the interesting one. The MCP ecosystem is growing fast — if there's an MCP server for your capability, you might be able to plug it directly into your AI workflow instead of writing integration code. SKILLmama surfaces that option explicitly.
The Security Gate
But a high score means nothing if the tool is unsafe. Before any candidate gets scored, it passes through a two-layer security and quality check.
The hard gate discards candidates that are genuinely unsafe: CVE dependencies, undisclosed data exfiltration, jailbreak instructions, or destructive operations with no user warning. These never reach the scoring phase.
The quality flags (SQP rules, inspired by NVIDIA/SkillSpector) surface softer issues without discarding the candidate:
- SQP-1 — Vague trigger phrases that could activate unintentionally
- SQP-2 — Missing warnings on file writes, network calls, or credential access
- SQP-3 — Hardcoded language or locale without user opt-in
Every result card shows a Security line: PASS, ⚠️ SQP-2 — [finding], or 🚫 BLOCKED. You always know what you're installing. No surprises. No silent risks.
How It Works
┌─────────────────────────────────────────────────────────┐
│ USER REQUEST │
└─────────────────────────┬───────────────────────────────┘
│
▼
┌───────────────────────┐
│ PHASE 0 │
│ Understand Request │
│ Extract: capability,│
│ stack, constraints │
└───────────┬───────────┘
│
▼
◇ Capability
vague?
/ \
YES NO
│ │
▼ │
Ask 1 clarifying │
question, await │
user response │
│ │
└──────┬──────┘
│
▼
┌───────────────────────┐
│ PHASE 1 │
│ Architecture Scan │
└───────────┬───────────┘
│
▼
◇ In a project
repo?
/ \
YES NO
│ │
▼ │
Read: package.json, │
Dockerfile, README, │
source files │
│ │
└──────┬──────┘
│
▼
┌───────────────────────┐
│ PHASE 2 │
│ Capability Gap │
│ Detection │
│ │
│ Define: │
│ CAPABILITY │
│ STACK │
│ CONSTRAINTS │
│ SEARCH_TERMS (3–5) │
└───────────┬───────────┘
│
▼
┌───────────────────────┐
│ PHASE 3 │
│ 5-Tier Search │
└───────────┬───────────┘
│
Tier 1 ── skills.sh
↓
Tier 2 ── GitHub (stars, recency, contrib)
↓
Tier 3 ── MCP Ecosystem
↓
Tier 4 ── npm / PyPI registries
↓
Tier 5 ── Templates & Cookbooks
│
◇ 8+ candidates found?
/ \
YES NO
│ │
Skip remaining Continue tiers
tiers │
└──────┬─────────┘
│
▼
┌────────────────────────────────────────┐
│ PHASE 3.5 — Security & Quality Gate │
│ │
│ Hard Gate: │
│ 🚫 BLOCKED → discard, never score │
│ ⚠️ WARN → show, user confirms │
│ │
│ Quality flags (SQP rules): │
│ SQP-1 Vague triggers │
│ SQP-2 Missing user warnings │
│ SQP-3 Policy violations │
└───────────────┬────────────────────────┘
│
▼
┌────────────────────────────────────────┐
│ PHASE 4 — Score Each Candidate │
│ │
│ Score = (C × 0.40) + │
│ (P × 0.30) + │
│ (M × 0.15) + │
│ (S × 0.15) │
└───────────────┬────────────────────────┘
│
▼
┌────────────────────────────────────────┐
│ PHASE 5 — Present Results │
│ │
│ #1, #2, #3 — full score breakdown │
│ Also Considered — table │
│ MCP callout (if found) │
│ Next Steps (3 actions) │
└────────────────────────────────────────┘
End-to-End Example
Prompt:
/skillmama find me a vector database for my FastAPI + Python project
Phase 1 — Architecture Scan
SKILLmama reads your project files first:
✓ pyproject.toml → Python 3.11, FastAPI, SQLAlchemy
✓ Dockerfile → containerized, no GPU
✓ .env.example → OPENAI_API_KEY present → RAG use case confirmed
Detected stack: Python / FastAPI / PostgreSQL / Docker / OpenAI
Phase 2 — Capability Gap Detection (runs internally)
CAPABILITY : vector database for RAG / semantic search
STACK : Python / FastAPI / Docker / OpenAI
CONSTRAINTS: containerizable, Python client, active maintenance
Phase 3 — 5-Tier Search
Tier 1 skills.sh → "qdrant-memory-skill", "chroma-rag-skill"
Tier 2 GitHub → qdrant (17k★), chroma (14k★), pgvector (11k★), milvus (29k★)
Tier 3 MCP → qdrant-mcp-server, chroma-mcp
Tier 4 PyPI → qdrant-client (380k/wk), chromadb (620k/wk), pgvector (180k/wk)
Tier 5 Templates → LangChain + Qdrant RAG template, FastAPI + Chroma starter
Phase 4 — Scoring
| Candidate | Compat | Popular | Maint | Simple | Score |
|---|---|---|---|---|---|
| Qdrant | 9 | 8 | 10 | 9 | 9.05 |
| pgvector | 10 | 7 | 9 | 7 | 8.65 |
| Chroma | 8 | 8 | 9 | 10 | 8.55 |
| Milvus | 6 | 9 | 10 | 4 | 7.05 |
Phase 5 — Output
#1 — Qdrant · Score: 9.05/10
Docker-native, official Python client, active MCP server for AI workflows.
- Compatibility: 9/10 — official qdrant-client SDK, FastAPI examples in docs
- Popularity: 8/10 — 17k GitHub stars, 380k PyPI downloads/week
- Maintenance: 10/10 — committed 2 days ago, weekly releases
- Simplicity: 9/10 — docker run + pip install, 5-min setup
- Security: PASS — no findings
- Install: docker run -p 6333:6333 qdrant/qdrant && pip install qdrant-client
#2 — pgvector · Score: 8.65/10
Stay on PostgreSQL — no new infra, native SQL queries.
#3 — Chroma · Score: 8.55/10
Easiest local dev setup; best for prototyping before scaling.
MCP Option: qdrant-mcp-server — install as MCP tool for direct AI memory integration.
Next Steps:
1. docker run qdrant/qdrant and pip install qdrant-client to validate locally
2. Use the LangChain + Qdrant RAG template as a starting point
3. If staying Postgres-only, evaluate pgvector — saves an infra hop
That's 45 minutes of tab-hopping, compressed into a structured decision.
Install in 4 AI Systems
Claude Code:
mkdir -p /your-project/.claude/commands
cp .claude/commands/skillmama.md /your-project/.claude/commands/skillmama.md
Then type /skillmama in any Claude Code session.
Claude.ai:
- Clone the repo
zip -r skillmama.zip skillmama/- Go to Customize → Skills → + and upload the zip
- Type
/skillmamain any conversation
OpenAI Codex:
Place codex/AGENTS.md in your repo root, then ask naturally:
codex "find me the best job queue for this project"
Antigravity:
Load antigravity/PROMPT.md as the system prompt, then ask naturally.
All four adapters run the same pipeline and produce the same output format.
What SKILLmama Is Not
Not an IDE. Not autocomplete. Not a chatbot.
It's a capability oracle — it tells you what to use and why, with evidence. You still write the code. SKILLmama just makes sure you're writing it with the right tool.
The Repo
Apache 2.0 licensed. Works with Claude Code, Claude.ai, OpenAI Codex, and Antigravity.
/skillmama find me a vector database for my FastAPI project
/skillmama what auth library should I use for my Next.js app?
/skillmama scan my project and tell me what's missing
/skillmama find a .dwg parser for Node.js
Try it on your next project: github.com/Magithar/SKILLmama. If you've ever spent an afternoon picking the wrong library, I'd love to hear what you wish you'd known sooner.
If SKILLmama saves you time, a ⭐ on the repo goes a long way — it helps other developers find it.
Top comments (1)
Update: Part 2 is up — I added a security gate that catches dangerous libraries and malicious agent skills before they ever get scored. Read Part 2 →