--- title: Stepper Skill Sets | Paperform Help Center | Paperform description: Skill Sets let you bundle your Stepper integration actions into secure, curated toolkits and expose them to AI agents, the stpr CLI, or MCP-compatible client. url: "https://paperform.co/help/articles/stepper-skill-sets" type: static generatedAt: "2026-09-21T00:46:23.969Z" --- Stepper Skill Sets ## Overview > Note: Skill Sets is in beta - if you have any questions or feedback, please contact us via live chat in the bottom right. Skill Sets let you bundle your Stepper integration actions into secure, curated toolkits and expose them to AI agents, the `stpr` CLI, or any MCP-compatible client. This guide covers everything you need to know to create, configure, and use Skill Sets. A Skill Set is a named, permissioned collection of integration actions from your connected apps in Stepper. Instead of giving an AI agent or script unrestricted access to all your integrations, you define exactly which apps, connections, and actions it can use — and optionally lock down specific parameter values. Every Skill Set gets its own MCP (Model Context Protocol) endpoint, making it instantly compatible with AI tools like Claude, Cursor, Windsurf, and any other MCP client. **Key benefits:** - **Scoped access** — only expose the actions you choose - **Guard rails** — lock parameter values to prevent misuse (e.g., hardcode a Slack channel so an agent can only post to `#alerts`) - **Multiple auth methods** — static tokens for scripts, OAuth for interactive tools - **Audit trail** — every call is logged with tool name, status, and caller identity - **Works everywhere** — standard MCP protocol, plus a dedicated CLI ## Creating a Skill Set 1. Navigate to **Skill Sets** in your Stepper dashboard (found in the left sidebar). 2. Click **New Skill Set** in the top right. 3. Enter a **Name** for your Skill Set (e.g., "Marketing Tools", "Deploy Script", "Claude Assistant"). 4. Optionally add a **Description** to help your team understand its purpose. 5. Click **Create**. You'll be taken to the Skill Set detail page where you can add entries, generate tokens, and configure access. ## Adding App Entries ### Adding an entry 1. On the Skill Set detail page, find the **Enabled Skills** section. 2. Click **Add App**. 3. Search for and select the app you want to add (e.g., Google Sheets). 4. **Select a connection** — choose which authenticated account to use. If you haven't connected this app yet, click **Create new connection** to set one up. 5. **Choose your action mode** (see below). 6. Click **Add Entry**. You can add multiple entries to a single Skill Set — even multiple entries for the same app with different connections. For example, you could add two Google Sheets entries, one for your personal account and one for a shared team account. ### Unrestricted vs Restricted Mode When configuring an entry, you choose how much access to grant: **All actions (unrestricted)** Every action available for that app is exposed. If new actions are added to the app in the future, they'll automatically be included. This is the simplest option when you trust the consumer of the Skill Set. **Restricted** You hand-pick exactly which actions to expose. Only the actions you check will be available. This is ideal when you want tight control — for example, allowing an agent to read from a spreadsheet but not delete it. To switch between modes, use the **All actions** / **Restricted** toggle in the action selector. ### Hardcoding Parameters When using Restricted mode, you can **lock specific parameter values** for any action. Locked parameters are hidden from the AI agent or CLI caller — they're silently applied on every call. **Example use cases:** - Lock a Slack "send message" action to a specific channel, so the agent can only post to `#alerts` - Lock a Google Sheets action to a specific spreadsheet ID, so the agent can only read from one sheet - Lock an email "send" action to a specific recipient To hardcode a parameter: 1. Select an action in Restricted mode. 2. Find the parameter you want to lock in the parameter list below the action. 3. Toggle the **Lock** switch next to it. 4. Set the value you want to hardcode. 5. Click **Save Changes** (or **Add Entry** for new entries). You can lock as many or as few parameters as you need. Unlocked parameters remain dynamic and will be filled in by the AI agent or CLI caller at runtime. ## Adding Component Libraries ### Adding a component library 1. On the Skill Set detail page, find the **Enabled Component Libraries** section. 2. Click **Add Library**. 3. Search for and select a component library from the list. Only libraries that have been published and set to "live" will appear. 4. The library is added immediately with all its components enabled. ### Restricting components By default, all components in a library are exposed. To restrict which components are available: 1. Click the **Edit** button on the component library card. 2. Check or uncheck individual components. 3. Click **Save Changes**. If you uncheck all components, you'll be prompted to remove the library entirely. ### How component tools work Component library tools are **asynchronous**. When called, they start a workflow run and return a `statusId`. The caller then polls for the result using `stpr status ` or the `__poll_status` meta-tool. This means component tools can handle longer-running operations that would time out with a synchronous call. ## Authentication ### Static Tokens Static tokens are the simplest way to authenticate. They're ideal for scripts, cron jobs, CI/CD pipelines, and other automated workflows. **Generating a token:** 1. On the Skill Set detail page, scroll to the **Tokens** section. 2. Click **Generate Token**. 3. Enter a **name** for the token (e.g., "Deploy Script", "GitHub Action"). 4. Optionally set an **expiry date**. If left blank, the token never expires. 5. Click **Generate**. 6. **Copy the token immediately** — it will only be shown once. Tokens are prefixed with `sst_`. **Using a static token:** Pass the token as a Bearer token in the `Authorization` header: ``` Authorization: Bearer sst_your_token_here ``` Or with the CLI: ```bash stpr --token sst_your_token_here list ``` Or set it as an environment variable: ```bash export STEPPER_SKILL_TOKEN=sst_your_token_here ``` ### OAuth Sessions OAuth authentication is used by the `stpr` CLI and any MCP client that supports the OAuth 2.0 Authorization Code flow with PKCE. This is the recommended method for interactive use. When an MCP client connects to your Skill Set's MCP URL, it will be guided through the OAuth flow automatically — opening a browser window where you select which Skill Set to authorize and approve access. OAuth sessions are visible in the **Active OAuth Sessions** section of the Skill Set detail page. You can revoke any session at any time. **OAuth details:** - Access tokens expire after **1 hour** and are automatically refreshed - Refresh tokens are valid for **30 days** - PKCE is required (code challenge method: S256) ### Connecting to AI Agents ### Using the MCP URL Every Skill Set has a dedicated MCP endpoint URL displayed on its detail page. Copy it using the copy button next to the URL. The URL format is: ``` https://mcp.stepper.io/skill-sets/mcp ``` Authentication is per-token — the same URL is used for all Skill Sets, and the token determines which Skill Set is accessed. **Connecting to Claude Desktop, Cursor, Windsurf, or other MCP clients:** 1. Copy the MCP URL from the Skill Set detail page. 2. In your MCP client's settings, add a new MCP server. 3. Paste the URL and provide your authentication token (or use the OAuth flow if supported by the client). 4. The Skill Set's tools will appear in your AI agent's tool list. ### Using the stpr CLI The `stpr` CLI is a command-line tool for interacting with Skill Sets. Install it globally: ```bash npm install -g stpr ``` **Quick start:** ```sh # Authenticate via OAuth (opens browser) stpr login # List all available skills stpr list # Explore a specific service stpr google-sheets # Call a skill stpr google-sheets create_sheet --call -i '{"name": "Q1 Report"}' ``` The CLI supports multiple Skill Set profiles. Use `stpr profiles` to list them and `stpr use ` to switch between them. For full CLI documentation, see the [stpr README](https://www.npmjs.com/package/stpr). ## Managing Skill Sets ### Activating and Deactivating Every Skill Set has an **Active/Inactive** toggle. When a Skill Set is inactive: - All MCP requests are rejected - Existing tokens remain valid but cannot be used - The Skill Set configuration is preserved This is useful for temporarily disabling access without deleting tokens or reconfiguring entries. Toggle the switch on the Skill Set list page or the detail page. ### Monitoring Usage The **Recent Calls** section at the bottom of the Skill Set detail page shows a log of all calls made in the last 30 days. Each entry shows: - **Tool name** — which action was called (e.g., `google-sheets → add_row`) - **Status** — success or error - **Auth method** — whether the call used a static token or OAuth, and the token/session name - **Timestamp** — when the call was made - **Event ID** — a unique identifier for the call (useful for debugging) Call logs are automatically purged after 30 days. ### Revoking Access **Revoking a static token:** 1. Go to the Skill Set detail page. 2. In the **Tokens** table, click the delete icon next to the token you want to revoke. **Revoking an OAuth session:** 1. Go to the Skill Set detail page. 2. In the **Active OAuth Sessions** table, click the delete icon next to the session. **Deleting a Skill Set:** Deleting a Skill Set revokes all associated tokens and OAuth sessions immediately. This action cannot be undone. ## How It Works ### Dynamic Parameters Many integration actions have fields that change based on other field values. For example, when adding a row to Google Sheets, the available columns depend on which spreadsheet and worksheet you've selected. Skill Sets handle this through special protocol methods. AI agents use meta-tools (`__get_tool_params` and `__get_parameter_options`) to progressively discover and fill in parameters. The `stpr` CLI handles this naturally — calling an action without `--call` returns the current parameter schema, and `--options` fetches dropdown values. ### Tool Naming Tools are named using the pattern `.` (e.g., `google-sheets.add_row`, `slack.send_message`). If the same app appears multiple times with different connections, the connection name is appended to disambiguate (e.g., `google-sheets.add_row_personal`, `google-sheets.add_row_team`). ## FAQ **Can I add the same app to multiple Skill Sets?** Yes. Each Skill Set is independent. You can have the same app and connection in as many Skill Sets as you need, each with different action restrictions. **What happens if I add a new action to a Restricted entry?** Nothing changes automatically. You'll need to edit the entry and check the new action to expose it. With unrestricted entries, new actions are exposed automatically. **Can I use the same token across multiple Skill Sets?** No. Each token is tied to a single Skill Set. **Is there a limit to how many entries a Skill Set can have?** There's no hard limit. Add as many app entries and component libraries as you need. **What happens when a token expires?** Expired static tokens are rejected immediately. OAuth tokens are automatically refreshed by the CLI if a valid refresh token exists. If the refresh token has also expired (after 30 days), you'll need to re-authenticate with `stpr login`. **Can I use Skill Sets without the CLI?** Yes. Any MCP-compatible client can connect directly to the MCP URL. You can also make raw HTTP requests to the JSON-RPC endpoint if you prefer. **How do I connect a Skill Set to Claude?** Add the MCP URL as a new MCP server in Claude's settings. Provide your static token or use the OAuth flow when prompted. Your Skill Set's tools will then be available to Claude as callable tools. **What's the difference between an app entry and a component library?** App entries expose individual integration actions (like "send a Slack message" or "add a row to Google Sheets"). Component libraries expose full Stepper workflows as single tools, which can orchestrate multi-step processes across multiple apps. Component library tools run asynchronously. **Can I see who is using my Skill Set?** Yes. The Recent Calls section shows every call with the authentication method and token/session name. This lets you track which token or OAuth session made each call.