1. On the Skill Set detail page, find the Enabled Skills section.
2. Click Add App.
3. Search for and select the app you want to add (e.g., Google Sheets).
4. Select a connection — choose which authenticated account to use. If you haven't connected this app yet, click Create new connection to set one up.
5. Choose your action mode (see below).
6. Click Add Entry.

You can add multiple entries to a single Skill Set — even multiple entries for the same app with different connections. For example, you could add two Google Sheets entries, one for your personal account and one for a shared team account.

When configuring an entry, you choose how much access to grant:

All actions (unrestricted)
Every action available for that app is exposed. If new actions are added to the app in the future, they'll automatically be included. This is the simplest option when you trust the consumer of the Skill Set.

Restricted
You hand-pick exactly which actions to expose. Only the actions you check will be available. This is ideal when you want tight control — for example, allowing an agent to read from a spreadsheet but not delete it.

To switch between modes, use the All actions / Restricted toggle in the action selector.

When using Restricted mode, you can lock specific parameter values for any action. Locked parameters are hidden from the AI agent or CLI caller — they're silently applied on every call.

Example use cases:

• Lock a Slack "send message" action to a specific channel, so the agent can only post to #alerts
• Lock a Google Sheets action to a specific spreadsheet ID, so the agent can only read from one sheet
• Lock an email "send" action to a specific recipient

To hardcode a parameter:

1. Select an action in Restricted mode.
2. Find the parameter you want to lock in the parameter list below the action.
3. Toggle the Lock switch next to it.
4. Set the value you want to hardcode.
5. Click Save Changes (or Add Entry for new entries).

You can lock as many or as few parameters as you need. Unlocked parameters remain dynamic and will be filled in by the AI agent or CLI caller at runtime.

1. On the Skill Set detail page, find the Enabled Component Libraries section.
2. Click Add Library.
3. Search for and select a component library from the list. Only libraries that have been published and set to "live" will appear.
4. The library is added immediately with all its components enabled.

By default, all components in a library are exposed. To restrict which components are available:

1. Click the Edit button on the component library card.
2. Check or uncheck individual components.
3. Click Save Changes.

If you uncheck all components, you'll be prompted to remove the library entirely.

Component library tools are asynchronous. When called, they start a workflow run and return a statusId. The caller then polls for the result using stpr status <statusId> or the __poll_status meta-tool. This means component tools can handle longer-running operations that would time out with a synchronous call.

Static tokens are the simplest way to authenticate. They're ideal for scripts, cron jobs, CI/CD pipelines, and other automated workflows.

Generating a token:

1. On the Skill Set detail page, scroll to the Tokens section.
2. Click Generate Token.
3. Enter a name for the token (e.g., "Deploy Script", "GitHub Action").
4. Optionally set an expiry date. If left blank, the token never expires.
5. Click Generate.
6. Copy the token immediately — it will only be shown once. Tokens are prefixed with sst_.

Using a static token:

Pass the token as a Bearer token in the Authorization header:

Authorization: Bearer sst_your_token_here

Or with the CLI:

stpr --token sst_your_token_here list

Or set it as an environment variable:

export STEPPER_SKILL_TOKEN=sst_your_token_here

OAuth authentication is used by the stpr CLI and any MCP client that supports the OAuth 2.0 Authorization Code flow with PKCE. This is the recommended method for interactive use.

When an MCP client connects to your Skill Set's MCP URL, it will be guided through the OAuth flow automatically — opening a browser window where you select which Skill Set to authorize and approve access.

OAuth sessions are visible in the Active OAuth Sessions section of the Skill Set detail page. You can revoke any session at any time.

OAuth details:

• Access tokens expire after 1 hour and are automatically refreshed
• Refresh tokens are valid for 30 days
• PKCE is required (code challenge method: S256)

Every Skill Set has a dedicated MCP endpoint URL displayed on its detail page. Copy it using the copy button next to the URL.

The URL format is:

https://mcp.stepper.io/skill-sets/mcp

Authentication is per-token — the same URL is used for all Skill Sets, and the token determines which Skill Set is accessed.

Connecting to Claude Desktop, Cursor, Windsurf, or other MCP clients:

1. Copy the MCP URL from the Skill Set detail page.
2. In your MCP client's settings, add a new MCP server.
3. Paste the URL and provide your authentication token (or use the OAuth flow if supported by the client).
4. The Skill Set's tools will appear in your AI agent's tool list.

The stpr CLI is a command-line tool for interacting with Skill Sets. Install it globally:

npm install -g stpr

Quick start:

 # Authenticate via OAuth (opens browser)
stpr login

 # List all available skills
stpr list

 # Explore a specific service
stpr google-sheets

 # Call a skill
stpr google-sheets create_sheet --call -i '{"name": "Q1 Report"}'

The CLI supports multiple Skill Set profiles. Use stpr profiles to list them and stpr use <name> to switch between them.

For full CLI documentation, see the stpr README.

Every Skill Set has an Active/Inactive toggle. When a Skill Set is inactive:

• All MCP requests are rejected
• Existing tokens remain valid but cannot be used
• The Skill Set configuration is preserved

This is useful for temporarily disabling access without deleting tokens or reconfiguring entries. Toggle the switch on the Skill Set list page or the detail page.

The Recent Calls section at the bottom of the Skill Set detail page shows a log of all calls made in the last 30 days. Each entry shows:

• Tool name — which action was called (e.g., google-sheets → add_row)
• Status — success or error
• Auth method — whether the call used a static token or OAuth, and the token/session name
• Timestamp — when the call was made
• Event ID — a unique identifier for the call (useful for debugging)

Call logs are automatically purged after 30 days.

Revoking a static token:

1. Go to the Skill Set detail page.
2. In the Tokens table, click the delete icon next to the token you want to revoke.

Revoking an OAuth session:

1. Go to the Skill Set detail page.
2. In the Active OAuth Sessions table, click the delete icon next to the session.

Deleting a Skill Set:
Deleting a Skill Set revokes all associated tokens and OAuth sessions immediately. This action cannot be undone.

Many integration actions have fields that change based on other field values. For example, when adding a row to Google Sheets, the available columns depend on which spreadsheet and worksheet you've selected.

Skill Sets handle this through special protocol methods. AI agents use meta-tools (__get_tool_params and __get_parameter_options) to progressively discover and fill in parameters. The stpr CLI handles this naturally — calling an action without --call returns the current parameter schema, and --options fetches dropdown values.

Tools are named using the pattern <service>.<action> (e.g., google-sheets.add_row, slack.send_message). If the same app appears multiple times with different connections, the connection name is appended to disambiguate (e.g., google-sheets.add_row_personal, google-sheets.add_row_team).