The useful half works on your own data: spend by provider and model, a checkup with one prioritized fix, an expiry list that catches the card or certificate nobody is watching, and a cleanup audit that reports before it removes. The BYOK design is the part worth noting — keys are encrypted in a local vault on your own machine and the read tool returns only whether a key exists, not its value, so an agent can tell what is configured without ever seeing it. Be aware that part of the advertised tool surface is not implemented yet and says so when called.
An operations layer for the machine an agent runs on: LLM spend across providers, a health checkup, provider keys held in a local vault, and an audit of local clutter.
- Spend for the current period across Anthropic, OpenAI, DeepSeek, Qwen, Doubao and other platforms, and real token usage for today, this week or this month broken down by provider, agent and model
- A cheaper or faster model recommended for a specific task before it runs, with alternatives and an estimated saving
- An AI checkup: a health score out of 100 across six dimensions, today's single most important fix, and where savings are available
- Expiring assets — domains, SSL certificates, payment cards, API balances — ranked by severity with the renewal action attached
- A cleanup audit for local AI clutter: stale worktrees, oversized logs and cache folders, previewed before anything is removed
- A BYOK vault on your own machine — provider keys encrypted on disk under ~/.skillfm/ — with tools to save, remove and list which providers are present, but never to read a key value back
- A per-provider guide to generating a key, including its risk level, before you ask the user for one
- Suggestion preferences you control: how often suggestions appear, quiet hours, and which categories are switched off, plus acceptance and rejection recorded so the suggestions adapt
- Cross-device memory searched, saved to and listed — a Pro feature backed by Mem0
- Setup helpers: the optional LLM gateway configured in a detected IDE, and SkillFM's guidance injected into the agent harness so the tools actually get called
- A daily report that runs the checkup and renders a short push message
Run it with npx -y @skillfm/mcp@latest over stdio, from the npm package @skillfm/mcp, currently 0.1.2. That package is a thin launcher that delegates to @skillfm/local, which is the actual runtime. Activation is a device-code flow you complete yourself: start the local sidecar, which binds only to 127.0.0.1 and writes its address to ~/.skillfm/local.json, then approve the real device code it returns in your browser. Provider keys stay on the machine in the local vault and are never returned to an agent. The memory tools are a Pro feature. A number of the listed tools are Phase 0 placeholders — calling one returns a not-implemented response rather than a result — and a few others are marked deprecated, so check what responds before building a workflow on it.
One command — npx -y @skillfm/mcp@latest