# Skills for Claude Code and Codex

> Install the Thoth skills so your coding agent can govern tool calls, write policy, configure Thoth as code, and troubleshoot decisions.

Source: https://docs.atensecurity.com/docs/agent-skills

Most teams instrument agents with an AI coding tool. The Thoth skills teach
that tool how Thoth works, so you can ask in plain language and get code and
configuration that keep enforcement fail-closed.

The skills follow the open [Agent Skills](https://agentskills.io) format and
are published as a plugin for Claude Code and Codex from
[atensecurity/thoth-skills](https://github.com/atensecurity/thoth-skills).
They link to these docs for versions and exact APIs.

## Install

**Claude Code**

```bash title="Terminal"
claude plugin marketplace add atensecurity/thoth-skills
claude plugin install thoth@atensecurity
```

Or, inside a session:
`/plugin install thoth --marketplace atensecurity/thoth-skills`.
Update with `claude plugin update thoth@atensecurity`.

**Codex**

```bash title="Terminal"
codex plugin marketplace add atensecurity/thoth-skills
codex plugin add thoth@atensecurity
```

Or open `/plugins` in Codex and install **Thoth** from the Aten Security
marketplace. Update with `codex plugin marketplace upgrade atensecurity`.

**Other agents**

Copy the folders under
[`skills/`](https://github.com/atensecurity/thoth-skills/tree/main/skills)
into your agent's skills directory: `.agents/skills/` in a repository to share
them with your team, or `~/.agents/skills/` for yourself.

## What's included

| Skill | Use it to |
| --- | --- |
| `thoth-govern-agent` | Put an agent's tool calls behind Thoth with the [Python](https://docs.atensecurity.com/docs/sdks/python), [TypeScript](https://docs.atensecurity.com/docs/sdks/typescript) or [Go](https://docs.atensecurity.com/docs/sdks/go) SDK and verify the first decisions |
| `thoth-policies` | Choose a [profile](https://docs.atensecurity.com/docs/getting-started/profiles), confirm tool declarations and action classes, write `action_class` rules and plan approvals |
| `thoth-configure` | Configure Thoth with the [Terraform](https://docs.atensecurity.com/docs/terraform-provider) or [Pulumi](https://docs.atensecurity.com/docs/pulumi-provider) provider, `thothctl`, or the [configuration MCP server](https://docs.atensecurity.com/docs/mcp/configure-thoth) |
| `thoth-mcp-proxy` | Govern MCP servers used by desktop clients with the [MCP proxy](https://docs.atensecurity.com/docs/mcp/proxy) |
| `thoth-troubleshoot` | Tell a policy refusal from a service error, read a decision's [explanation](https://docs.atensecurity.com/docs/api-reference/explain) and recover a quarantined agent |

Your agent picks the right skill from your request. For example:

- "Put this agent's tool calls behind Thoth."
- "Which Thoth profile fits this agent, and what would it step up or block?"
- "Manage our Thoth governance settings in Terraform."
- "Why did Thoth refuse this tool call?"

## How the skills behave

- **Keys stay out of code.** The agent asks for your tenant ID, API URL and
  key and reads them from environment variables or your secret manager. It
  keeps the runtime execute key and the organization configuration key apart.
- **Enforcement stays fail-closed.** The skills never add a fallback that
  runs a tool without a Thoth decision, and treat `approved_scope` as context,
  not permission.
- **Changes are reviewed first.** Configuration goes through a Terraform plan,
  a Pulumi preview, or a server-generated preview from the configuration MCP
  server. A commit made while signed in returns an approval link you approve
  in the browser.

Skills guide your coding agent; they don't grant it access. To let your agent
inspect and preview Thoth configuration directly, also connect the
[configuration MCP server](https://docs.atensecurity.com/docs/mcp/configure-thoth).

## Prefer a one-off prompt?

Every docs page has **Copy agent prompt** and **View as Markdown** buttons
that point your agent at that page and [llms.txt](/llms.txt) without
installing anything.