Skills for Claude Code and Codex
Install the Thoth skills so your coding agent can govern tool calls, write policy, configure Thoth as code, and troubleshoot decisions.
Most teams instrument agents with an AI coding tool. The Thoth skills teach that tool how Thoth works, so you can ask in plain language and get code and configuration that keep enforcement fail-closed.
The skills follow the open Agent Skills format and are published as a plugin for Claude Code and Codex from atensecurity/thoth-skills. They link to these docs for versions and exact APIs.
Install
Or, inside a session:
/plugin install thoth --marketplace atensecurity/thoth-skills.
Update with claude plugin update thoth@atensecurity.
What's included
| Skill | Use it to |
|---|---|
thoth-govern-agent | Put an agent's tool calls behind Thoth with the Python, TypeScript or Go SDK and verify the first decisions |
thoth-policies | Choose a profile, confirm tool declarations and action classes, write action_class rules and plan approvals |
thoth-configure | Configure Thoth with the Terraform or Pulumi provider, thothctl, or the configuration MCP server |
thoth-mcp-proxy | Govern MCP servers used by desktop clients with the MCP proxy |
thoth-troubleshoot | Tell a policy refusal from a service error, read a decision's explanation and recover a quarantined agent |
Your agent picks the right skill from your request. For example:
- "Put this agent's tool calls behind Thoth."
- "Which Thoth profile fits this agent, and what would it step up or block?"
- "Manage our Thoth governance settings in Terraform."
- "Why did Thoth refuse this tool call?"
How the skills behave
- Keys stay out of code. The agent asks for your tenant ID, API URL and key and reads them from environment variables or your secret manager. It keeps the runtime execute key and the organization configuration key apart.
- Enforcement stays fail-closed. The skills never add a fallback that
runs a tool without a Thoth decision, and treat
approved_scopeas context, not permission. - Changes are reviewed first. Configuration goes through a Terraform plan, a Pulumi preview, or a server-generated preview from the configuration MCP server. A commit made while signed in returns an approval link you approve in the browser.
Skills guide your coding agent; they don't grant it access. To let your agent inspect and preview Thoth configuration directly, also connect the configuration MCP server.
Prefer a one-off prompt?
Every docs page has Copy agent prompt and View as Markdown buttons that point your agent at that page and llms.txt without installing anything.