removed restriction to allow only 512 files and 16 mb for each skill, it's not mandatory as per recent update

Author: vijay

src/mcp/client/skills.py

@@ -9,9 +9,12 @@
         for skill in await skills.bind(client).list_skills():
             print(skill.uri, skill.frontmatter["description"])
 
-`bind(client)` returns a `BoundSkills`. Each verb validates that the server
-advertises the extension before sending; `list_skills` and `read_directory`
-follow `nextCursor` to completion, so one call returns every page's results.
+`bind(client)` returns a `BoundSkills`. Its catalog verbs — `list_skills`,
+`get_skill`, and `read_directory` — check that the server advertises the
+extension and validate its response; `list_skills` and `read_directory` follow
+`nextCursor` to completion, so one call returns every page's results.
+`read_skill_uri` is a thin `resources/read` alias that does neither — verify its
+result with `verify_skill_resource`.
 """
 
 from __future__ import annotations
@@ -68,9 +71,13 @@ def bind(self, client: Client) -> BoundSkills:
 class BoundSkills:
     """The SEP-2640 verbs bound to one connected session.
 
-    Obtain it from `Skills.bind(client)`. `list_skills` and `read_directory`
-    follow `nextCursor` to completion; every method validates the server's
-    response against the SEP-2640 conformance rules before returning it.
+    Obtain it from `Skills.bind(client)`. The catalog verbs — `list_skills`,
+    `get_skill`, and `read_directory` — check that the server advertises the
+    extension and validate its response against the SEP-2640 conformance rules
+    before returning; `list_skills` and `read_directory` also follow
+    `nextCursor` to completion. `read_skill_uri` is the exception: a thin
+    `resources/read` alias that neither checks advertisement nor validates —
+    pair it with `verify_skill_resource`.
     """
 
     def __init__(self, session: ClientSession) -> None:
@@ -88,8 +95,9 @@ async def list_skills(self, params: ListSkillsParams | None = None) -> list[Skil
         """Call `skills/list`, following `nextCursor` to completion, and validate the result.
 
         Raises:
-            ValueError: If the server doesn't advertise the Skills extension, or
-                its response is not SEP-2640 conformant.
+            ValueError: If the server doesn't advertise the Skills extension, its
+                response is not SEP-2640 conformant, or it repeats a pagination cursor.
+            MCPError: If the server returns an error response.
         """
         self._require_extension()
         base = params if params is not None else ListSkillsParams()
@@ -118,6 +126,8 @@ async def get_skill(self, uri: str) -> Skill:
         Raises:
             ValueError: If the server doesn't advertise the Skills extension, its
                 response names a different skill, or the skill is not conformant.
+            MCPError: If the server returns an error response, such as `-32602`
+                for a URI it does not serve.
         """
         self._require_extension()
         result = await self._session.send_request(GetSkillRequest(params=GetSkillParams(uri=uri)), GetSkillResult)
@@ -133,6 +143,11 @@ async def read_skill_uri(self, uri: str) -> ReadResourceResult:
         file regardless of whether the skill was ever enumerated. Verify the
         result against a held `Skill` entry with `verify_skill_resource` before
         treating it as trusted content — this call does not verify anything itself.
+
+        Raises:
+            MCPError: If the server returns an error response.
+            RuntimeError: If the server returns an `InputRequiredResult`; this
+                alias does not drive the input-required loop.
         """
         return await self._session.read_resource(uri)
 
@@ -141,7 +156,9 @@ async def read_directory(self, uri: str, params: ReadDirectoryParams | None = No
 
         Raises:
             ValueError: If the server doesn't advertise the `directoryRead`
-                setting, or its response is not a valid child listing of `uri`.
+                setting, its response is not a valid child listing of `uri`, or
+                it repeats a pagination cursor.
+            MCPError: If the server returns an error response.
         """
         self._require_extension(directory_read=True)
         base = params if params is not None else ReadDirectoryParams(uri=uri)

src/mcp/shared/skills.py

@@ -24,10 +24,17 @@
 METHOD_READ_DIRECTORY = "resources/directory/read"
 
 MAX_RESOURCES_PER_SKILL = 512
-"""SEP-2640 per-skill resource-count limit, `SKILL.md` included."""
+"""SEP-2640 per-skill resource-count threshold (`SKILL.md` included).
+
+A SHOULD NOT limit, not a hard cap: the spec requires a host to support skills
+*up to and including* 512 entries and permits it to support larger ones, so
+`validate_skill` does not reject an over-count manifest."""
 
 MAX_TOTAL_SIZE = 16 * 1024 * 1024
-"""SEP-2640 per-skill total-byte-size limit (16 MiB), summed over `resources[].size`."""
+"""SEP-2640 per-skill total-byte-size threshold (16 MiB), summed over `resources[].size`.
+
+A SHOULD NOT limit, not a hard cap (see `MAX_RESOURCES_PER_SKILL`); an over-size
+manifest is not rejected."""
 
 _NAME_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
 _DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
@@ -180,9 +187,11 @@ def validate_skill(skill: Skill) -> None:
     """Validate `skill` against the SEP-2640 and Agent Skills conformance rules.
 
     Checks the frontmatter's `name`/`description` fields, that `resources` (when
-    not `"dynamic"`) is complete and within the `MAX_RESOURCES_PER_SKILL`/
-    `MAX_TOTAL_SIZE` limits, and that every resource entry names a file within
-    the skill's own directory with a well-formed digest.
+    not `"dynamic"`) is complete — every entry names a file within the skill's
+    own directory, has a well-formed digest, and `SKILL.md` is present. The
+    512-entry/16-MiB limits are SEP-2640 SHOULD NOT thresholds, not MUST NOT, so
+    an over-limit manifest is accepted (a conforming host must support up to the
+    limits and may support larger).
 
     Raises:
         ValueError: If `skill` violates any of the above.
@@ -200,10 +209,7 @@ def validate_skill(skill: Skill) -> None:
     if skill.resources == "dynamic":
         return
     resources = skill.resources
-    if len(resources) > MAX_RESOURCES_PER_SKILL:
-        raise ValueError(f"skill {skill.uri!r} has {len(resources)} resources, exceeding {MAX_RESOURCES_PER_SKILL}")
     seen: set[str] = set()
-    total_size = 0
     for resource in resources:
         _validate_resource_uri_in_skill(skill.uri, resource.uri)
         if resource.uri in seen:
@@ -213,11 +219,8 @@ def validate_skill(skill: Skill) -> None:
             raise ValueError(f"skill {skill.uri!r} resource {resource.uri!r} has an invalid SHA-256 digest")
         if resource.size < 0:
             raise ValueError(f"skill {skill.uri!r} resource {resource.uri!r} has a negative size")
-        total_size += resource.size
     if skill.uri not in seen:
         raise ValueError(f"skill {skill.uri!r} resources does not include its own SKILL.md")
-    if total_size > MAX_TOTAL_SIZE:
-        raise ValueError(f"skill {skill.uri!r} has {total_size} bytes, exceeding {MAX_TOTAL_SIZE}")
 
 
 def validate_list_result(result: ListSkillsResult) -> None:
@@ -250,7 +253,11 @@ def parse_directory_uri(uri: str) -> tuple[str, str, str]:
 
 
 def validate_directory_result(uri: str, result: ReadDirectoryResult) -> None:
-    """Validate that `result.resources` are exactly the direct children of `uri`.
+    """Validate that each entry in `result.resources` is a unique direct child of `uri`.
+
+    Checks containment and shape only — that every listed resource is a direct
+    child of `uri` with a unique `uri` and `name`. It cannot confirm the listing
+    is exhaustive, since it has no independent view of the directory's contents.
 
     Raises:
         ValueError: If `uri` is malformed, or any entry is not a direct child,

tests/shared/test_skills.py

@@ -249,25 +249,34 @@ def test_validate_skill_rejects_malformed_digest_formats(digest: str) -> None:
         validate_skill(skill)
 
 
-def test_validate_skill_rejects_more_than_512_resources() -> None:
-    """SEP-2640 Limits: 512 entries per skill, `SKILL.md` included."""
+def test_validate_skill_accepts_exactly_512_resources() -> None:
+    """SEP-2640 Limits: a host MUST support skills up to and including 512 entries
+    (`SKILL.md` counted), so a 512-entry manifest validates."""
+    root = "skill://git-workflow/SKILL.md"
+    resources = [_resource(root)] + [_resource(f"skill://git-workflow/f{i}.md") for i in range(511)]
+    skill = Skill(uri=root, frontmatter={"name": "git-workflow", "description": "d"}, resources=resources)
+    validate_skill(skill)
+
+
+def test_validate_skill_accepts_more_than_512_resources() -> None:
+    """SEP-2640 Limits: 512 is a SHOULD NOT threshold, not a hard cap — a host MAY support
+    larger skills, so an over-count manifest is not rejected."""
     root = "skill://git-workflow/SKILL.md"
     resources = [_resource(root)] + [_resource(f"skill://git-workflow/f{i}.md") for i in range(512)]
     skill = Skill(uri=root, frontmatter={"name": "git-workflow", "description": "d"}, resources=resources)
-    with pytest.raises(ValueError, match="exceeding 512"):
-        validate_skill(skill)
+    validate_skill(skill)
 
 
-def test_validate_skill_rejects_total_size_over_16mib() -> None:
-    """SEP-2640 Limits: 16 MiB total per skill, summed over `resources[].size`."""
+def test_validate_skill_accepts_total_size_over_16mib() -> None:
+    """SEP-2640 Limits: 16 MiB total is a SHOULD NOT threshold, not a hard cap — an over-size
+    manifest is not rejected."""
     root = "skill://git-workflow/SKILL.md"
     skill = Skill(
         uri=root,
         frontmatter={"name": "git-workflow", "description": "d"},
         resources=[_resource(root, size=16 * 1024 * 1024 + 1)],
     )
-    with pytest.raises(ValueError, match="exceeding"):
-        validate_skill(skill)
+    validate_skill(skill)
 
 
 def test_validate_skill_accepts_dynamic_resources_without_further_checks() -> None: