Kuroco Skills Reference
This page provides a detailed description of the 13 skills included in Kuroco Skills.
kuroco-docs - Documentation search
A skill that assists with searching and referencing Kuroco official documentation.
Features
- Cross-search of official documentation bundled with the package
- Quick reference organized by purpose (API, authentication, frontend, content management, etc.)
Example queries
"I want to know how to configure endpoints in Kuroco"
"Show me the login API specification"
"How do I write filter queries?"
Bundled documentation structure
Each page of the official documentation is bundled as a consolidated file per category. A single consolidated file contains multiple official pages, and the slug and official site URL of the source page are shown directly under each page heading.
| File | Content |
|---|---|
INDEX.md | List of all files and the number of pages they contain |
tutorials-*.md | Tutorials (auth-member / frontend / content / api-custom / ai-mcp / ec / form-mail / integration / admin-customize / misc) |
reference-*.md | Reference (api / content / smarty-trigger / mcp-ai / file / misc) |
management-*.md | Admin panel guides (account / api / campaign / content / ec / integration / member / operation / misc) |
faq-*.md | FAQ (content / frontend / api / api-error / admin / email-form / domain / file / login-session / password / smarty / tls / infrastructure / deploy / member / email / assessment / contracts / other) |
about.md | Kuroco overview, pricing, limitations, security |
troubleshooting.md | Troubleshooting |
Announcements and release notes are not bundled because freshness matters for them. Refer to the official site (https://kuroco.app/docs/ ) for these.
kuroco-app-builder - App/site building workflow
A skill that orchestrates the entire process of building a web app or site on Kuroco from scratch. Implementation of individual features is delegated to the specialized skills; this skill covers the process (phase design) and the handoffs between phases.
Features
- Frontend-first (mock-first) building flow
- Feature-to-Kuroco-feature mapping table (content structures, categories, members, forms, favorites, comments, EC, etc.)
- Criteria for choosing an authentication method (none / Cookie / dynamic access token / static access token)
- Checking Admin MCP scope in advance (
whoami) and deciding whether work can start - The contract of writing mock data in Kuroco API response shapes (
{ list, pageInfo }/{ details }) and the pattern for switching to the real API - Progress checklist and a list of anti-patterns
Usage examples
"I want to build a whole app on Kuroco"
"Build a new site for me"
"I want to build a blog site. Show me a working screen first"
"Build a membership site from scratch"
Keywords
app building site building prototype mock-first frontend-first content structure TopicsGroup endpoint creation KurocoFront deploy whoami mcp:tools.all
Building phases
| Phase | Content |
|---|---|
| Phase 0 | Requirements interview, feature-to-Kuroco mapping, authentication decision, Admin MCP scope check |
| Phase 1 | Building the frontend with mock data and finalizing the screens |
| Phase 2 | Creating content structures, categories, and sample data (Admin MCP) |
| Phase 3 | Endpoint creation and security settings |
| Phase 4 | Connecting live data, authentication and forms, deployment |
When the data model is already fixed or the screens are standard, you can switch to a backend-first order (phase 2 -> 3 -> 1 -> 4).
kuroco-api-content - API integration & content management
A skill that provides best practices for Kuroco API design, implementation, and content management (CRUD operations).
This skill consolidates the former kuroco-api-integration and kuroco-content-management skills.
Features
API integration:
- Endpoint design patterns (URL structure, key models, operations)
- Authentication methods (none / static access token / dynamic access token / Cookie)
- CORS settings, caching strategies, rate limiting
- Error handling patterns (401 / 403 / 429)
Content management:
- Content structure (Topics / TopicsGroup / TopicsCategory)
- Custom fields (ext_col) setup and usage
- Topics API operations (list / details / insert / update / delete / bulk_upsert)
- Filter query syntax and usage, pagination
- Multilingual support (
langs_open_flg) - File uploads, CSV import/export
- EC point operations (ECPoint)
Example queries
"I want to implement login with Kuroco API"
"How do I use token authentication?"
"I'm getting a CORS error. How do I configure it?"
"I want to create a content definition in Kuroco"
"How do I get a list of articles via API?"
"I want to filter articles by a specific category"
Keywords
Kuroco API endpoint settings authentication CORS Cookie authentication dynamic access token static access token JWT rate limiting credentials include 401 error 403 error 429 error pageInfo pagination langs_open_flg content definition Topics category WYSIWYG file upload CSV import ext_col filter order_query bulk_upsert topics_flg custom fields ECPoint
Authentication method comparison
| Method | Recommended use case | Features |
|---|---|---|
| None | Development and testing (not recommended for production) | No header required |
| Static access token | Server-to-server, public APIs | Fixed token in the X-RCMS-API-ACCESS-TOKEN header |
| Dynamic access token | Sites that require login (JWT) | Token obtained at login, sent in the X-RCMS-API-ACCESS-TOKEN header |
| Cookie | Web sites that require login | Session-based. credentials: 'include' required |
Filter query basic syntax
| Operator | Example |
|---|---|
=, != | filter=category_id = 1 |
>, >=, <, <= | filter=ymd >= "2024-01-01" |
contains, ncontains | filter=subject contains "keyword" |
in, nin | filter=category_id in [1, 2, 3] |
String values must be enclosed in double quotes. Single quotes are treated as part of the value including the quote characters, so the query returns 0 results instead of raising an error.
kuroco-frontend-integration - Frontend integration & KurocoFront deployment
A skill that provides integration patterns for Kuroco with Vite / Nuxt.js / Next.js, and deployment to KurocoFront.
This skill now includes the former kuroco-ai-deployment skill.
For a hands-on tutorial, see the Kuroco Sample Site Tutorial.
Features
Frontend integration:
- Integration patterns for Vite + Vue 3 / Nuxt 3 / Nuxt 2 / Next.js (App Router / Pages Router)
- Environment variables, project structure examples
- Authentication implementation (login / logout / auth check / signup)
- SPA / SSG / SSR configuration
- KurocoPages integration
- Third-party cookie issue solutions, XSS countermeasures
KurocoFront deployment:
kuroco_front.jsonconfiguration- Deployment via GitHub repository integration
- Direct deployment from the Admin MCP (upload zip →
KurocoFront-deploy→ check withKurocoFront-history) - Preview deploy (
is_preview) / production deploy, and notes on overwriting
Example queries
"I want to display Kuroco content with Nuxt3"
"How do I implement authentication with Next.js and Kuroco?"
"I want to generate a static site with SSG"
"Login doesn't work on Safari (cookie issue)"
"I want to deploy a Kuroco site to KurocoFront"
"I want to deploy to a preview environment first"
Keywords
Vite Nuxt3 Next.js App Router SPA SSG SSR useAsyncData $fetch composable useAuth KurocoPages credentials include third-party cookies XSS KurocoFront kuroco_front.json GitHub integration KurocoFront-deploy KurocoFront-history artifact_url stage_url is_preview CI/CD
Framework recommendations
| Framework | Recommended use case |
|---|---|
| Vite + Vue 3 | Simple SPAs (apps and tools that do not need SEO) |
| Nuxt.js 3.x | Content sites that need SEO (static HTML via SSG, recommended) |
| Nuxt.js 2.x | Existing Vue projects |
| Next.js 13+ (App Router) | New React projects |
| Next.js (Pages Router) | Existing React projects |
Deployment methods
| Method | Content |
|---|---|
| GitHub integration | Admin panel [KurocoFront] → GitHub repository integration. On push, GitHub Actions builds and deploys the artifact |
| Direct deployment from the Admin MCP | Upload the build artifact as a zip and deploy it with KurocoFront-deploy (asynchronous). Check the result with KurocoFront-history |
Only one current deployment is published per domain, and a new deployment replaces the existing published content. We recommend verifying with a preview deployment (is_preview: true) before deploying to production.
kuroco-server-processing - Smarty plugins & batch processing
A skill that provides a complete reference for Kuroco Smarty templates and automation patterns using batch processing, webhooks, and triggers.
This skill consolidates the former kuroco-smarty-plugins and kuroco-webhook-processing skills.
Features
Smarty plugin reference:
- Complete reference for 205 plugins
- Category index (API / string / array / form / auth / integration / file / Vue.js)
- Smarty basic syntax (variable assignment, loops, conditionals, modifiers)
- Security settings (IF_FUNCS / MODIFIER_FUNCS)
Batch processing & webhooks:
- Batch processing setup and execution frequency
- Internal API calls (
api_internal) - External API calls (
api) - Trigger processing (on content update / on form submission), trigger email addresses
- External service integration (Slack / Chatwork / SendGrid / email / GitHub Actions)
Example queries
"I want to get and display a list of articles with Smarty"
"How do I use the sendmail plugin?"
"How do I parse JSON in Smarty?"
"I want to generate CSV daily with batch processing"
"I want to send a Slack notification when content is updated"
"I want to trigger a deploy via GitHub Actions"
Keywords
Smarty plugin Smarty function Smarty modifier assign foreach escape date_format api_internal sendmail slack_post_message ai_completion write_file batch processing Webhook scheduled execution cron Slack notification Chatwork SendGrid GitHub Actions api trigger trigger email address custom function
Category reference
| Category | Key plugins |
|---|---|
| API & data retrieval | api_internal, assign_topics_list, assign_tag_list |
| String processing | escape, truncate, date_format, translate |
| Array operations | count, in_array, implode, explode |
| Form & UI | fileupload, inquiry_input, pager |
| Auth & permissions | rcms_auth, login, logout |
| External integration | sendmail, slack_post_message, ai_completion |
| File operations | write_file, put_file, read_file |
| Vue.js integration | rcms_vue_component, head_include |
Batch processing frequency
| Frequency | Use case |
|---|---|
| Every 15 minutes | When frequent sync is needed |
| Every 30 minutes | Near-real-time processing |
| Every hour | Periodic aggregation and updates |
| Daily (specified time) | Daily reports, backups |
kuroco-admin-mcp - Admin MCP connection & admin operations
A skill for setting up connections to the Admin MCP (management MCP server) and performing admin operations through MCP tools. This is the recommended approach when an AI agent performs Kuroco admin operations.
Features
- How to build module-scoped endpoint URLs (
/x/all,/x/all/readonly,/x/topics_group_5, etc.) - Three authentication methods (OAuth 2.0 authorization code flow / privileged static token / admin session) and CIMD usage
- OAuth scope design by permission level (the four levels
mcp:tools.read/mcp:tools.write/mcp:tools.all/mcp:admin, plus resource-level scopes) - Checking effective permissions in advance with
whoami - Connection setup from Claude Code, Claude (Web / Desktop), ChatGPT, and Codex CLI
- Tool naming rules (
{resource}-{verb}), usage flow, and file upload (staging then reference passing) - Troubleshooting "no tools listed", "audience mismatch", "permission error only when creating endpoints", and similar issues
Usage examples
"I want to operate Kuroco from Claude Desktop"
"I want to connect to the Admin MCP"
"Why are no MCP tools showing up?"
"I want to use MCP in read-only mode"
Keywords
Admin MCP MCP server MCP connection OAuth CIMD Issuer URL mcp:admin mcp:tools.all mcp:tools.write mcp:tools.read whoami scope tools/list privileged static token
Scope permission levels
| Scope | What it allows |
|---|---|
mcp:tools.read | Read-only across all modules (no writes) |
mcp:tools.write | Insert and update for topics / csvtable / tag / comment and similar. Delete is not allowed, and rcms_api, member, group, and batch are not included |
mcp:tools.all | All modules and all operations (except the exclusions below) |
mcp:admin | No restrictions. Only super users can approve it |
mcp:tools.write cannot be selected on its own; it is granted together with mcp:tools.read. Even with mcp:tools.all, you cannot create, change, or delete permission groups and general-purpose Smarty batches, grant a super user group to a member, or issue privileged static tokens.
Creating API definitions and endpoints requires mcp:tools.all or higher. Content structure creation works with mcp:tools.write, so the failure surfaces only right before endpoint creation. Check permissions.connection.scope with whoami before starting.
Prerequisites
- An admin member account for the target site (the OAuth flow goes through the admin panel login and consent screens)
- To restrict source IPs, configure "Admin MCP access restriction (IP address)" under [Environment settings] → [Admin panel]
Requests to the Admin MCP (/direct/rcms_api/admin_mcp/) are billed per request, the same as regular API requests.
kuroco-content-structure-design - Content structure design
A skill for making structural design decisions before creating a content structure (TopicsGroup). The actual creation is handed off to kuroco-content-structure-creation.
Features
- Deciding whether to split a content structure (extension field limits, differences in the nature of the content)
- Deciding whether to group incidental fields that are not used for search, list display, or external integration into a single JSON field to keep the extension field count down
- Choosing how to represent master data (CSV table vs. a separate content structure with a relation field)
- Choosing a classification mechanism (category / tag / relation)
ext_slugnaming policy- Design deliverable templates (field tables, master data tables)
Usage examples
"I want to design a content structure"
"Help me decide how to hold master data"
"Should I use categories or tags?"
"The number of extension fields is growing. Should I use a JSON field?"
Keywords
content structure splitting content structures TopicsGroup master data CSV table csvtable relation category tag JSON field ext_slug extension field limit
Representing master data
| Aspect | CSV table + csvtable / csvtable_checkbox | Separate content structure + relation |
|---|---|---|
| Where the master data lives | A CSV table (a resource separate from content structures) | A regular content structure |
| API response on the referencing side | Keys only. Values must be joined by calling Master::list separately | id + label returned inline |
| Extension fields, categories, and publication control on the master side | Not available | Available |
| Filtering by the master record's own attributes | Not possible | Possible (:R() search; primary language only) |
| Best suited for | Static, simple key/value lists such as prefectures or industries | Master data edited in the admin panel, carrying attributes, or used for filtering |
By default, a relation field returns only the id and a label. To return all fields of the related content, you need to add a custom function as post-processing on the endpoint.
kuroco-content-structure-creation - Content Structure creation
A skill for creating Content Structures (TopicsGroup) through an MCP tool.
Features
- Steps for creating a content definition via the MCP tool
- Field type reference (text, WYSIWYG, select, checkbox, image, file, relation, date, JSON, block editor, etc.)
- How to define field groups and repeatable fields
Usage examples
"I want to create a new content definition"
"I want to add a select field as a custom field"
"Design a content definition with repeatable fields"
Keywords
content definition TopicsGroup custom fields ext_col field type field group repeatable fields
kuroco-auth-design - Authentication & member design
A skill for making design decisions about member authentication and permissions. Implementation code is covered by kuroco-frontend-integration, and auditing existing settings is covered by kuroco-security-audit.
Features
- Choosing an API authentication method (none / Cookie / dynamic access token / static access token)
- Member group design (combinations of per-module permissions, avoiding privilege escalation paths)
- Choosing a registration flow (immediate registration / invitation / provisional registration)
- Content access restriction scopes (group restriction / custom search / own posts only), and why the authentication method and permissions must be configured together
- Password policies and two-factor authentication (separating admin panel 2FA from member login two-step verification)
- Whether alias login is required
- Designing with enterprise SSO (OAuth SP / SAML SP / IDaaS SP) and SCIM provisioning in mind
Usage examples
"I want to design member functionality"
"How should I split up member groups?"
"What registration flow should I use?"
"I want to be able to connect SSO later"
Keywords
member authentication member group registration flow provisional registration invitation view restriction edit restriction password policy two-factor authentication alias login SSO OAuth SP SAML SP IDaaS SP SCIM
ID integration types
| Mechanism | Role |
|---|---|
| OAuth SP | Kuroco acts as the client and performs SSO login against an external IdP with OAuth |
| SAML SP | Kuroco acts as the service provider and performs SSO login against an external IdP with SAML |
| IDaaS SP | SSO login through a CIAM (consumer identity management) service |
| SCIM SP | Not login, but automatic synchronization of member information from an external IdP (create / update / deactivate) |
Only one SCIM SP can be enabled per site at a time.
This skill covers authentication and permissions for site members. OAuth scopes that let an AI agent itself perform Kuroco admin operations (mcp:admin and so on) are covered by kuroco-admin-mcp.
kuroco-external-integration-design - External system integration design
A skill for making design decisions about integrating a Kuroco-based app with external systems. Smarty implementation syntax is covered by kuroco-server-processing.
Features
- Choosing between the three patterns (direct call / proxy / ingestion)
- Implementation constraints of the proxy pattern (
apiplugin parameters, only one file per call, handling of timeouts) - Choosing an ingestion method (batch processing / spider / webhook / trigger email address)
- Managing secrets (choosing between the
secretplugin and site constants, referencing mTLS certificates) - Token management (fixed API key / client credentials / refresh token / signed requests) and how to carry access tokens
- Pitfalls per integration target (Instagram, Twilio, LINE, Slack, Amazon S3, and others)
Usage examples
"I want to integrate with an external API"
"I want to connect to LINE or Slack"
"I want to ingest external data"
"Where should I put the API key?"
Keywords
external integration direct call proxy ingestion api plugin secret site constant batch processing spider Webhook trigger email address OAuth refresh token mTLS
The three integration patterns
| Pattern | Structure | Best suited for |
|---|---|---|
| Direct call | The frontend calls the external API directly; Kuroco is not involved | The external API allows CORS and it is acceptable to hold credentials in the frontend |
| Proxy (via Kuroco) | A custom endpoint's Smarty template calls the external API with the api plugin and returns the result | You want to hide credentials, centralize authentication / CORS / rate limiting in Kuroco, or transform the response |
| Ingestion | External data is imported into Topics / CSV tables in advance and served through the standard Topics API | Update frequency is low, or you want external data to benefit from Kuroco's standard features (search, cache, multilingual) |
Values that could be abused in an attack, such as API keys and secret webhook URLs, are read with the secret plugin (registered in advance under [Environment] → [Secret]). Site constants ($smarty.const.*) are meant for non-confidential configuration values and must not be used to store secrets.
The spider crawls and imports web pages and files, and is not suited to periodically fetching a structured external API — the crawl itself generates billable API requests. To fetch structured data periodically, use batch processing with the api plugin and register the results into Topics with api_internal.
kuroco-api-performance-review - API performance & cost review
A skill that investigates API performance and usage costs with the Admin MCP read-only tools and produces improvement proposals centered on cache configuration.
Features
- Understanding the cost breakdown and trend by billing item (usage status)
- Per-endpoint aggregate analysis (request count, cache hit / miss, average execution time, average response size)
- Cross-checking cache settings against recent activity (distinguishing "no cache period set" from "set but not being hit")
- Corroboration with raw logs (crawler share, requests by referrer, persistent errors)
- Symptom-based investigation recipes and countermeasures ordered by cost effectiveness
Usage examples
"Why did my Kuroco usage cost increase?"
"I want to list endpoints with a low cache hit ratio"
"Analyze the breakdown of API request charges"
"Identify endpoints with slow responses"
Keywords
usage cost cost pay-as-you-go API requests cached API requests cache hit ratio MISS PASS API analytics cache settings maxage CDN traffic execution time crawler
Prerequisites
- A connection to the Admin MCP (a read-only permission level is sufficient for investigation)
- Permission to view usage status for cost analysis
kuroco-security-audit - Security configuration audit
A read-only skill that collects security settings using only the Admin MCP read tools and reports risks against a checklist. It never changes settings.
Features
- Reviewing API security methods, CORS, and IP address restrictions
- Checking login / password policies and two-factor authentication (one-time password) settings
- Taking inventory of permission groups and super users
- Taking inventory of static access tokens and secrets
- Verifying audit logging, and listing items that must be checked manually because they are not available over MCP
Usage examples
"I want to check whether my security settings are safe"
"Review the CORS and IP restriction settings"
"I want to take inventory of permission groups and super users"
"Take inventory of static access tokens"
Keywords
security check security audit security review CORS IP restriction access restriction permissions super user two-factor authentication one-time password password policy static access token audit log
This skill reviews the configured values of settings available in the admin panel. Vulnerability scanning and penetration testing are out of scope.
kuroco-spec-writer - Specification generation
A read-only skill that collects a site's live settings using only the read tools of Admin MCP and generates specification documents (as-built documentation) in Markdown + Mermaid. It never changes settings.
Features
- Generating field tables and ER diagrams for content structures, plus API endpoint lists, authentication and member groups, approval workflows, custom functions and batches, and forms
- Detecting which modules the site actually uses (CSV tables, site constants, mail templates, and so on) and adding chapters for them
- Splitting output as one page per definition, with page keys assigned for file names and diagram node names
- Recording the read tools used as the source for each section
- Conversion to PDF + zip with the bundled script
- A round-trip workflow in which the user edits the generated specification and the differences are applied back to the site (the writes themselves are delegated to
kuroco-admin-mcp)
Usage examples
"Write a specification document for my site"
"List my content definitions and draw an ER diagram"
"I need a handover document as a PDF"
"Apply the changes I made to the specification to the site"
Keywords
specification design document as-built documentation ER diagram Mermaid PDF handover document delivery document
Output structure
spec/
├── README.md # Table of contents, site overview, overall diagram
├── contents/ # Content structures (list + ER diagram, one page per definition)
├── functions/ # Custom functions and batches (one page each)
├── api.md # API endpoint list
├── auth.md # Authentication and member groups
├── workflow.md # Approval workflow (only if used)
├── forms.md # Forms (only if used)
└── {module}.md # Lists for other modules in use
Prerequisites
- A connection to Admin MCP. A scope URL with
/readonlyis recommended, because write tools are then not listed at all - Because a specification spans modules, the
allscope is often appropriate
This skill writes up live settings as a specification. Risk assessment from a security perspective is covered by kuroco-security-audit.
Related documentation
- How to use Kuroco Skills - Installation and basic usage
- Kuroco Skills GitHub Repository
Support
If you have any other questions, please contact us or check out Our Slack Community.