# Private Skills for Teams

> Publish skills that are only installable by your team members. Your username is your namespace — no org setup required.

Your Aerostack username is your namespace. If your username is `acme`, your skills live at `@acme/skill-name`. You control who can install them.

No separate "org setup" step. You already have everything you need once you have an Aerostack account.

---

## Visibility Levels

When publishing a skill, set its visibility:

| Visibility | Who can install | Use case |
|-----------|----------------|---------|
| `public` (default) | Anyone | Open-source skills, community contributions |
| `team` | Only people you've invited | Company-internal tools, client-specific integrations |
| `private` | Only you | Personal automation, work in progress |

---

## Publish a Private Skill

```bash
# Publish to the marketplace, visible to your team only
aerostack skill publish --name "internal-crm-skill" --private team

# Self-only (not visible to anyone else)
aerostack skill publish --name "my-dev-tool" --private
```

Team-private skills:
- Do **not** appear in public marketplace searches
- **Do** appear in `aerostack skill list` for team members
- Require a valid Aerostack account + team membership to install

---

## Invite Team Members

Invite team members from the Admin dashboard → **Team** tab, or via the CLI:

```bash
aerostack team invite alice@acme.com
# → Invitation sent. Alice will receive an email with a join link.

aerostack team list
# bob@acme.com       pending   invited 2026-03-07
```

Once a member accepts, they can install your team-private skills:

```bash
# From Alice's machine (she's a member of @acme team)
aerostack skill install @acme/internal-crm-skill

# From a non-member's machine
aerostack skill install @acme/internal-crm-skill
# ✗ 403: You are not a member of @acme
```

---

## Team Workspaces

For team setups, create a **shared workspace** that all team members connect to. This way everyone uses the same set of skills through one gateway URL.

```bash
# Create the shared workspace (owner only)
aerostack workspace create acme-team

# Issue a token for each team member (or share one team token)
aerostack workspace token create acme-team --name "Alice Cursor"
# → mwt_xxxxxxxx (give this to Alice)

aerostack workspace token create acme-team --name "Bob VSCode"
# → mwt_yyyyyyyy (give this to Bob)
```

Each member adds the same gateway URL to their editor config with their token:

```json
{
  "mcpServers": {
    "acme-team": {
      "url": "https://gateway.aerostack.dev/ws/acme-team",
      "headers": { "Authorization": "Bearer mwt_xxxxxxxx" }
    }
  }
}
```

When you install a new skill into `acme-team`, it appears for **all team members** immediately — no config change on their end.

---

## Install Scripts for Onboarding

Create a team onboarding script that installs your standard skill set:

```bash
#!/bin/bash
# team-setup.sh — run this when a new dev joins

aerostack workspace use acme-team

aerostack skill install @acme/internal-crm-skill
aerostack skill install @acme/deploy-skill
aerostack skill install @acme/jira-skill
aerostack skill install johndoe/github-skill  # public skill

echo "✓ All team skills installed."
echo "Add this to your editor MCP config:"
echo "URL: https://gateway.aerostack.dev/ws/acme-team"
```

---

## Audit: Who Installed What

View install and usage events per workspace from the Admin dashboard → **Workspace Audit**, or via the API:

```bash
aerostack workspace audit acme-team
# 2026-03-07 11:30 UTC  bob@acme      @acme/deploy-skill      install
```

---

## Rotating Workspace Tokens

If a team member leaves or a token is compromised:

```bash
aerostack workspace token list acme-team
# Bob VSCode           2026-03-02     2026-03-06     active

aerostack workspace token revoke acme-team --name "Alice Cursor"
# ✓ Token revoked. Alice's gateway access is immediately disabled.
```

---

## Next Steps

- [Back your private skill with an edge function →](/mcp/function-backed)
- [Use your skills with ChatGPT or Gemini →](/mcp/cross-llm)