MCP from GitHub and registries—sandboxed connectors vs skill packages

Harriet does not replace your Git client. “Using something from GitHub” usually means one of these two supported patterns.

A) Sandboxed MCP connector (Company settings)

In Company settings → Integrations → New connector, choose Sandboxed (uvx / npx) when you want Harriet to run a published MCP package from a registry (often the same package you would run with npx or uvx). You provide the sandbox command and arguments; Harriet runs it in an isolated environment.

Use when: you need Harriet chat or workflows to call tools exposed by that MCP server through a connector, with IT-controlled credentials and tool permissions.

This path is not a Git clone of an arbitrary repo—it expects a runnable package command.

B) Skill package synced from GitHub (Endpoint AI)

In the Endpoint AI console (Harriet skills authoring), admins can create package skills and sync content from a GitHub URL or repository picker (branch/path), depending on what your organization configured. That flow builds skill instructions (SKILL.md and related files), not the Company-settings MCP wizard.

Use when: you want a reusable skill package maintained in Git, reviewed, and provisioned to users—often alongside Skilify submissions from endpoints.

Choosing

Goal	Typical path
Call tools from a registry MCP in chat/workflows	New connector → Sandboxed or Native MCP
Maintain skill Markdown in Git and roll it out after review	Endpoint AI package skill + Git sync, or Skilify submit

See How to create an MCP connector and Using Skilify to build skills locally, submit for review, and provision them.