feat: fix site template, add QoL features, update docs and scaffold

Fix parse_skills() to handle YAML frontmatter correctly.
Add collapsible categories, search/filter, back-to-top, toast, mobile nav.
Fix install steps rendering raw HTML (safe filter).
Update README/AGENTS/CLAUDE/CONTRIBUTING/SECURITY for site-template.
Rewrite scaffold pages.yml.j2 for unified template, add site.json.j2 and mcp-tools.json.j2.
Upgrade validate.yml to enforce full registry.json schema.

Made-with: Cursor

Author: TMHSDigital

.cursorrules

@@ -5,7 +5,8 @@ You are working on Developer Tools Directory, a meta-repository that catalogs, s
 - `registry.json` -- single source of truth for all 9 tool repos (name, type, counts, links, status)
 - `standards/` -- 9 Markdown docs defining conventions (folder structure, CI/CD, manifests, pages, commits, README, AGENTS.md, versioning)
 - `scaffold/create-tool.py` -- Python repo generator using Jinja2 templates
-- `scaffold/templates/` -- 18 Jinja2 templates producing a standards-compliant repo
+- `scaffold/templates/` -- Jinja2 templates producing a standards-compliant repo
+- `site-template/` -- shared GitHub Pages build system for tool repos (build_site.py + template.html.j2 + fonts)
 - `docs/` -- static GitHub Pages catalog site (index.html, style.css, script.js)
 - `assets/` -- logo image
 - `.github/workflows/` -- CI/CD for this repo (validate, pages, stale, codeql, dependency-review, release, release-drafter, label-sync)
@@ -54,6 +55,13 @@ Use conventional commits. Prefix determines changelog category:
 - Test locally: `python scaffold/create-tool.py --name "Test" --description "Test" --mcp-server --skills 2 --rules 1 --output /tmp/test`
 - CI runs a dry-run test on every push.
 
+## When editing site-template/
+
+- `site-template/build_site.py` generates GitHub Pages for tool repos. It parses plugin.json, site.json, skills/, rules/, and mcp-tools.json.
+- `site-template/template.html.j2` is the Jinja2 HTML template with collapsible categories, search, mobile nav.
+- Tool repos clone this directory in CI via sparse checkout and run `build_site.py --repo-root . --out docs`.
+- Test locally: `python site-template/build_site.py --repo-root /path/to/tool-repo --out /path/to/tool-repo/docs`
+
 ## When editing docs/
 
 - `docs/index.html` is the catalog site entry point.

.github/workflows/validate.yml

@@ -26,21 +26,50 @@ jobs:
           import json, sys
           data = json.load(open("registry.json"))
           assert isinstance(data, list), "registry.json must be an array"
-          required = ["name", "repo", "slug", "description", "type", "skills", "rules", "mcpTools", "status"]
-          valid_types = ["cursor-plugin", "mcp-server"]
+          SCHEMA = {
+            "name": str,
+            "repo": str,
+            "slug": str,
+            "description": str,
+            "type": str,
+            "homepage": str,
+            "skills": int,
+            "rules": int,
+            "mcpTools": int,
+            "extras": dict,
+            "topics": list,
+            "status": str,
+            "version": str,
+            "language": str,
+            "license": str,
+            "pagesType": str,
+            "hasCI": bool,
+          }
+          OPTIONAL = {"npm": str}
+          VALID_TYPES = {"cursor-plugin", "mcp-server"}
+          VALID_STATUS = {"active", "beta", "deprecated"}
+          VALID_PAGES = {"static", "mkdocs", "none"}
           errors = []
           for i, tool in enumerate(data):
-            for field in required:
+            label = "Entry %d (%s)" % (i, tool.get("name", "?"))
+            for field, expected_type in SCHEMA.items():
               if field not in tool:
-                errors.append("Entry %d (%s): missing '%s'" % (i, tool.get("name", "?"), field))
-            if tool.get("type") not in valid_types:
-              errors.append("Entry %d (%s): invalid type '%s'" % (i, tool.get("name", "?"), tool.get("type")))
-            if not isinstance(tool.get("skills", 0), int):
-              errors.append("Entry %d (%s): skills must be int" % (i, tool.get("name", "?")))
-            if not isinstance(tool.get("rules", 0), int):
-              errors.append("Entry %d (%s): rules must be int" % (i, tool.get("name", "?")))
-            if not isinstance(tool.get("mcpTools", 0), int):
-              errors.append("Entry %d (%s): mcpTools must be int" % (i, tool.get("name", "?")))
+                errors.append("%s: missing required field '%s'" % (label, field))
+              elif not isinstance(tool[field], expected_type):
+                errors.append("%s: '%s' must be %s, got %s" % (label, field, expected_type.__name__, type(tool[field]).__name__))
+            for field, expected_type in OPTIONAL.items():
+              if field in tool and not isinstance(tool[field], expected_type):
+                errors.append("%s: optional '%s' must be %s" % (label, field, expected_type.__name__))
+            if tool.get("type") not in VALID_TYPES:
+              errors.append("%s: type must be one of %s" % (label, VALID_TYPES))
+            if tool.get("status") not in VALID_STATUS:
+              errors.append("%s: status must be one of %s" % (label, VALID_STATUS))
+            if tool.get("pagesType") not in VALID_PAGES:
+              errors.append("%s: pagesType must be one of %s" % (label, VALID_PAGES))
+            if not isinstance(tool.get("topics", []), list):
+              pass
+            elif not all(isinstance(t, str) for t in tool.get("topics", [])):
+              errors.append("%s: topics must be array of strings" % label)
           if errors:
             for e in errors:
               print("::error::" + e, file=sys.stderr)
@@ -91,5 +120,8 @@ jobs:
 
           test -f /tmp/scaffold-test/ci-test-plugin/.cursor-plugin/plugin.json
           test -f /tmp/scaffold-test/ci-test-plugin/.github/workflows/validate.yml
+          test -f /tmp/scaffold-test/ci-test-plugin/.github/workflows/pages.yml
+          test -f /tmp/scaffold-test/ci-test-plugin/site.json
+          test -f /tmp/scaffold-test/ci-test-plugin/mcp-tools.json
           test -f /tmp/scaffold-test/ci-test-plugin/mcp-server/server.py
           echo "Scaffold test passed"

.gitignore

@@ -11,4 +11,3 @@ build/
 Thumbs.db
 node_modules/
 output/
-site-template/SETUP-PROMPT.md

AGENTS.md

@@ -10,7 +10,8 @@ This is a **meta-repository** -- it does not contain a Cursor plugin or MCP serv
 
 - **`registry.json`** -- single source of truth for all tool repos (9 entries). The catalog site and README tables are derived from it.
 - **`standards/`** -- 9 Markdown docs defining conventions for folder structure, CI/CD, plugin manifests, GitHub Pages, commit conventions, README format, AGENTS.md format, and versioning.
-- **`scaffold/`** -- Python repo generator (`create-tool.py`) with 18 Jinja2 templates that produce a fully standards-compliant new tool repo.
+- **`scaffold/`** -- Python repo generator (`create-tool.py`) with Jinja2 templates that produce a fully standards-compliant new tool repo.
+- **`site-template/`** -- shared GitHub Pages build system for tool repos. `build_site.py` reads `.cursor-plugin/plugin.json`, `site.json`, `skills/`, `rules/`, and `mcp-tools.json` from a tool repo and renders `docs/index.html` via `template.html.j2`. Self-hosts Inter and JetBrains Mono fonts. Tool repos clone this directory in CI and run the build script at deploy time.
 - **`docs/`** -- static GitHub Pages catalog site (vanilla HTML/CSS/JS, no build step). Reads `registry.json` at runtime to render tool cards.
 - **`assets/`** -- logo image.
 - **`.github/workflows/`** -- CI/CD for this repo (validate, pages, release, release-drafter, stale, codeql, dependency-review, label-sync).
@@ -178,6 +179,19 @@ Pure documentation -- no code. Each file documents a convention derived from ana
 - CI runs a scaffold dry-run test on every push. If you add a new required file, add a `test -f` check to the `validate.yml` scaffold test step.
 - The `LICENSE.j2` template has conditional logic for MIT, Apache-2.0, and CC-BY-NC-ND-4.0. If adding a new license option, update both the template and the `LICENSE_FILES`/`SPDX` dicts in `create-tool.py`.
 
+## When editing site-template/
+
+- `site-template/build_site.py` is the build script that generates GitHub Pages sites for tool repos. It reads data from the tool repo and renders HTML via `template.html.j2`.
+- `site-template/template.html.j2` is a Jinja2 template producing a single-page site with: sticky nav, hero with animated stats, collapsible MCP tool categories, search/filter, back-to-top, toast copy feedback, and mobile hamburger nav.
+- `site-template/fonts/` contains self-hosted Inter (400/500/700) and JetBrains Mono (400) woff2 files.
+- `site-template/SETUP-PROMPT.md` is a copy-paste prompt for applying the template to a new tool repo.
+- Tool repos consume this template via their `pages.yml` workflow, which clones Developer-Tools-Directory with sparse checkout and runs `build_site.py --repo-root . --out docs`.
+- Data sources in each tool repo: `.cursor-plugin/plugin.json` (metadata), `site.json` (branding/colors), `skills/*/SKILL.md` (parsed for name/description via frontmatter), `rules/*.mdc` (parsed for name/scope/description), `mcp-tools.json` (manually maintained tool list).
+- Changes to the template or build script affect all tool repos on their next deploy. Test locally before pushing:
+  ```
+  python site-template/build_site.py --repo-root /path/to/tool-repo --out /path/to/tool-repo/docs
+  ```
+
 ## When editing docs/ (catalog site)
 
 - `docs/index.html` is the single-page catalog site. It embeds a copy of `registry.json` inside a `<script type="application/json" id="registry-data">` tag as a fallback for when the direct fetch fails.

CLAUDE.md

@@ -20,7 +20,12 @@ Developer-Tools-Directory/
   standards/                 # 9 convention docs (folder structure, CI/CD, manifests, etc.)
   scaffold/
     create-tool.py           # Python repo generator (Jinja2)
-    templates/               # 18 .j2 templates for new repos
+    templates/               # Jinja2 templates for new repos
+  site-template/
+    build_site.py            # Builds GitHub Pages for tool repos from their metadata
+    template.html.j2         # Shared HTML template with configurable branding
+    fonts/                   # Self-hosted Inter + JetBrains Mono woff2
+    SETUP-PROMPT.md          # Copy-paste prompt for applying template to a repo
   docs/
     index.html               # GitHub Pages catalog site
     style.css                # Dark theme, responsive, card layout
@@ -76,7 +81,7 @@ Static HTML/CSS/JS. No build step. No external CDN. The `pages.yml` workflow cop
 | Steam Cursor Plugin | Plugin | 30 | 9 | 25 |
 | Steam MCP Server | MCP Server | 0 | 0 | 25 |
 
-**Totals:** 186 skills, 77 rules, 377 MCP tools
+**Totals:** 177 skills, 71 rules, 371 MCP tools
 
 ## Development Workflow
 

CONTRIBUTING.md

@@ -27,7 +27,11 @@ Developer-Tools-Directory/
   standards/                 # Convention documentation (9 docs)
   scaffold/
     create-tool.py           # Repo generator script
-    templates/               # Jinja2 templates (18 files)
+    templates/               # Jinja2 templates for new repos
+  site-template/
+    build_site.py            # Shared GitHub Pages build for tool repos
+    template.html.j2         # HTML template with configurable branding
+    fonts/                   # Self-hosted Inter + JetBrains Mono woff2
   docs/                      # GitHub Pages catalog site
   assets/                    # Logo image
   .github/workflows/         # CI/CD automation
@@ -49,6 +53,7 @@ Developer-Tools-Directory/
   "rules": 0,
   "mcpTools": 0,
   "extras": {},
+  "npm": "",
   "topics": ["topic-1", "topic-2"],
   "status": "active",
   "version": "0.1.0",

README.md

@@ -29,7 +29,7 @@
 ---
 
 <p align="center">
- 9 repos &nbsp;&bull;&nbsp; 186 skills &nbsp;&bull;&nbsp; 77 rules &nbsp;&bull;&nbsp; 377 MCP tools
+ 9 repos &nbsp;&bull;&nbsp; 177 skills &nbsp;&bull;&nbsp; 71 rules &nbsp;&bull;&nbsp; 371 MCP tools
 </p>
 
 ## How It Works
@@ -40,9 +40,10 @@ flowchart LR
     A --> C["README tables\n(below)"]
     D["scaffold/\ncreate-tool.py"] --> E["New repo with\nall standards"]
     F["standards/\n(conventions)"] --> D
+    G["site-template/\nbuild_site.py"] --> H["Tool repo\nGitHub Pages"]
 ```
 
-**Registry** tracks every tool repo. **Standards** document conventions for CI/CD, folder structure, manifests, and versioning. **Scaffold** generates new repos that follow those standards automatically.
+**Registry** tracks every tool repo. **Standards** document conventions for CI/CD, folder structure, manifests, and versioning. **Scaffold** generates new repos that follow those standards automatically. **Site template** provides a shared build system for tool repo GitHub Pages sites.
 
 ## Tools
 
@@ -172,6 +173,11 @@ Developer-Tools-Directory/
   assets/                  Logo
   docs/                    GitHub Pages catalog site
   scaffold/                Repo generator + Jinja2 templates
+  site-template/           Shared GitHub Pages build system for tool repos
+    build_site.py          Reads plugin.json, skills/, rules/, mcp-tools.json -> index.html
+    template.html.j2       Jinja2 HTML template with configurable branding
+    fonts/                 Self-hosted Inter + JetBrains Mono woff2
+    SETUP-PROMPT.md        Copy-paste prompt for applying template to a repo
   standards/               Convention documentation (9 docs)
   registry.json            Tool registry (source of truth)
   AGENTS.md                AI agent guidance

SECURITY.md

@@ -23,6 +23,7 @@ This repository is a meta-repository containing:
 | registry.json | Schema poisoning via malicious PR (fake repo URLs, XSS in description fields) | CI validates schema on every PR. The catalog site renders text content via `textContent`, not `innerHTML`. |
 | GitHub Pages site | XSS via registry data rendered in the DOM | Tool descriptions are inserted via `textContent`. No `innerHTML` or `eval` is used with registry data. |
 | GitHub Actions workflows | Workflow injection via PR title/body in release-drafter | Release-drafter uses the official action with no custom script interpolation of PR content. |
+| Site template (supply chain) | Tool repos clone this repo in CI to build their Pages site. A compromised template could inject malicious HTML/JS into all tool repo sites. | Template changes are reviewed before merge. Tool repos pin to `main` branch. The build script does not execute arbitrary code from tool repos -- it only reads JSON and Markdown files. |
 
 ### Out of scope
 

scaffold/create-tool.py

@@ -167,8 +167,9 @@ def main():
     write_file(output_dir, ".cursorrules", render_template(env, "cursorrules.j2", ctx))
     write_file(output_dir, ".gitignore", render_template(env, "gitignore.j2", ctx))
 
-    # GitHub Pages docs site
-    write_file(output_dir, "docs/index.html", render_template(env, "index.html.j2", ctx))
+    # GitHub Pages data files
+    write_file(output_dir, "site.json", render_template(env, "site.json.j2", ctx))
+    write_file(output_dir, "mcp-tools.json", render_template(env, "mcp-tools.json.j2", ctx))
 
     # Assets placeholder
     (output_dir / "assets").mkdir(parents=True, exist_ok=True)
@@ -178,7 +179,7 @@ def main():
     # Skills
     for skill in skill_names:
         skill_content = f"""---
-title: {skill.replace('-', ' ').title()}
+name: {skill}
 description: TODO - describe this skill
 globs: ["**/*"]
 alwaysApply: false

scaffold/templates/mcp-tools.json.j2

@@ -0,0 +1 @@
+[]