On-Prem

Skills Manager ships inside self-hosted Prompt Manager. The same pm-skills CLI points at your API base URL.

Point the CLI at your deployment

pm-skills login --server https://prompt-manager.example.com --api-key "$PM_SKILLS_API_KEY"

# local HTTP only:
pm-skills login --server http://localhost:8005 --api-key "$PM_SKILLS_API_KEY" --insecure

Use the API origin your frontend calls (behind nginx this may be https://host/api — follow your install’s documented base URL).

How on-prem differs from SaaS

Concern	On-prem
Auth (UI)	JWT (not Clerk)
Database	PostgreSQL + Alembic migrations
Skill assets	Pluggable storage (filesystem default; S3/MinIO/Azure/GCS)
Marketplace / scan	Off by default until you set env flags
Management HTTP paths	RESTful per-tier routes (CLI consume paths match SaaS)
Notifications	SMTP

Product behavior (tiers, resolution, pins, publish model) is intended to match SaaS.

Operator flags

Variable	Purpose
SKILL_MARKETPLACE_ENABLED	Marketplace, installs, promote (default false)
SKILL_SCAN_ENABLED	SkillSpector pipeline (default false)
SKILL_SEMANTIC_SCAN_ENABLED	LLM semantic stage
SKILLSPECTOR_CMD	Path to scanner binary
SKILL_BUNDLE_MAX_*	Bundle size caps
Storage vars	See your on-prem .env.example / storage docs

Docker images may include SkillSpector under /opt/skillspector. Enable scanning only after the binary path is valid — fail-closed when enabled with a bad command.

API keys

Create elsai_… keys in the on-prem console. Membership checks apply: the key owner must access the target project.

Related

• Prompt Manager On-Prem
• Security scanning
• Configuration