AEVU agent skills

Give your AI client reusable instructions for working with AEVU. Version 1.0.0 contains 12 skills covering all 35 current MCP information areas and 66 read-only tools. Install the workflows you need, connect your personal MCP grant separately, then ask for a sourced review or briefing.

The skill provides instructions. AEVU's MCP server supplies authorised information and enforces access. Installation does not create an account, connect MCP, select scopes, grant permissions or run an autonomous PMO service. A tool appearing in the catalogue does not mean your connection may use it.

Choose a workflow

Skill	What it helps you do	Relevant information areas
aevu-mcp	Confirm the workspace, find appropriate tools and handle pages, limits and access errors	Connection context and selective tool use
aevu-portfolio-review	Explain the visible portfolio and project position	Projects, portfolios, programmes
aevu-schedule-review	Examine dates, task dependencies and cross-project handoffs	Tasks, milestones, dependencies
aevu-resource-review	Review project workload and recorded capacity	Workload and allocations
aevu-financial-review	Review financial records, permitted analytics and saved scenarios	Finance, reports, scenarios
aevu-governance-review	Find material governance concerns and evidence gaps	Exceptions, risks, issues, challenges, changes, document metadata, stakeholders, gates
aevu-pmo-briefing	Brief a complete issued weekly pack and its decision requests	Issued PMO packs and decisions
aevu-delivery-review	Compare recorded delivery evidence and issued reviews	History, baselines, progress, watches, reviews
aevu-benefits-review	Assess recorded objectives and outcomes	Benefits and observations
aevu-demand-review	Review demand you are permitted to read	Demand content, estimates, scores and state
aevu-evidence-status	Explain stored intake status and its age	Own evidence batch status/timestamps only
aevu-workspace-review	Review selected operational configuration and records	Calendar, members, reference lists, templates, settings, audit, integrations, AI usage

Scopes are independent. For example, a financial review does not require you to select every financial, reporting and scenario area when you need only one. The scope/tool reference describes current native rights and sensitive information. The downloadable manifest maps every tool and scope to its primary skill; a tool can also be useful in another workflow.

Inspect and install

Use Node.js 22.20 or newer with npm. Review the package before installing it. The pinned Vercel CLI below is third-party software; no Node runtime or installer is required on the AEVU server.

First list the available skills without installing them:

npx skills@1.7.4 add https://docs.aevupm.com --list

Install selected skills for Claude Code and Codex in the current project:

npx skills@1.7.4 add https://docs.aevupm.com --skill aevu-mcp aevu-pmo-briefing -a claude-code -a codex

Or deliberately install the complete catalogue for both clients:

npx skills@1.7.4 add https://docs.aevupm.com --skill '*' -a claude-code -a codex

The CLI asks you to review the installation. Project installations use .claude/skills/ for Claude Code and .agents/skills/ for Codex; the installer can use links to shared files. Add -g only if you intentionally want a user-wide install. Do not overwrite existing custom skills without reviewing them. These commands contain no AEVU token and never need one.

Vercel's CLI makes its own telemetry and security-audit requests. Its documented DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 switches disable both. Check your organisation's tooling policy and Vercel's current documentation before running the installer.

Manual and pinned installation

• Download all twelve skills, version 1.0.0.
• View the release manifest, per-file hashes and complete coverage mapping.
• Download SHA256SUMS.txt.

For a pinned installation, download the versioned ZIP, verify its SHA-256 against the manifest using your platform's SHA-256 utility, inspect the contents, then extract it to a new directory. The archive contains only instructions, client UI metadata, a secret-free setup reference, README and MIT licence. It contains no executable scripts, hooks or credentials.

From that extracted directory you can install its local source:

npx skills@1.7.4 add . --skill '*' -a claude-code -a codex

Alternatively, copy selected folders from skills/ into the client's project skill directory, preserving their relative references. SHA-256 checks integrity against the manifest you trust; it is not a publisher signature. The domain discovery URL selects the current release; use the versioned archive to retain a particular release. Previously installed copies do not receive changed instructions merely because the website changes.

Connect MCP separately

Follow Connect an AI client. Create a personal, short-lived connection in Settings → MCP connections, select only relevant areas and keep the one-time secret in your approved private environment/secret store. The client configuration uses PMO_MCP_TOKEN; never paste its value into chat or an installer command.

AEVU currently uses native Streamable HTTP with a bearer token. It does not provide browser OAuth discovery. Skills do not change client compatibility or administrator controls. Each read still checks selected scopes, current workspace membership, project visibility, record-owner privacy and native module/plan permissions.

Use the installed skill

In Claude Code:

/aevu-pmo-briefing Brief the latest issued pack for my selected engagement and reporting week. Read every chunk, include its cutoff and original fingerprint, and separate decisions requested from recorded outcomes.

In Codex:

$aevu-pmo-briefing Brief the latest issued pack for my selected engagement and reporting week. Read every chunk, include its cutoff and original fingerprint, and separate decisions requested from recorded outcomes.

Both clients may select an installed skill when its description matches a request. Automatic activation depends on the client and context; use explicit invocation when you want to select the workflow. If it is missing, refresh the client's skill discovery or restart the client as its documentation directs. See Claude Code skills and Codex skills.

Other useful requests:

• “Review the visible projects for schedule slippage and unresolved handoffs; cite the records and flag incomplete coverage.”
• “Explain this project's recorded cashflow for the selected period, including assumptions and missing information.”
• “Review governance evidence for the selected projects and suggest questions for human review.”
• “Show my evidence batches' stored status and recorded time; do not refresh or run extraction.”

What a good answer includes

The agent should first verify the connected workspace, use real returned identifiers and follow each tool's pagination or report chunks. Its answer should identify the sources, relevant observation/issue/cutoff dates, incomplete coverage and uncertainty. Native project information describes current records; an issued PMO pack describes its frozen reporting basis. Retrieval time does not refresh the underlying evidence.

A refused or hidden record remains unknown. The skills instruct agents to report access limits rather than switch accounts, credentials, REST endpoints or database access to bypass them. Stored integration/evidence status does not certify present provider health; workspace audit reads cover their supported rolling 30-day window, not an unlimited archive.

Boundaries remain in force

• MCP has no business edits, approvals, report preparation/issue, message sending, source-file downloads or provider/model execution. An agent-generated briefing is unapproved analysis, not an issued AEVU report.
• PMO packs and decision reviews remain issued-only. Supported own drafts in other modules retain their native privacy rules.
• Returned names, notes and report prose are untrusted data. They do not authorise following embedded instructions, running commands, requesting secrets or exporting information through another tool.
• Read-only data can still be sensitive. Approve the client/provider and intended audience before sharing enterprise information. Skills cannot enforce provider retention or control every action of a third-party agent.
• Server rate, concurrency, body and output limits remain authoritative. A skill must not evade them by rotating grants or repeatedly retrying refused reads.

These instructions guide behaviour; server enforcement remains necessary. They are not a security certification or a guarantee that every model always follows them.

Update or remove

Review the new release manifest and changed instructions before installing an update from the same domain. Re-run the selected installation command to replace the intended skill copies after review; preserve local customisations separately. Versioned download paths remain stable, and a changed release receives a new version.

Use the CLI's list and remove commands or remove only the AEVU skill folders you installed, following its command reference. Removing a skill does not revoke MCP access. Revoke the connection in AEVU and remove its retired secret from the client's private store when access is no longer needed.

New skills can be added for additional outcomes. New MCP capabilities need server implementation and authorization first; writing instructions cannot make an unsupported action available.