The official Neon entry-point skill: Load this when building applications or backends on Neon, or when mentioning Neon / Lakebase Postgres. The agent first checks for existing credentials, then prioritizes using the neon CLI (falling back to MCP only if unavailable) to connect to projects. It follows a workflow where "creating a git branch creates a database branch," pulls environment variables such as DATABASE_URL for that branch to local storage, and uses neon.ts declarations along with neon deploy to manage login (hosted Better Auth), object storage, Functions, AI Gateway, and Realtime.
skills.sh install count 251459 (+1114 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- When modifying existing projects, conduct an inventory first: Reuse existing DATABASE_URL, Clerk / Better Auth, and S3; only select Neon components for capabilities that have not yet been determined. If existing account credentials are invalid, stop and ask the user to log in; do not substitute with a temporary project.
- Define the branching workflow with specific commands: Run neon link once, then for each feature use neon checkout <branch-name> --create, which automatically writes the environment variables for that branch into .env.local. Use neon diff to view schema differences from the parent branch, and require the agent to switch branches independently between tasks.
- Adopt a conservative security approach: Do not recommend placing PostgREST in the browser relying solely on RLS protection for new applications; Functions are public HTTPS endpoints, so validate JWTs or API Keys at the beginning of handler functions. For project-level MCP installations, always use OAuth to avoid writing keys into files that are committed to git.
- This is merely an entry point; specific tasks are delegated to sub-skills in the same repository such as neon-postgres, neon-auth, and neon-realtime (there are 8 other skills from this repository on the leaderboard); the repository is licensed under Apache-2.0.
- skills.sh installs: 1114 in the last 24 hours, cumulative total of 251459; weekly installs over the last 8 weeks have risen from 16847 to 22650 (this only reflects attention level).
Usage
- The installation command will be displayed after the audit passes; triggered by saying "build a backend with Neon," mentioning Lakebase Postgres, neon.new, or "database without registration."
- If you have a Neon account: Install the neon CLI and log in, or set NEON_API_KEY; if you do not have an account: Use Claimable Neon, where the agent first creates a temporary project for you to claim. Functions, object storage, and AI Gateway are unavailable until claimed.
Risks
- Not audited this period; fixed at Grade C with no installation command displayed. SKILL.md instructs the agent to execute neon commands to create projects, branches, and deployments, and to write database connection strings and other environment variables into local .env files. This modifies cloud resources, which is consistent with its purpose. The Gen Agent Trust Hub audit on skills.sh is marked as Pass.
- Running neon mcp --agent writes the API Key into the agent's user configuration; if you prefer not to persist keys to disk, add --no-env-pull and use neon-env run for runtime injection instead.
- SKILL.md states that Functions, object storage, AI Gateway, and Realtime are currently available only in 4 AWS regions; compute can scale to zero but storage is still billed; unclaimed temporary projects expire after approximately 72 hours.
- SKILL.md is approximately 3.7 bytes in size, consuming context when loaded; it also requires the agent to adhere to the naming convention that "the database is called Lakebase Postgres, and Neon is just the brand."