[codex] Update skills install instructions

[mnvsk97]

Summary

• update the README and install guide to use the long-form npx skills add ... --skill ... --yes commands
• align per-skill install snippets for onboard and integrate-gateway with the same flag style
• revamp the MCP Gateway skill around live product flows for remote, official remote, virtual, hosted STDIO, and OpenAPI-backed MCP servers
• add MCP Gateway references for UI click paths and YAML variations across auth modes/server types
• slim duplicated MCP schema content so detailed examples live in the MCP references and the gateway schema stays as a compact index

MCP Gateway Coverage

• list MCP servers attached to a gateway
• connect any remote MCP server or official remote MCP server
• create virtual MCP servers from selected tools across multiple source MCP servers
• create hosted STDIO MCP servers from mcpServers JSON
• import OpenAPI specs as MCP servers
• configure no auth, API key/header auth, OAuth2 authorization code, OAuth2 client credentials, and token passthrough
• enable/disable tools while preserving unrelated server config
• manage access additions with mcp-server-manager; keep deletes/removals dashboard-only
• add MCP servers to Cursor, VS Code, Claude Code, Python, TypeScript, Windsurf, and Codex clients

Validation

• ./scripts/validate-skills.sh
• ./scripts/validate-skill-security.sh
• git diff --check
• searched edited install docs for stale -s, -g, -a, -y, and --all shorthand examples

Notes

• final tfy apply flows remain gated by summary, YAML/diff, exact command, and explicit user confirmation
• MCP Gateway YAML examples are treated as references; the live dashboard Apply using YAML preview remains the source of truth when it differs

---

Note

Low Risk
Low risk documentation-only changes, but they do alter agent guidance around MCP server management (auth/tool filtering/access) and remove the checked-in .codex/hooks.json, which could affect local hook behavior if anyone relied on it.

Overview
Updates installation docs (README.md, install.md, and per-skill install pages) to standardize on long-form npx skills add ... --skill ... --yes commands, including examples for global installs and agent linking.

Refreshes the mcp-servers skill to match current MCP Gateway product flows (remote vs official remote, virtual composition, hosted STDIO import, OpenAPI import), with stronger safety guidance (confirmation-gated tfy apply, no deletes/collaborator removals, secret handling) and new reference docs for UI click paths and YAML/auth variations. Also trims the gateway mcp-server schema reference down to a compact index that points to the new detailed references.

Removes .codex/hooks.json from the repo and stops un-ignoring it in .gitignore.

^{Reviewed by Cursor Bugbot for commit 9fe9660. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9fe9660. Configure here.}