What problem does it solve? The divalto-devkit plugin ships with a template .mcp.json that has no authentication headers, so the diva-mcp server returns 401 errors until the partner's API credentials (site, environment, API key) are written into the X-Api-Key header. This Skill interactively collects those values and persists them for all future Claude Code sessions. ## Core Features & Use Cases - Credential collection and injection: Asks the partner for site, environment, and API key, builds the X-Api-Key header in the <site>-<env>@<apikey> format, and patches .mcp.json atomically with a .bak backup. - Robust .mcp.json discovery: Locates the real plugin install path, including versioned marketplace cache directories under ~/.claude/plugins/cache and marketplaces. - Shell-expansion protection: Passes API keys containing $$ or ! via stdin or file instead of argv, preventing bash from corrupting the key. - Use Case: After installing the plugin from the marketplace, a partner runs this Skill, answers three questions, restarts Claude Code, and the mcp__diva-mcp__* tools respond without 401 errors. ## Quick Start Ask Claude to configure your diva-mcp API key by saying "configure diva-mcp" and answer the three questions about your site, environment, and API key.