Claude Code Skills Anywhere: Build a Python host that runs real hooks, SKILL.md files, and an MCP client, for customer-site engineers (Deploy It There)

Forward deployed engineers fly to somebody else's office, log into a network they do not control, and make their mess produce something. India Today reported on 10 July 2026 that it can pay up to a million dollars a year; The Economic Times reported the same role at up to $200,000 on 3 June 2026, and whether either figure is base pay or total compensation is unresolved: neither article body would fetch. Anthropic's own job board carries no posting under that title at all.

On day three somebody with the authority to stop the engagement asks whether the agent you just installed will respect the rules in the file you wrote. You answer from the documentation, and the documentation disagrees with itself. OpenAI's page says a SKILL.md must include a name and a description. Claude Code's page publishes a frontmatter table where not one field reads Yes in the Required column. Two engineers who both read carefully can disagree about the same file, and both be right.

This book settles that class of argument the only way it can be settled. You build a third implementation.

Read this before you buy it. It bounds every claim after it. No vendor binary ran anywhere in this book. No Claude Code process, no Codex process, no model call, no request to any inference endpoint. Every green row in the report you generate asserts agreement with a page, which means any of them could be a faithful implementation of a sentence the product does not honour. The oracle column that would close that is empty in this edition.

Across eighteen chapters you write ownhost, a Python agent host of 2,706 lines across 23 modules, standard library only. A loop that reads the documented stop_reason and names which kind of ending it had, including ceiling, an arbitrary turn limit labelled as mine because no page documents when to stop a model that keeps asking for the same thing. Its transport points at the real Messages API and that path never ran: every reply printed here is a replayed fixture that says so in its model field. A permission gate that evaluates deny, then ask, then allow, where the narrower rule deliberately does not win. A dispatcher that runs a stranger's PreToolUse hook, vendored byte-identical, and takes the refusal it returns on exit 2. A loader that implements the portable subset — two fields and a body — and prints every field it ignored. And an MCP client in both eras the specification names, since the draft deletes sessions, the handshake and SSE resumability.

The pass condition is external. Your host runs artifacts you did not write, unmodified. This book does part of that and names the rest. A stranger's SKILL.md loads and a stranger's hook refuses a command, both measured here, on one laptop under one Python 3. No third-party MCP server was contacted anywhere in the book. Two environment variables are yours to set, and the check prints NOT PROVEN until you do. A stranger's bundled script runs, and nothing in that chapter ran inside a confinement, because the capture machine had no bubblewrap.

What you keep is one generated file. contract-report.md holds one row per published requirement, quoted, with its documentation URL, what your host does about it, and a tag saying whether that verdict came from a probe you can re-run or was transcribed off a page. A large share of the rows read declined, by name and with a reason. Most hook handler types, most frontmatter fields and four MCP features are not buildable at this size. That the portable subset is small is the finding. The job in continuous integration that would re-check the table has executed on no runner.