Skip to main content
Reproducibility is one of the main reasons to use gaal in the first place. Pinning every external source to a specific revision turns “it worked on my machine” into “it worked on every machine.”

Pinning repositories

The version: field accepts the right pin format for each VCS type:
For maximum reproducibility, prefer tags or commits over branch names.

Pinning skill sources

Skill sources don’t have a version: field, they always track the source’s default branch. Two ways to pin:

1. Mirror the source as a repository, then point at it locally

The skills now come from a pinned local directory, and the repository pin governs the version.

2. Use a tag-pinned tarball

Pinning MCP servers

MCP entries written inline: are pinned by definition, the command and arguments you wrote are exactly what runs:
For npx-launched servers, pin the package version in the args (@1.4.0). For uvx, use uvx package==1.4.0. For binaries, point at a specific path. When using source: to pull a remote MCP config, host the JSON yourself or pin to a tagged URL, never trust an HTTPS URL whose contents can change.

Reading current pins

gaal status reports the actual revision present on disk.

Configure repositories

Configure skills

gaal status