Reference & troubleshooting
Every limit in the system, and what each error message you might run into actually means.
Every limit in one table
| Item | Limit | Who can change it |
|---|---|---|
| Businesses owned per person | 3 | system administrator (in the database) |
| Servers per business | 5 | system administrator, can be set per business |
| Skills per server | 50 | fixed |
| Departments per business | 200 | fixed |
| Depth of the department tree | 6 levels | fixed |
| Active member keys per person | 5 | fixed |
| Keys for a whole department, one run | 50 people | fixed |
| Service keys per server | 200 | fixed |
| Service keys issued in bulk, one run | 20 | fixed |
| Admin MCP keys per business | 10 | fixed |
| Each attached file | 2 MB | fixed |
| All attached files of one skill | 20 MB | fixed |
SKILL.md body | 2,000,000 characters | fixed |
| A whole uploaded package | 8 MB | fixed |
| Entries inside one ZIP file | 1,000 | fixed |
| Depth of an attached file path | 6 segments | fixed |
| Invitation validity | 7 days | fixed |
| Validity of a 6-digit email code | 10 minutes | fixed |
| Usage log retention | 90 days | system administrator |
| One CSV export | 100,000 rows | fixed |
Rate limits
| Action | Ceiling |
|---|---|
| Sign-in, per IP address | 10 per 15 min |
| Failed sign-in, per account | 5 per 15 min |
| Entering a two-factor code | 10 per 15 min |
| Creating an account | 5 per hour |
| Asking for an email code | 3 per 5 min |
| Entering an email code | 10 per 15 min, 5 wrong ones kill the code |
| Uploading a skill package | 30 per 10 min |
| MCP calls, per key | 120 per minute |
| Admin MCP calls, per key | 60 per minute |
A successful password reset clears the failed sign-in counter for that account, so you don't have to sit out the full 15 minutes before signing in.
Naming rules
- Skill name
- 2–100 characters, letters, numbers,
-and_only; the first character must be a letter or a number. No accented letters, no spaces. Valid:weekly-report,quy_trinh_sales,SOP2024. Not valid:báo-cáo,quy trình,-abc,report.md. - Attached file name
- Up to 200 characters, at most 6 segments deep. Each segment starts with a letter or a number, then letters, numbers,
.,_,-. No.., no\, and no segment starting with a dot. - Server, business and key names
- Free text, accented letters are fine. Servers and keys up to 100 characters, businesses 80, departments 80, job titles 80.
Error messages you will actually meet
Sign-in and account
| What you see | What it means |
|---|---|
| Wrong email or password. | Deliberately covers both cases, so the sign-in page can't be used to probe which emails exist |
| Too many attempts. Wait a few minutes and try again. | You hit the rate limit. Wait 15 minutes |
| Verify your email address before signing in. | The sign-up was never finished: the 6-digit code is still unentered |
| That code isn't right. Try the next one from your app. | Wrong 2FA code, or your phone's clock has drifted. Wait for the next code |
| This account is locked. | A system administrator locked it. Get in touch with them |
| An account with that email already exists. Sign in instead. | Use Forgot your password? if you can't remember it |
| That code has expired. Ask for a new one. | A 6-digit code lives 10 minutes |
| Too many wrong codes. Request a new one. | Five wrong tries and the code dies |
| This account uses two-step verification, which Google and Facebook can't carry. | With 2FA on you have to sign in with email and password |
| That provider hasn't verified this email address, so we can't link it to an existing account. | Google reported the address as unverified, so it can't be attached to an account that already exists |
| This email already has a password on CoreSkill. | Sign in with email and password instead of Facebook |
Business, departments and people
| What you see | What it means |
|---|---|
| That business doesn't exist, or you're not a member of it. | Deliberately does not separate the two cases |
| This business is suspended by the system administrator. | Talk to whoever runs the server |
| Your membership in this business is suspended. | An admin of the business suspended you |
| You can own at most 3 businesses. | Delete one, or transfer ownership of an older business |
| Move its members, servers and sub-departments out first. | Only an empty department can be deleted |
| A department can't be moved under one of its own sub-departments. | It would make a loop in the tree |
| That person is already an active member of this business. | Edit them on the Members page instead of inviting them again |
| This invitation has expired. Ask the sender to resend it. | A link lives 7 days |
| This invitation was sent to a different email address. | Sign out, then sign in with the address that was invited |
| You don't have permission to do that. | Your role isn't enough. See the permission matrix in Getting started |
Servers, skills and keys
| What you see | What it means |
|---|---|
| You've reached your limit of 5 servers. | Delete a server, or ask the system administrator to raise the quota |
| A skill with that name is already in this server. | Skill names have to be unique inside one server |
| Skill names take letters, numbers, dashes and underscores only. | Drop the accented letters and the spaces |
| Each file must be 2 MB or smaller. | Split the file up, or cut what isn't needed |
| The package has no SKILL.md. | Every skill package must carry that file |
| That file isn't a .zip or .skill package. | Check which file you picked |
| The package is too large. The upload limit is 8 MB. | And every file inside it must be 2 MB or smaller |
| The key limit here is 5. | Revoke or delete one of that person's old keys first |
| Everyone active in that department already has a key. | Nobody left to issue to, which is exactly as it should be |
| That member is suspended. | Reinstate them before issuing a key |
| Pick at least one department, or make the server visible to the whole business. | If you choose Selected departments you have to tick at least one |
Errors on the AI assistant's side
| What the assistant reports | What it means |
|---|---|
| Invalid key | Wrong key, a stray space, or the Bearer in front is missing |
| Key has been revoked | It was revoked. Ask for a new one |
| Key has expired | It expired. Ask for a new one |
| Key does not belong to this business hub | You pasted a key from another business, or from the wrong key family |
| Your membership in this business is suspended | The membership is suspended |
| Business hub not found | The business id in the address is wrong |
| This business hub is suspended | The business is suspended, or its owner's account is locked |
| Skill MCP is disabled | The system administrator turned the master switch off |
| Rate limit exceeded | Calling too fast. Wait a minute |
| No skill named … is available to you | The skill doesn't exist, or it isn't on a server you may read |
| That skill name exists on several servers | Two skills share the name. Have the AI call again with the server name |
Pages that say not found
This is usually deliberate, not a bug. CoreSkill answers *not found* rather than *not allowed*, so that an address never turns into a way of probing what exists inside the system.
| Role | Blocked from |
|---|---|
| Member | Skill servers, server detail, skill detail, Members, Departments, Member keys |
| Manager | Admin MCP |
| Not a system administrator | the whole Admin area (sent back to the home page, with no message) |
Still stuck?
- Open Usage logs and filter Status = Denied. Rows there mean the key did reach the server and the problem is the key; no rows at all means the address is wrong, or the client never called.
- Open My access to confirm that a server really is shared with you.
- Ask for a fresh key and try again. A bad copy-paste is by far the most common cause.
- If the whole company breaks at once, ask whoever runs the server whether the master switch is off.