Token cost
A mod is not free to have installed. An agent definition, a Cursor rule or an instructions file is injected into the context of every session, whether or not you use it that day. Nobody prints this, so nobody knows what their configuration costs.
Every page carries two figures. Per session is what the mod adds before it is invoked: for a skill that is only its name and description, because skills are progressive disclosure; for an agent, command, rule or instructions file it is the whole body, because those are injected whole. Once invoked is the entire file, excluding the scripts and references a skill only reads on demand.
Counted locally with the o200k_base tokenizer: exact for GPT models and within a few percent for Claude. That is a deliberate trade against making one API call per item to be told approximately the same number.
MCP servers are the important special case and the one nobody has solved. The file itself is not what sits in context — the tool schemas are, and thirty tools can be ten thousand tokens per session. Those are parsed from the server's source where it can be read, and marked not measured where it cannot. Saying so is more useful than a confident wrong number.
Security scan
A mod is markdown that instructs an agent. A hook is a shell command. An MCP server is a process on your machine. Installing one with a single click is a supply-chain decision, and the catalogues that offer that click say nothing about what is in the file.
Every body is scanned for: hidden Unicode (zero-width and bidirectional characters that a reader cannot see and a model can), instruction-override phrasing, downloads piped straight into a shell, recursive force deletes, privilege escalation, credential paths such as .env, id_rsa and ~/.aws, encoded payloads, and plain network or shell access.
The result is a grade from A to F and every finding printed with the line that produced it. That last part is the whole point. A grade nobody can check is the badge this exists to replace, and plenty of findings are perfectly reasonable in context — a skill that cleans up a workspace with rm -rf is doing its job. You are given what was found and the line it was found on, and you decide.
It is a scan, not an audit, and it says so on every page it appears.
The AI review
The scan is regular expressions: fast, run on every file, but blind to context. It cannot tell a bug-bounty guide that explains curl … | bash from a file that runs it. Measured against reviewed samples, an F grade is a false positive most of the time — the low grades are mostly security guides, blocklists, official installers, and mods cleaning up their own scratch directory.
So the worst grades get a second pass. Each flagged file, with the lines that triggered it and the text around them, is read by a model (Sonnet 5, with the confirmed-dangerous ones re-read by Fable 5.1). It marks each finding real or a false positive, gives the file an overall risk, and — because it read the whole file, not a pattern — its grade overrides the scanner's. A reviewed file carries a dated AI security review badge saying which model and when.
Dual-use is not danger. A file can contain real offensive commands — a Linux privilege-escalation reference, a cloud-pentest playbook — and still be legitimate: reference material for authorized testing, in the style of HackTricks or LinPEAS. The review clears those (a green badge, a middle grade like C — reviewed, legitimate, but security-sensitive) rather than flagging them.
Confirmed unsafe is reserved for what harms the person installing it: a jailbreak that disables the agent's own safety, a credential stealer disguised as a tool, a sandbox escape, an attack chain that grants itself authorization. Those get a red banner and are kept out of the listings' default view; pure malware demonstrations and test fixtures are retired outright.
The hooks — commands an agent runs on an event without anyone reading them — were reviewed as a set, definition and script together: the hooks security audit, and every skill also gets a local NVIDIA SkillSpector scan.
Third-party audits
Some files here have also been read by scanners that are not ours. Two auditors publish verdicts on agent skills — Socket and Snyk — and where one of them has published a scan of a skill listed here, its verdict is shown beside ours. For an MCP server that launches an npm or PyPI package, the package is looked up on Socket. Where no published Snyk scan exists, Snyk's open-source agent-scan is run here instead.
A pill says Socket: pass or Snyk: fail. It is their verdict rather than ours, and it carries their date: none of them pins a commit, so an audit from March may describe an older version of the file than the one on this page. The scan grade above is ours and is computed on exactly the version shown.
A third scanner, NVIDIA SkillSpector, is run here over every skill. We checked its accuracy on a sample and found about 96% of its high-severity flags on skills were false positives — a static scanner reads a skill’s prose and matches words, not meaning — so its flags are shown as a caution (a SkillSpector: warn pill), never as a fail, and never as the thing that raises a red mark. The full findings are on the skill’s page for you to read; the report explains what we found.
Skills are matched to a published audit by repository and by the name of the directory the file sits in. A repository with two skills in same-named directories is not matched at all rather than matched wrongly, and a skill nobody has audited simply shows no pill.
Origin and copies
Most of what a crawl of GitHub finds is a copy of something else. A catalogue that lists all of it is making the search harder, not easier.
Bodies are hashed with a simhash over token shingles, so near-identical documents land within a few bits of each other and similarity is a popcount rather than a comparison against every other row. Documents within six bits are clustered; the member with the most behind it is treated as the original, ties broken by which was seen first. Everything else in the cluster records how identical it is, links to the original, and drops to the tier that carries noindex.
So everything is indexed and only the ones that differ are shown. The copies remain reachable; they simply stop competing with the original for the same query.
Change tracking
Every body is hashed on every crawl and the history is kept, not just the latest state. A file that gained a network call this week is a thing you should be able to see, and a supply-chain change to an agent configuration is a question of when rather than whether.
Each item page lists the versions seen, with the date and the content hash. Re-measurement happens only when a hash changes, which is also what keeps lastmod in the sitemaps honest.
Community rating
The stars under the buttons are satisfaction, rated by people — the one signal no measurement can produce. One vote per address per mod, from 1 to 5, changeable any time, no account: your address is HMAC'd server-side and only the digest is stored, so the table never says who rated what.
A vote marked verified install carried the code the install API hands out — the rater demonstrably went and fetched the mod, through npx agentmods add and then npx agentmods rate, or by following the link the CLI prints. Votes without the code count exactly the same in the average; the verified number just tells you how many raters provably had the thing on disk. Honest limits, stated plainly: the install API is public, so "verified" means "fetched the files", not a notarised fact.
The Top rated sort is Bayesian-weighted: every mod starts from a 3.5-star prior with the weight of five phantom votes, so a single 5-star vote lands just above the unrated crowd and can never outrank a real consensus of hundreds.
Watching for updates
Installed mods do not update themselves — add copies files. Watching is how you hear the source changed: press Watch on any mod page, confirm your address once (double opt-in — nothing is ever sent to an address that did not click its confirmation link), and a daily digest arrives when a watched mod actually changes, with the delta spelled out: lines, tokens per session, and any move in the scan grade.
Every email carries a per-mod unsubscribe, an unsubscribe-everything link that deletes your address outright, and the one-click unsubscribe header your mail client's own button uses. Unconfirmed signups are purged after seven days. Manage everything any time at /watch/manage — a signed link sent to your address is the only key needed. Updating the installed copy is then one command: npx agentmods update.
Ranking
Listings open sorted by repository stars — the ecosystem's proven names first — with a cap of three mods per repository so one giant cannot occupy the page. The composite score below powers the Relevance sort, search ranking and the home rails; there, reputation enters through log10, which is the load-bearing detail — without it that score is a ranking of five repositories.
The composite score, out of 100: reputation 25, freshness 20, security 20, originality 15, content quality 10, traction 10. An F grade is capped at 40 whatever else it has going for it, because a ranking you can climb by being popular and unsafe is not one worth trusting.
Two display rules follow from the same reasoning. No more than three mods from one repository appear on a page of results, with the rest collapsed behind a link. And every card shows the reason it is where it is: stars, freshness, grade, token cost and origin, so the score is never a black box.
You can also sort by fewest tokens, by security grade, and by stars gained this week — a delta rather than a total, because a total tells you what was popular two years ago and cannot be inherited from a parent repository.
Licences and bodies
Metadata and links are always shown. A body is reproduced only where the repository carries a licence that permits it: MIT, Apache-2.0, BSD, ISC, MPL-2.0, CC0 or Unlicense. A repository with no LICENSE file is all rights reserved by default, and so is one whose LICENSE is custom enough that neither GitHub nor this catalogue can name it. Those pages carry the metadata, the measurements and a link to the source, and they say which of the two it is.
Nothing here is hosted or modified. Every mod stays where its author put it.
The catalogue itself — the records and the measurements, as distinct from the bodies — is offered under the Open Database License. What that covers, what it asks and how to get bulk access is on the terms page.
The crawler
Authenticated, one request at a time on one token, honouring Retry-After and the rate-limit headers. File bodies come from raw.githubusercontent.com rather than the API, which is both faster and does not spend quota. The user agent identifies the crawler and carries a contact address.
If you would rather your repository were not listed, say so and it is removed. The problem with a crawler is rarely the host; it is an author who was not asked.