Token cost
A mod is not free to have installed. An agent definition, a Cursor rule or an instructions file is injected into the context of every session, whether or not you use it that day. Nobody prints this, so nobody knows what their configuration costs.
Every page carries two figures. Per session is what the mod adds before it is invoked: for a skill that is only its name and description, because skills are progressive disclosure; for an agent, command, rule or instructions file it is the whole body, because those are injected whole. Once invoked is the entire file, excluding the scripts and references a skill only reads on demand.
Counted locally with the o200k_base tokenizer: exact for GPT models and within a few percent for Claude. That is a deliberate trade against making one API call per item to be told approximately the same number.
MCP servers are the important special case and the one nobody has solved. The file itself is not what sits in context — the tool schemas are, and thirty tools can be ten thousand tokens per session. Those are parsed from the server's source where it can be read, and marked not measured where it cannot. Saying so is more useful than a confident wrong number.
Security scan
A mod is markdown that instructs an agent. A hook is a shell command. An MCP server is a process on your machine. Installing one with a single click is a supply-chain decision, and the catalogues that offer that click say nothing about what is in the file.
Every body is scanned for: hidden Unicode (zero-width and bidirectional characters that a reader cannot see and a model can), instruction-override phrasing, downloads piped straight into a shell, recursive force deletes, privilege escalation, credential paths such as .env, id_rsa and ~/.aws, encoded payloads, and plain network or shell access.
The result is a grade from A to F and every finding printed with the line that produced it. That last part is the whole point. A grade nobody can check is the badge this exists to replace, and plenty of findings are perfectly reasonable in context — a skill that cleans up a workspace with rm -rf is doing its job. You are given what was found and the line it was found on, and you decide.
It is a scan, not an audit, and it says so on every page it appears.
Origin and copies
Most of what a crawl of GitHub finds is a copy of something else. A catalogue that lists all of it is making the search harder, not easier.
Bodies are hashed with a simhash over token shingles, so near-identical documents land within a few bits of each other and similarity is a popcount rather than a comparison against every other row. Documents within six bits are clustered; the member with the most behind it is treated as the original, ties broken by which was seen first. Everything else in the cluster records how identical it is, links to the original, and drops to the tier that carries noindex.
So everything is indexed and only the ones that differ are shown. The copies remain reachable; they simply stop competing with the original for the same query.
Change tracking
Every body is hashed on every crawl and the history is kept, not just the latest state. A file that gained a network call this week is a thing you should be able to see, and a supply-chain change to an agent configuration is a question of when rather than whether.
Each item page lists the versions seen, with the date and the content hash. Re-measurement happens only when a hash changes, which is also what keeps lastmod in the sitemaps honest.
Community rating
The stars under the buttons are satisfaction, rated by people — the one signal no measurement can produce. One vote per address per mod, from 1 to 5, changeable any time, no account: your address is HMAC'd server-side and only the digest is stored, so the table never says who rated what.
A vote marked verified install carried the code the install API hands out — the rater demonstrably went and fetched the mod, through npx agentmods add and then npx agentmods rate, or by following the link the CLI prints. Votes without the code count exactly the same in the average; the verified number just tells you how many raters provably had the thing on disk. Honest limits, stated plainly: the install API is public, so "verified" means "fetched the files", not a notarised fact.
The Top rated sort is Bayesian-weighted: every mod starts from a 3.5-star prior with the weight of five phantom votes, so a single 5-star vote lands just above the unrated crowd and can never outrank a real consensus of hundreds.
Watching for updates
Installed mods do not update themselves — add copies files. Watching is how you hear the source changed: press Watch on any mod page, confirm your address once (double opt-in — nothing is ever sent to an address that did not click its confirmation link), and a daily digest arrives when a watched mod actually changes, with the delta spelled out: lines, tokens per session, and any move in the scan grade.
Every email carries a per-mod unsubscribe, an unsubscribe-everything link that deletes your address outright, and the one-click unsubscribe header your mail client's own button uses. Unconfirmed signups are purged after seven days. Manage everything any time at /watch/manage — a signed link sent to your address is the only key needed. Updating the installed copy is then one command: npx agentmods update.
Ranking
Listings open sorted by repository stars — the ecosystem's proven names first — with a cap of three mods per repository so one giant cannot occupy the page. The composite score below powers the Relevance sort, search ranking and the home rails; there, reputation enters through log10, which is the load-bearing detail — without it that score is a ranking of five repositories.
The composite score, out of 100: reputation 25, freshness 20, security 20, originality 15, content quality 10, traction 10. An F grade is capped at 40 whatever else it has going for it, because a ranking you can climb by being popular and unsafe is not one worth trusting.
Two display rules follow from the same reasoning. No more than three mods from one repository appear on a page of results, with the rest collapsed behind a link. And every card shows the reason it is where it is: stars, freshness, grade, token cost and origin, so the score is never a black box.
You can also sort by fewest tokens, by security grade, and by stars gained this week — a delta rather than a total, because a total tells you what was popular two years ago and cannot be inherited from a parent repository.
Licences and bodies
Metadata and links are always shown. A body is reproduced only where the repository carries a licence that permits it: MIT, Apache-2.0, BSD, ISC, MPL-2.0, CC0 or Unlicense. A repository with no LICENSE file is all rights reserved by default, so those pages carry the metadata, the measurements and a link to the source, and they say why.
Nothing here is hosted or modified. Every mod stays where its author put it.
The crawler
Authenticated, one request at a time on one token, honouring Retry-After and the rate-limit headers. File bodies come from raw.githubusercontent.com rather than the API, which is both faster and does not spend quota. The user agent identifies the crawler and carries a contact address.
If you would rather your repository were not listed, say so and it is removed. The problem with a crawler is rarely the host; it is an author who was not asked.