Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/agentrhq/webcmd/codex-cligit clone --depth 1 https://github.com/agentrhq/webcmdWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01073 |
| Opus 5 | $0.00000 | $0.00536 |
| Sonnet 5 | $0.00000 | $0.00215 |
| Haiku 4.5 | $0.00000 | $0.00107 |
Grade B, and why
codex-cli scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Its one web tool is `web_search`, set by the top-level `web_search` key in `~/.codex/config.toml`. **Keep it enabled.** Webcmd has no search index of its own, and search is how a question becomes URLs for Webcmd to read. How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent prompt
Fetch and follow https://raw.githubusercontent.com/agentrhq/webcmd/main/start.md to set up Webcmd end to end.
Manual
Requirements
- Node.js 20.6+
- The
webcmdnpm CLI, installed globally or in the project - Codex CLI (
codex), installed and authenticated - A browser runtime; confirm with
webcmd doctorbefore browser work
Install and configure
Pick one of the two paths below. Do not use both — the plugin already carries the skills, and installing them again leaves duplicates.
Plugin (recommended)
Add the marketplace and install the plugin:
codex plugin marketplace add agentrhq/webcmd
codex plugin add webcmd@webcmd
codex plugin add takes PLUGIN@MARKETPLACE, or a bare plugin name with -m webcmd. Pin a version with codex plugin marketplace add agentrhq/webcmd --ref <tag>.
The same flow is available in the TUI: run /plugins, choose Add plugin marketplace, and enter agentrhq/webcmd or https://github.com/agentrhq/webcmd.
The plugin bundles all seven Webcmd skills, and installs the npm CLI on first use if webcmd is missing. Start a new task after installing.
Useful follow-ups: codex plugin list, codex plugin remove webcmd, codex plugin marketplace upgrade. All accept --json.
Manual
npm install -g @agentrhq/webcmd
webcmd doctor
webcmd skills add
When webcmd skills add prompts, choose the agents provider. It installs into ~/.agents/skills/ (user) or .agents/skills/ (project), which Codex CLI reads on startup. Codex then surfaces webcmd-usage and webcmd-browser as skills.
Restart Codex (or start a new session) after installing skills.
Override default tools
Nothing to disable. Codex CLI has no fetch tool and no browser tool, so Webcmd does not displace anything — it adds the surface Codex is missing. Codex drives it through the shell tool.
Its one web tool is web_search, set by the top-level web_search key in ~/.codex/config.toml. Keep it enabled. Webcmd has no search index of its own, and search is how a question becomes URLs for Webcmd to read.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 94 lines · 0 tokens per session scan B 2f70995bf28e
codex-cli is an agent published in the GitHub repository agentrhq/webcmd (1,594 stars, last pushed 2d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,073 tokens. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
e2e-tester
Tests web applications end-to-end using Glance browser MCP. Navigates pages, fills forms, clicks buttons, takes screenshots, runs assertions, and reports bugs. Use when you want to verify an app works correctly — login flows, forms, navigation, responsiveness — with real browser interaction.
browser-driver
Drives a delegated multi-step browser task through Fast Browser and returns only the distilled result.
test-planner
An expert QA test planner agent that explores web applications and APIs to create comprehensive, risk-prioritized test plans.
bxc-scrape-debugger
Use when a Bxc scraper fails, gets blocked (403/429/captcha), or returns empty/wrong data. Inspects HTML / headers / console dumps and proposes the next profile escalation step.
{{APP_NAME}}-builder
Maintain and extend the {{APPNAME}} MOAB automation — add features, re-mine broken selectors, and upgrade the server. Privileged; use deliberately, not for day-to-day automation.
playwright-test-planner
Use this agent when you need to create comprehensive test plan for a web application or website.