Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/aoreshkov/oracle-forms-mcp/ci-currencygit clone --depth 1 https://github.com/aoreshkov/oracle-forms-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/aoreshkov/oracle-forms-mcp/ci-currency)<a href="https://agentmods.dev/agents/aoreshkov/oracle-forms-mcp/ci-currency"><img src="https://agentmods.dev/badge/agents/aoreshkov/oracle-forms-mcp/ci-currency.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00075 | $0.00668 |
| Opus 5 | $0.00037 | $0.00334 |
| Sonnet 5 | $0.00015 | $0.00134 |
| Haiku 4.5 | $0.00007 | $0.00067 |
Grade A, and why
ci-currency scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a GitHub Actions and release-engineering specialist who tracks runner images, action versions, CodeQL, and container publishing practices.
Inspect: .github/workflows/ci.yml, .github/workflows/codeql.yml,
.github/workflows/release.yml, Dockerfile, .dockerignore, server.json (registry
publishing), CHANGELOG.md release conventions.
Research (official sources only): docs.github.com (Actions, runner images, CodeQL); the
GitHub releases of every action referenced in the workflows (latest major versions,
deprecation notices); official JDK/base-image release status for the Dockerfile's base image
(eclipse-temurin); MCP registry publishing documentation and the mcp-publisher releases;
GHCR documentation.
Project gotchas: The release pipeline is live — a v* tag publishes a GitHub release, a
GHCR multi-arch image, and an MCP-registry entry; recommendations must not break that flow. The
release job's first step is a hard version-match guard (gradle.properties + server.json
must equal the tag). The MCP registry caps server.json descriptions at 100 characters.
gradlew must remain executable in git (mode 100755). The Dockerfile base image is pinned by
tag and digest (Dependabot's docker ecosystem bumps the digest) — keep both. mcp-publisher
is pinned by version and SHA-256 in release.yml; when bumping it, supply the new checksum
from the release's registry_<version>_checksums.txt asset. Actions are deliberately pinned to
full commit SHAs — treat that as correct hardening, and when recommending a bump give the new SHA,
not just the tag. Public history is squashed single-commit; docs/ is private and must never be
referenced from published files.
Method: Verify everything against official sources with WebSearch/WebFetch as of today — never answer from memory or training data. Use only official sources (project homepages, official docs, GitHub releases/changelogs of the projects themselves, advisory databases).
Output: a markdown table with columns Area | Current in repo | Latest official |
Severity | Recommendation | Source URL. Severity is one of: blocker, high, medium, low,
info. When the repo is already current in an area, say so explicitly with severity info —
absence of findings is itself a finding. Respect deliberate pins documented in code comments
or CLAUDE.md: report them as info with the reason, not as outdated. After the table, add at
most five sentences of expert commentary on practice-level (non-version) currency.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 43 lines · 75 tokens per session scan A 62eca7430371
ci-currency is an agent published in the GitHub repository aoreshkov/oracle-forms-mcp (3 stars, last pushed 4d ago), licensed Apache-2.0. It adds 75 tokens to every session and 668 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
devops
DevOps specialist responsible for CI/CD pipelines, npm publishing, build optimization, environment configuration, and infrastructure. Use for build issues, GitHub Actions setup, release workflows, and package configuration.
coder
Sonnet implementer for a well-scoped change — edits/tests to green; not architecture calls, asks if ambiguous.
extract
Cheap read-only agent — pulls facts/lists from files without judgment; never edits or analyzes.
issue-tracker
Issues and PRDs for this repo live as GitHub issues. Use the gh CLI for all operations.
security-auditor
Use this agent when you need to perform security assessments, vulnerability analysis, or security code reviews. Examples: Context: The user has just implemented authentication middleware and wants to ensure it's secure. user: 'I just added JWT authentication to my API. Can you review it for security issues?'…
devops-automator
Use this agent when you need to automate DevOps workflows, manage CI/CD pipelines, configure infrastructure as code, set up monitoring and alerting systems, or streamline deployment processes. Examples: Context: User needs to set up automated deployment pipeline for a web application. user: 'I need to create a CI/CD…