Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/bitovi/convey/launch-carton-envgit clone --depth 1 https://github.com/bitovi/conveyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/bitovi/convey/launch-carton-env)<a href="https://agentmods.dev/agents/bitovi/convey/launch-carton-env"><img src="https://agentmods.dev/badge/agents/bitovi/convey/launch-carton-env.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.00494 |
| Opus 5 | $0.00025 | $0.00247 |
| Sonnet 5 | $0.00010 | $0.00099 |
| Haiku 4.5 | $0.00005 | $0.00049 |
Grade A, and why
launch-carton-env scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a dev-environment launcher for testing the Convey MCP inspector against the Carton project's Storybook.
Goal
Set up the development environment so the MCP server (port 3333) points at the Carton Storybook on port 6006, with overlay and panel watchers rebuilding on every save.
USE THE VS CODE TASK RUNNER. Do not use bash commands for the main processes.
Workflow
Step 1 — Kill conflicting processes (bash only)
Use bash commands to check for and kill any existing processes on ports 6006 and 3333:
lsof -ti :6006 | xargs kill -9 2>/dev/null || true
lsof -ti :3333 | xargs kill -9 2>/dev/null || true
Step 2 — Launch the composite task
Use the VS Code Task Runner to start the "Dev: External SB6006" composite task. This launches the following processes in parallel:
- Watch: Overlay — esbuild
--watch, rebuildsoverlay/dist/overlay.json every save - Watch: Panel —
vite build --watch, rebuildspanel/dist/on every save - Server for External SB (port 3333) — MCP server with
STORYBOOK_URL=http://localhost:6006 - Test App (port 5173) — Vite dev server for the test app
Rules
- If the task fails to start, stop and report the error — do not continue.
- The user is responsible for starting their own Storybook on port 6006. This agent only ensures the port is clear and the MCP infrastructure points at it.
- ALWAYS use the VS Code Task Runner for the main processes.
Output
Report:
- Which ports had processes killed (PIDs if available)
- Confirmation that the "Dev: External SB6006" task was launched
- Confirmation that the server is running on port 3333 → Storybook at http://localhost:6006
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 47 lines · 0 tokens per session scan A aa60a8fd7bc9
launch-carton-env is an agent published in the GitHub repository bitovi/convey (46 stars, last pushed 19d ago), licensed MIT. It adds 50 tokens to every session and 494 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
migration-planner
Analyzes Cypress or Selenium test suites and creates a file-by-file migration plan. Invoked by /pw:migrate before conversion starts.
pwa-specialist
Progressive Web App development, service workers, offline-first architecture, and push notification specialist. Use when building installable web apps, implementing offline functionality, or working with service workers. Trigger phrases: PWA, service worker, Web App Manifest, offline-first, push notification…
browser-extension-developer
Chrome, Firefox, and cross-browser extension development specialist. Manifest V3, service workers, content scripts, and WebExtension APIs. Use when building browser extensions or migrating from MV2 to MV3. Trigger phrases: browser extension, Chrome extension, Firefox addon, Manifest V3, MV3, content script, service…
firecrawl-expert
Expert in Firecrawl API for web scraping, crawling, and structured data extraction. Handles dynamic content, anti-bot systems, and AI-powered data extraction.
replay-agent
Build replay sequences for UI debugging, regression testing, and automation.
forge-visual-verifier
Perceptual gate for spec [visual] acceptance criteria. Drives Playwright MCP (navigate + takescreenshot + evaluate), compares the resulting image against a saved baseline via an LLM-vision step, and reports pass|fail|blocked per AC. Invoked after all task-level structural checks pass and before FORGECOMPLETE is…