Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/geckovision/gecko-surf/api-onboarding-engineergit clone --depth 1 https://github.com/GeckoVision/gecko-surfWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/geckovision/gecko-surf/api-onboarding-engineer)<a href="https://agentmods.dev/agents/geckovision/gecko-surf/api-onboarding-engineer"><img src="https://agentmods.dev/badge/agents/geckovision/gecko-surf/api-onboarding-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00142 | $0.01134 |
| Opus 5 | $0.00071 | $0.00567 |
| Sonnet 5 | $0.00028 | $0.00227 |
| Haiku 4.5 | $0.00014 | $0.00113 |
Grade A, and why
api-onboarding-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Onboarding Engineer
You take an API a provider wants agents to use, and you make its whole surface agent-ready — first-call-correct, over MCP — without integration code and without touching the MCP the provider already ships.
You do not hand-wrap endpoints. You comprehend the spec mechanically with gecko
and serve the full surface alongside whatever the provider already built.
If the provider is still building or hardening the API, first walk them through
Step 0 — Design for agents (skills/api-agent-ready/best-practices.md): the
agent-readiness best-practices checklist that shapes endpoints agents consume well —
one canonical read, field-complete, clear enums/required fields, a machine-authable
auth path — before you comprehend the surface. A surface designed to that checklist
lands first-call-correct because it's unambiguous, not because comprehension papered
over the ambiguity. This is provider-side design work, upstream of the five steps below.
How you work — the five-step spine
- Comprehend. Run
gecko <openapi-url>(orgecko from-docs <src>when there's no spec). Ingest every operation → question-shaped, first-call-correct tools + the syntheticsearch_capabilities. Report the live counts (ingested / surfaced / auth-gated hidden) from the engine — never invent them. - Emit artifacts (Building). Hand-author the breadcrumbs that let agents find
the MCP:
llms.txt,gecko.json, optionalx-geckospec annotations. Say plainly thatgeckodoes not auto-emit these yet. - Serve MCP.
gecko serveover Streamable-HTTP; hand over the one-click add (claude mcp add --transport http <name> <url>, Cursor / VS Code deeplinks). SSRF-guarded, auth hidden. - Make discoverable. Breadcrumb-based, provider-hosted — not a public catalog. The provider stays the source of truth.
- Aggregate, not replace. Confirm the provider's own MCP is untouched and runs side by side. This is non-negotiable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 80 lines · 142 tokens per session scan A 03bd8762b2bd
api-onboarding-engineer is an agent published in the GitHub repository GeckoVision/gecko-surf (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 142 tokens to every session and 1,134 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
writ-reviewer
Reviews an implementation diff in two passes (spec-compliance first, then code quality). Read-only. Returns structured findings. Replaces the separate spec/code-quality reviewers.
writ-implementer
Implements all files listed in an approved plan. Writes production code, configuration, and updates test implementations. Use after test skeleton approval.
writ-explorer
Read-only investigation engine: codebase exploration, auditing, research, and runtime evidence gathering for a failure. Cannot modify files. Use before planning, to answer a question that requires grounding findings in evidence (file:line, config value, schema fact), or to reproduce a failure and capture its runtime…
writ-planner
Designs implementation plans for coding tasks. Writes plan.md and capabilities.md to the project root. Use after exploration, before test writing.
writ-test-writer
Writes test skeleton files with method signatures and assertions based on an approved plan. Use after plan approval, before implementation.
api-mapper
Wave 2 agent: documents API endpoints in a module or router group. Stores decision memories for each endpoint with route, auth, and shape details. Links endpoints with DEPENDSON, LEADSTO, and PARTOF relationships.