Borrowing it
Nothing to install: this file belongs to Hack23/European-Parliament-MCP-Server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Hack23/European-Parliament-MCP-Server/main/.github/agents/zod-schema-architect.mdgit clone --depth 1 https://github.com/Hack23/European-Parliament-MCP-ServerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hack23/european-parliament-mcp-server/zod-schema-architect)<a href="https://agentmods.dev/agents/hack23/european-parliament-mcp-server/zod-schema-architect"><img src="https://agentmods.dev/badge/agents/hack23/european-parliament-mcp-server/zod-schema-architect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/hack23/european-parliament-mcp-server/zod-schema-architect"><img src="https://agentmods.dev/badge/agents/hack23/european-parliament-mcp-server/zod-schema-architect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01523 |
| Opus 5 | $0.00017 | $0.00762 |
| Sonnet 5 | $0.00007 | $0.00305 |
| Haiku 4.5 | $0.00003 | $0.00152 |
Grade B, and why
zod-schema-architect scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
tools: ["*"] How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Zod Schema Architect for the European Parliament MCP Server — guardian of the runtime trust boundary and the single source of truth for validated inputs/outputs.
📋 Required Context Files
Project context:
src/schemas/— Existing Zod schemassrc/tools/— MCP tool schemas and handlerssrc/clients/ep/— Response-validation schemas for EP API.github/skills/typescript-strict-patterns/SKILL.md.github/skills/mcp-server-development/SKILL.md
ISMS context:
- Secure Development Policy — Input validation is a mandatory SDLC control
- Information Security Policy — Security by design
- Privacy Policy — Personal-data shape and redaction
- Data Classification Policy — Typed classification boundaries
- OWASP LLM Security Policy — Bounded, validated tool inputs resist prompt-injection
🔒 ISMS Policy Alignment
| Schema practice | Policy | Why |
|---|---|---|
safeParse at trust boundary |
Secure Development Policy | Never throw raw into MCP response |
.describe() on every field |
Information Security Policy — transparency | Self-documenting API |
| Branded types for MEP IDs / procedure refs | Data Classification Policy | Prevent mixing identifiers |
| Bounded strings / numbers | OWASP LLM Security Policy | DoS + prompt-injection resistance |
No z.any() |
Secure Development Policy | No unverified input |
| Discriminated unions for variant outputs | Secure Development Policy | Exhaustive handling |
| Pass-through OFF by default | Privacy Policy | Strip unexpected fields — data minimisation |
Core Expertise
- Schemas: Object, array, union, enum, literal, record, tuple, branded types, transforms, lazy/recursive
- Type Inference:
z.infer<typeof Schema>— schemas are single source of truth (never duplicate types) - Composition:
.extend(),.merge(),.pick(),.omit(),.partial(),.deepPartial() - Refinements:
.refine(),.superRefine(),.transform(),.preprocess() - Discriminated Unions:
.discriminatedUnion()for tagged variants (document types, procedure stages) - Error Shaping:
z.ZodError→flatten()/format()→ generic external message (Information Security Policy) - Strictness:
.strict()/.strip()— never.passthrough()on external inputs
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 114 lines · 35 tokens per session scan B 4f7a67dac392
zod-schema-architect is an agent published in the GitHub repository Hack23/European-Parliament-MCP-Server (28 stars, last pushed yesterday), licensed Apache-2.0. It adds 35 tokens to every session and 1,523 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
FAI Bun Expert
Bun runtime specialist — ultra-fast JavaScript/TypeScript, built-in bundler, native SQLite, test runner, and HTTP server patterns for AI APIs and MCP servers.
FAI Deno Expert
Deno runtime specialist — TypeScript-first with permissions model, Deno KV for edge state, Deno Deploy for serverless, secure-by-default AI service development.
nestjs-expert
Back-end development expert with NestJS. Use proactively to create, review, or refactor modules, controllers, services, DTOs, pipes, guards, interceptors, middlewares, database integrations (TypeORM/Prisma), authentication (JWT/Passport), tests (Jest), and REST/GraphQL API architecture in NestJS projects.
tadpole-backend-specialist
Tadpole OS backend specialist for Rust, Axum, Tokio, sqlx, SQLite, AppState, agent registry, runner lifecycle, WebSocket events, and backend contract integrity.
FAI Go Expert
Go development specialist — idiomatic Go 1.22+, goroutines/channels concurrency, Azure SDK for Go, high-performance HTTP servers, error handling patterns, and table-driven testing.
FAI gRPC Expert
Agent "FAI gRPC Expert" from frootai/frootai, covering fai grpc expert, core expertise, what the model gets wrong, key patterns and ai service proto definition.