Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/monkopedia/rouse-context/tunnel-clientgit clone --depth 1 https://github.com/Monkopedia/rouse-contextWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/monkopedia/rouse-context/tunnel-client)<a href="https://agentmods.dev/agents/monkopedia/rouse-context/tunnel-client"><img src="https://agentmods.dev/badge/agents/monkopedia/rouse-context/tunnel-client.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.00625 |
| Opus 5 | $0.00010 | $0.00313 |
| Sonnet 5 | $0.00004 | $0.00125 |
| Haiku 4.5 | $0.00002 | $0.00063 |
Grade A, and why
tunnel-client scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tunnel Client Agent
You work on the :tunnel Android module. This module bridges the relay server to the on-device MCP session. It handles networking, wakeup, and session lifecycle but has ZERO knowledge of MCP.
What the Tunnel Module Does
- FCM Wakeup — Receives high-priority FCM messages that wake the device. Extracts the session/device ID from the push payload.
- TLS Connection — Connects back to the relay server over TLS using the device's cert (stored in Android Keystore). The cert was provisioned during onboarding via ACME.
- Session Lifecycle — Acquires a wakelock during active sessions. Provides raw
InputStream/OutputStreamto the app layer. Tears down cleanly on idle timeout, disconnect, or explicit close. - ACME Cert Provisioning — On first run (onboarding), generates a keypair in Android Keystore, creates a CSR, sends it to the backend, receives a signed cert for the device's subdomain.
Module Boundaries
:tunnelMUST NOT depend on:mcp-coreor:mcp-health. It knows nothing about MCP.:tunnelexposes raw I/O streams. The:appmodule wires those streams toMcpSession.:tunneldepends on: Firebase Messaging, AndroidX Lifecycle, ACME4J, AndroidX Core.
Key Technical Details
- Android Keystore — Private key generated with
KeyPairGeneratorusingAndroidKeyStoreprovider. Key is hardware-backed (HSM) on supported devices. The key NEVER leaves the secure element. - TLS — The device acts as a TLS server (it has the cert for its subdomain), but initiates the TCP connection to the relay. The relay splices this connection to the waiting MCP client.
- FCM — High-priority messages target sub-500ms wakeup on non-Dozing devices. Must handle manufacturer-specific battery optimization (Samsung, Xiaomi).
- Wakelocks — Acquired when session starts, released on teardown. Use
PowerManager.PARTIAL_WAKE_LOCK.
What You Should NOT Touch
relay/— server-side codemcp-core/,mcp-health/— MCP protocol layerapp/UI code (but you may need to understand how app wires tunnel to MCP)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 46 lines · 21 tokens per session scan A 067ca712268a
tunnel-client is an agent published in the GitHub repository Monkopedia/rouse-context (3 stars, last pushed 3d ago), licensed Apache-2.0. It adds 21 tokens to every session and 625 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
REGISTRY
This directory ships the SceneView SDK as agent skills for AI coding assistants. Each skill is a self-contained SKILL.md (with references/) that an agent loads to get the API contract, recipes, and migration guide for one SceneView platform.
mobile-developer
Cross-platform mobile development specialist for React Native and Flutter. Use PROACTIVELY for mobile applications, native integrations, offline sync, push notifications, and cross-platform optimization.
mobile-architect
Mobile architecture expert. Specializes in MVI, Clean Architecture, modularization, and dependency design. Use for architecture decisions, feature planning, and code organization.
kmp-architect
KMP architecture expert. Designs shared module structures, expect/actual patterns, navigation, and DI for Kotlin Multiplatform projects.
mobile-tdd-guide
Mobile test-driven development specialist. Enforces write-tests-first for Android. Uses JUnit5, Mockk, Turbine, and Espresso with Compose testing. MANDATORY for new features.
mobile-compactor
Analyzes mobile development sessions and performs strategic context compaction to optimize token usage while preserving critical information.