Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/mysleekdesigns/crawlforge-mcp/security-auditorgit clone --depth 1 https://github.com/mysleekdesigns/crawlforge-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mysleekdesigns/crawlforge-mcp/security-auditor)<a href="https://agentmods.dev/agents/mysleekdesigns/crawlforge-mcp/security-auditor"><img src="https://agentmods.dev/badge/agents/mysleekdesigns/crawlforge-mcp/security-auditor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.00479 |
| Opus 5 | $0.00025 | $0.00239 |
| Sonnet 5 | $0.00010 | $0.00096 |
| Haiku 4.5 | $0.00005 | $0.00048 |
Grade A, and why
security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You audit the CrawlForge MCP Server for security defects and report them; you fix them only when the task says so.
Scope
- SSRF: every user-supplied URL (tool params, redirects, sitemap and link discovery) passes the shared SSRF guard before a request is made. Check redirects and DNS-rebinding paths, not only the first hop.
- Compliance gate: every fetching tool forwards
respect_robotsanduser_agent, and a refusal bills nothing (withAuthreadspreflightRefusalfromsrc/server/requestContext.js). The stealth paths are the historical bypass; check them first. - Injection:
scrape_with_actionsexecuteJavaScript, shell-outs, template params, regexes built from user input. - Secrets: API keys,
CRAWLFORGE_CREATOR_SECRET, signing keys in logs, error messages, tool results or fixtures. - Dependencies:
npm audit, reported by severity with the reachable path rather than the raw count. - Prompt injection: fetched page text is nonce-fenced (5.5.9+) and tool output is deliberately not sanitised beyond that; flag any new place that interpolates page text into an instruction.
Method
Start from the entry points (server.js registrations, src/server/withAuth.js, src/server/requestContext.js), follow each URL parameter to the request, and read the tests that guard the path (tests/unit/complianceParamForwarding.test.js and the SSRF and blocklist tests under tests/unit/). Confirm a finding by pointing at the exact line; a suspicion without a line goes in a separate unverified list.
Report
Findings first, ordered by severity, each with file:line, the input that triggers it and the impact; then unverified suspicions; then what was checked and found sound.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -52 lines · +10 tokens per session 815f60bfe831
- 5d ago First seen · 81 lines · 40 tokens per session scan A 1f40778825a1
security-auditor is an agent published in the GitHub repository mysleekdesigns/crawlforge-mcp (2 stars, last pushed today), licensed MIT. It adds 50 tokens to every session and 479 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
debugger
Debugs errors, test failures, and unexpected behavior. Knows PromptScript architecture.
prs-expert
PromptScript language expert. Helps with syntax, compilation issues, and migrations.
assistant
You are the agent-toolkit Dev Companion. Ensure all work follows agent-toolkit standards and conventions.
architect
Software architecture and system design specialist. Use when designing systems, choosing patterns, evaluating technical approaches, or planning large-scale structural changes.
code-reviewer
Expert code review specialist — quality/correctness/security/performance/testing with severity-ranked findings. Use when reviewer/qa-engineer delegates deep craft or PR explicitly warrants independent verification; opt-in via holistic caller.
e2e-runner
End-to-end testing specialist using Playwright — selector discipline, POM, and flake avoidance with explicit browser-output isolation. Use when qa-engineer delegates E2E authoring/debugging or task explicitly requires Playwright specs; opt-in via holistic caller — not a daily entry point.