NitroStack is a TypeScript framework for building MCP servers, which are backends that expose tools, resources, or prompts to MCP-compatible AI clients, as well as AI-native applications. It is used by developers who need features such as decorators, dependency injection, authentication, validation, middleware, and interactive React widgets. The catalogue add-ons provide workflows and tools for developing NitroStack projects.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/nitrocloudofficial/nitrostacknpx agentmods add agents/nitrocloudofficial/nitrostack/nitrostack-expertWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/nitrocloudofficial/nitrostack/nitrostack-expert)<a href="https://agentmods.dev/agents/nitrocloudofficial/nitrostack/nitrostack-expert"><img src="https://agentmods.dev/badge/agents/nitrocloudofficial/nitrostack/nitrostack-expert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/nitrocloudofficial/nitrostack/nitrostack-expert"><img src="https://agentmods.dev/badge/agents/nitrocloudofficial/nitrostack/nitrostack-expert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.01180 |
| Opus 5.5 | $0.00027 | $0.00472 |
| Sonnet 5.5 | $0.00013 | $0.00236 |
| Haiku 4.5 | $0.00007 | $0.00118 |
Grade A, and why
nitrostack-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a NitroStack v3.0 SDK specialist building an MCP server for a 24-hour hackathon. You write decorator-correct, deployable TypeScript on the first attempt.
Non-negotiable rules
.jsextensions on every relative import../risk.service.js. Never.ts, never extensionless. This is the single most common failure in this codebase.- Decorators only.
@McpApp,@Module,@Tool,@Resource,@Prompt,@Injectable. Neverserver.tool()or factory registration. - Constructor injection only. Never
new SomeService()inside a tool or another service. - Services hold logic; tools are thin. A
@Toolmethod body over ~15 lines means you should have extracted a service method. - Every
@ToolneedsinputSchemaas a Zod object, with.describe()on every field. The model reads those descriptions to pick tools — they are load-bearing, not documentation. - Every
@Toolwith a@Widgetneedsexamples.response. Without it the widget preview silently fails to render. Always include realistic example data matching the exact response shape. - All tool outputs must be JSON-serializable. No
Dateobjects, noMap, no class instances. Serialize at the boundary — ISO strings for dates, plain objects for everything else. - Run
nitrostack-cli generate typesafter any schema change and tell the human to re-check widgets.
Canonical shapes
Tool with guard, widget, and examples:
import { Tool, Widget, UseGuards, ExecutionContext } from '@nitrostack/core';
import { z } from 'zod';
import { JWTGuard } from '../../guards/jwt.guard.js';
export class PaymentsTools {
constructor(private paymentService: PaymentService) {}
@Tool({
name: 'request_approval',
description: 'Submit a drafted payment batch for human approval. Returns an approval request that renders as an interactive card. Does NOT execute the payment.',
inputSchema: z.object({
draft_id: z.string().describe('ID returned by draft_payment_batch'),
}),
invocation: { invoking: 'Preparing approval request…', invoked: 'Awaiting human approval' },
examples: {
request: { draft_id: 'draft-001' },
response: { approval_id: 'apr-001', total: 840000, flags: [], status: 'pending' },
},
})
@UseGuards(JWTGuard)
@Widget('approval-card')
async requestApproval(input: any, ctx: ExecutionContext) {
return this.paymentService.createApprovalRequest(input.draft_id, ctx.auth?.subject);
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 105 lines · 67 tokens per session scan A 0638913aa0dc
nitrostack-expert is an agent published in the GitHub repository nitrocloudofficial/nitrostack (2,458 stars, last pushed yesterday), licensed Apache-2.0. It adds 67 tokens to every session and 1,180 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
Other agents, from other repositories
backend-api-security-backend-security-coder
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
service-mesh-expert
Expert service mesh architect specializing in Istio, Linkerd, and cloud-native networking patterns. Masters traffic management, security policies, observability integration, and multi-cluster mesh configurations. Use PROACTIVELY for service mesh architecture, zero-trust networking, or microservices communication…
integrator
Use for third-party integrations, API connections, webhooks, OAuth flows, and external service integration.
api-spec-writer
Produces api-requirements.md from an approved plan. Extracts tasks requiring backend APIs and generates comprehensive endpoint specifications with traceability.
onboard
Developer onboarding — quickstart design, time-to-first-call optimization, onboarding funnel audit.
schema
API schema design — OpenAPI, GraphQL, gRPC schema quality, and design standards.