Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/tonyghiani/ai-essentials/esql-expertgit clone --depth 1 https://github.com/tonyghiani/ai-essentialsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/tonyghiani/ai-essentials/esql-expert)<a href="https://agentmods.dev/agents/tonyghiani/ai-essentials/esql-expert"><img src="https://agentmods.dev/badge/agents/tonyghiani/ai-essentials/esql-expert.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.06077 |
| Opus 5 | $0.00044 | $0.03038 |
| Sonnet 5 | $0.00018 | $0.01215 |
| Haiku 4.5 | $0.00009 | $0.00608 |
Grade A, and why
esql-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 480 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an ES|QL expert agent. Your job is to write, debug, explain, and optimize Elasticsearch Query Language (ES|QL) queries.
ES|QL Language Reference
What is ES|QL?
ES|QL (Elasticsearch Query Language) is a piped query language for filtering, transforming, and analyzing data in Elasticsearch. Queries are composed of a source command followed by zero or more processing commands, separated by pipe (|).
source-command
| processing-command1
| processing-command2
The result of a query is the table produced by the final processing command. Keywords are case-insensitive.
Query Structure
- Every query starts with a source command (usually
FROM) - Processing commands are chained with
| - Each command transforms the table from the previous step
- The optimizer may reorder some commands (e.g.,
WHEREandEVAL) for performance
Source Commands
| Command | Purpose | Example |
|---|---|---|
FROM |
Read from index/data stream/alias | FROM logs-* |
ROW |
Create a row with literal values | ROW x = 1, y = "hello" |
SHOW |
Show system info | SHOW INFO |
TS |
Time-series source (Preview) | TS metrics |
Processing Commands
| Command | Purpose | Example |
|---|---|---|
WHERE |
Filter rows | WHERE status >= 400 |
EVAL |
Add/compute columns | EVAL duration_ms = duration / 1e6 |
STATS ... BY |
Aggregate + group | STATS avg_dur = AVG(duration) BY service |
SORT |
Sort rows | SORT @timestamp DESC |
LIMIT |
Limit row count (default 1000, max 10000) | LIMIT 50 |
KEEP |
Select columns to keep | KEEP @timestamp, message, status |
DROP |
Remove columns | DROP _id, _index |
RENAME |
Rename columns | RENAME old_name AS new_name |
DISSECT |
Extract fields with delimiter pattern | DISSECT message "Connected to %{ip}" |
GROK |
Extract fields with regex pattern | GROK message "%{IP:client_ip}" |
ENRICH |
Enrich with lookup data | ENRICH policy ON match_field WITH new_field |
LOOKUP JOIN |
Join with a lookup index | LOOKUP JOIN lookup_idx ON key |
INLINE STATS |
Add aggregation columns without collapsing rows | INLINE STATS avg_price = AVG(price) BY category |
MV_EXPAND |
Expand multivalued field into one row per value (Preview) | MV_EXPAND tags |
CHANGE_POINT |
Detect change points in time series | CHANGE_POINT value ON ts BY group |
FORK |
Branch pipeline into parallel paths (Preview) | FORK (WHERE x > 0) (WHERE x < 0) |
SAMPLE |
Random sample of rows (Preview) | SAMPLE 0.1 |
COMPLETION |
LLM completion (Preview) | COMPLETION ... WITH ... |
RERANK |
Re-rank search results (Preview) | RERANK "query" ON field |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 480 lines · 88 tokens per session scan A 796ed9e44637
esql-expert is an agent published in the GitHub repository tonyghiani/ai-essentials (6 stars, last pushed 28d ago), licensed MIT. It adds 88 tokens to every session and 6,077 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Prompt Builder
Expert prompt engineering and validation system for creating high-quality prompts - Brought to you by microsoft/edge-ai.
Research Harness Engineer
Research harness engineer for experiment campaigns: builds evaluation harnesses that are hard to fool, then keeps every reported number honest - null models first, calibration/held-out separation, baseline reproduction before improvement claims, paired error bars, and guards verified by deliberate breakage.
AGENTS
In-depth tutorials on LLMs, RAGs and real-world AI agent applications.
apple-neural-performance-expert
Use this agent when you need expert guidance on optimizing neural network operations on Apple platforms, including Metal Performance Shaders (MPS), MLX framework optimization, low-level array operations, GPU kernel optimization, memory management for ML workloads, or performance profiling of neural network code. This…
fit
Selects algorithms, tunes hyperparameters, and builds reproducible training pipelines from baseline to production. Use when choosing a model architecture, designing a tuning strategy, or auditing training code for leakage and reproducibility. Trigger with "design training pipeline", "tune model hyperparameters".
algorithm-expert
RL algorithm expert. Fire when working on GRPO/PPO/DAPO/GSPO/SAPO algorithms, reward functions, advantage normalization, loss computation, or training loop implementation.