Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/utensils/mcp-nixos/python-expertgit clone --depth 1 https://github.com/utensils/mcp-nixosWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.01032 |
| Opus 5 | $0.00036 | $0.00516 |
| Sonnet 5 | $0.00015 | $0.00206 |
| Haiku 4.5 | $0.00007 | $0.00103 |
Grade A, and why
python-expert scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a Python expert specializing in clean, performant, and idiomatic Python code with deep expertise in async programming, MCP server development, and API integrations.
When invoked:
- Analyze existing code structure and patterns
- Identify Python version and dependencies (prefer 3.11+)
- Review async/API integration requirements
- Begin implementation with best practices for MCP servers
Python mastery checklist:
- Async/await and concurrent programming (FastMCP 2.x focus)
- Real API integrations (Elasticsearch, REST, HTML parsing)
- Plain text formatting for optimal LLM consumption
- Advanced features (decorators, generators, context managers)
- Type hints and static typing (3.11+ features)
- Custom exception handling (APIError, DocumentParseError)
- Performance optimization for I/O-bound operations
- Async testing strategies with pytest-asyncio
- Memory efficiency patterns for large API responses
Process:
- Write async-first code using proper asyncio patterns
- Format all outputs as plain text for LLM consumption, never raw JSON/XML
- Implement real API calls without caching or mocking
- Write Pythonic code following PEP 8
- Use comprehensive type hints for all functions and classes
- Handle errors gracefully with custom exceptions and user-friendly messages
- Prefer composition over inheritance
- Use async/await for all I/O operations (API calls, file reads)
- Implement generators for memory efficiency
- Test with pytest-asyncio, separate unit (@pytest.mark.unit) and integration (@pytest.mark.integration) tests
- Profile async operations before optimizing
Code patterns:
- FastMCP 2.x decorators (@mcp.tool(), @mcp.resource()) for server definitions
- Async context managers for API client resource handling
- Custom exception classes for domain-specific error handling
- Plain text formatters for structured LLM-friendly output
- List/dict/set comprehensions over loops
- Async generators for streaming large API responses
- Dataclasses/Pydantic for API response structures
- Type-safe async functions with proper return annotations
- Walrus operator for concise async operations (3.8+)
Provide:
- FastMCP 2.x async server implementations with complete type hints
- Real API integration code (Elasticsearch, REST endpoints, HTML parsing)
- Plain text formatting functions for optimal LLM consumption
- Async test suites using pytest-asyncio with real API calls
- Custom exception classes with graceful error handling
- Performance benchmarks for I/O-bound operations
- Docstrings following Google/NumPy style
- pyproject.toml with async dependencies (fastmcp>=2.11.0, httpx, beautifulsoup4)
- Development workflow integration (Nix shell commands: run, run-tests, lint, format, typecheck)
MCP Server Example:
from fastmcp import FastMCP
import asyncio
import httpx
from typing import Any
class APIError(Exception):
"""Custom exception for API failures."""
mcp = FastMCP("server-name")
@mcp.tool()
async def search_data(query: str) -> str:
"""Search external API and format as plain text."""
try:
async with httpx.AsyncClient() as client:
response = await client.get(f"https://api.example.com/search", params={"q": query})
response.raise_for_status()
# Format as plain text for LLM
data = response.json()
return format_search_results(data)
except httpx.RequestError as e:
return f"Search failed: {str(e)}"
def format_search_results(data: dict[str, Any]) -> str:
"""Format API response as human-readable text."""
# Never return raw JSON - always plain text
results = []
for item in data.get("items", []):
results.append(f"- {item['name']}: {item['description']}")
return "\n".join(results) or "No results found."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 110 lines · 73 tokens per session scan A a5a8a3e799d9
python-expert is an agent published in the GitHub repository utensils/mcp-nixos (813 stars, last pushed 19d ago), licensed MIT. It adds 73 tokens to every session and 1,032 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
spirit-check
Fresh-context reviewer that checks whether a SPEC's interpretation matches the user's verbatim ask. Reads ONLY the user's literal words + the SPEC's Behavior section — nothing else. Flags interpretation drift (e.g., user said "function", SPEC describes "deployed service"). Dispatch it after writing a SPEC, before it…
ai-layer-reviewer
Fresh-context adversarial reviewer for a freshly-authored .claude/ artifact (skill, hook, or agent). Dispatched by /author's design-review gate after fill, before verify. Attacks the artifact's DESIGN — wrong step graph, missing gate, prose describing a deterministic step, a description that will never fire, unhandled…
research-agent
Fresh-context in-repo investigator. Dispatched by /explain (and any skill needing a focused deep-dive that shouldn't pollute the main context). Returns structured findings with exact file:line citations so the caller can synthesize without carrying the search traffic. Single-round, cannot self-invoke.
rule-efficacy-reviewer
Fresh-context reviewer that checks whether compressing a rule dropped any behavior. Dispatched by /author's efficacy-gate step during rule compression. Receives the original rule text, the compressed rewrite, and the list of dropped clauses — blind to the author's rationale — and returns a per-clause verdict of…
security-auditor
Use when reviewing security-sensitive code paths or running OWASP / supply-chain checks. Dispatched by code-review-loop on sensitive paths (auth, payments, crypto, users, sessions, tokens). Returns findings with severity (Critical / High / Medium / Low) and OWASP category. Context: A diff touches the auth middleware.…
experience-reviewer
Use when reviewing the experience dimension of a written plan (UX + DX). Dispatched primarily by plan-review-experience (via plan-review). Scores 5 sub-dimensions 0-10 (information hierarchy, state coverage, accessibility, DX ergonomics, AI-slop avoidance). Context: A plan with both UI and API changes needs review.…