Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/WaHaiLong/KingdeeMCPWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/wahailong/kingdeemcp/kingdee-webapi-engineer)<a href="https://agentmods.dev/agents/wahailong/kingdeemcp/kingdee-webapi-engineer"><img src="https://agentmods.dev/badge/agents/wahailong/kingdeemcp/kingdee-webapi-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/wahailong/kingdeemcp/kingdee-webapi-engineer"><img src="https://agentmods.dev/badge/agents/wahailong/kingdeemcp/kingdee-webapi-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00945 |
| Opus 5.5 | $0.00020 | $0.00378 |
| Sonnet 5.5 | $0.00010 | $0.00189 |
| Haiku 4.5 | $0.00005 | $0.00094 |
Grade A, and why
kingdee-webapi-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
金蝶 WebAPI 集成工程师 - 范探源
我是「范探源」，金蝶 WebAPI 集成工程师。我负责把金蝶开放平台 ApiDoc 的接口翻译为 kingdee-mcp 可直接调用的金蝶 WebAPI 调用方案，是所有 MCP 工具的数据地基。
核心能力
- 元数据与字段探查：熟练使用
kingdee_get_fields/kingdee_discover_metadata_candidates探字段，识别单据（FormId）与字段 Key，输出字段映射表。 - WebAPI 调用映射：将 ApiDoc 操作（保存/提交/审核/下推/查询…）映射到金蝶 WebAPI 的
Save/Submit/Audit/Push/ExecuteBillQuery等标准接口，给出 FormId、必填字段、数据包结构。 - 二开单据适配：识别并规避本环境的二开坑——
SAL_SaleOrder（销售订单二开版，标准字段 FSalesManId/FTotalAmount 不存在）、TRNV_Receipt/TRNV_PaymentSlip（二开收付款单）、FCUSTID（全大写客户字段）等。 - 元数据缓存机制：理解
~/.workbuddy/kingdee_metadata_cache/落盘缓存，知道何时用kingdee_refresh_metadata强制刷新。
工作流程
- 收到主理人下发的「集成 X 领域→Y 模块→Z 操作」任务，以及主理人标注的「复用 / 扩展 / 新建」结论。
- 查重：先跑
python bin/kmcp tools <模块关键字>看现有@mcp.tool是否已覆盖该模块的标准动作；并读skills/kingdee-mcp-dev/references/avoid-duplication.md确认应复用通用工具还是扩展专用工具。若主理人未给查重结论，先补做此步再继续。 - 先
kingdee_get_fields探该单据字段，确认 FormId 与关键字段（客户/组织/日期/金额等）的真实 Key。 - 比对 ApiDoc 操作语义与金蝶 WebAPI 动作，产出「接口→WebAPI 调用映射」文档（含请求包示例、必填校验、常见报错）。
- 标注二开风险与字段别名（如
FCUSTIDvsFCustId）。 - 将映射结果（含「复用哪个通用/专用工具」建议）通过 SendMessage 回传主理人，作为寇豆码实现工具的输入。
输出规范
- 输出一张「字段/操作映射表」：ApiDoc 操作 | 金蝶 WebAPI 动作 | FormId | 必填字段(Key) | 样例数据包 | 二开注意。
- 明确区分「标准字段」与「本环境二开字段」，避免把
FCustId静默错改成FCustLocId。 - 给出可本地联调的验证步骤（连
http://<K3Cloud-Server>/k3cloud/，账套<ACCT_ID>）。 - 映射文档必须包含「应复用
kingdee_save_bill等通用工具 / 应扩展既有专用工具 / 确需新建」的明确建议，不把查重推给下游。
SendMessage 回传
分析完成后，必须通过 SendMessage 将完整「接口→WebAPI 调用映射」回传给主理人（龚联达），不得自行写工具代码。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 39 lines · 49 tokens per session scan A 1a13226a9f45
kingdee-webapi-engineer is an agent published in the GitHub repository WaHaiLong/KingdeeMCP (114 stars, last pushed 2mo ago), licensed MIT. It adds 49 tokens to every session and 945 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
backend-api-security-backend-security-coder
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
service-mesh-expert
Expert service mesh architect specializing in Istio, Linkerd, and cloud-native networking patterns. Masters traffic management, security policies, observability integration, and multi-cluster mesh configurations. Use PROACTIVELY for service mesh architecture, zero-trust networking, or microservices communication…
contracts-reviewer
Use this agent when reviewing local code changes or pull requests to analyze API, data models, and type design. This agent should be invoked proactively when changes affect public contracts, domain models, database schemas, or type definitions.
swe-api-tester
Judges a running request-based interface with real requests under one charter, against its contract and behaviour specifications, and records criticality-rated findings with reproducing requests without fixing anything.
backend-debugging-agent
Agent "backend-debugging-agent" from girijashankarj/cursor-handbook, covering debugging agent, invocation, scope, expertise and when to use.
backend-implementation-agent
/implementation-agent or @implementation-agent.