expression

expression is a command for coding agents from ch-bas/kibana-plugin-helper. It costs 20 tokens per session (1,052 once invoked), scanned A, original, MIT.

A generator for custom Kibana Expression Functions and Renderers, which transform data in visualizations or display it as charts, tables, or other interface elements.

In plain words
What is it for?
Use it to process numbers, tables, text, or Kibana context in Canvas, Lens, and dashboards, then optionally render the result in the browser or query Elasticsearch on the server.
Why use it?
It avoids manually wiring custom calculations and visual output into Kibana's expression pipeline, the system that passes results between visualization steps.

Command

Part of the kibana-plugin-helper plugin — 1 skill, 8 commands, 5 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/ch-bas/kibana-plugin-helper/expression
Clone the repo
git clone --depth 1 https://github.com/ch-bas/kibana-plugin-helper

Or install kibana-plugin-helper, the plugin that ships this one along with the rest of its 1 skill, 8 commands, 5 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for expression

README.md
[![agentmods](https://agentmods.dev/badge/commands/ch-bas/kibana-plugin-helper/expression.svg)](https://agentmods.dev/commands/ch-bas/kibana-plugin-helper/expression)
Your own site
<a href="https://agentmods.dev/commands/ch-bas/kibana-plugin-helper/expression"><img src="https://agentmods.dev/badge/commands/ch-bas/kibana-plugin-helper/expression.svg" alt="Measured on agentmods" height="20"></a>
Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,052 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00020 $0.01052
Opus 5 $0.00010 $0.00526
Sonnet 5 $0.00004 $0.00210
Haiku 4.5 $0.00002 $0.00105

Measured 3d ago against content hash 17d7fb94b7de, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

expression scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/expression.md · 97 lines

How it starts

The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Generate Kibana Expression

Create custom Expression Functions and/or Renderers that integrate with Kibana's expression pipeline (Canvas, Lens, Dashboard). Ask the user for:

  1. Function or Renderer? Are they creating an expression function, a renderer, or both?
  2. Function name (snake_case, e.g. my_metric_calc)
  3. What it does (description of the transformation or computation)
  4. Input type — what data does it receive from the previous function in the pipeline? (datatable, number, string, null, kibana_context)
  5. Arguments — named parameters with types and defaults
  6. Output type — what data does it produce? (datatable, number, string, render, custom type)
  7. For renderers: What does it visually display? (chart, metric, table, custom visualization)
  8. Server or browser? Does the function need server-side access (ES queries) or is it browser-only?

Generation Steps

  1. Create the expression files:

    common/expressions/          # Functions that work on both server and browser
    ├── index.ts
    ├── my_function.ts           # Expression function definition
    └── types.ts                 # Custom expression types
    public/expression_renderers/ # Renderers (browser-only)
    ├── index.ts
    └── my_renderer.tsx          # Expression renderer
    
  2. For an Expression Function:

    • Define the function using ExpressionFunctionDefinition
    • Specify name, help, args, inputTypes, type (output)
    • Implement fn(input, args, context) — the transformation logic
    • Register in setup() via expressions.registerFunction(myFunction)
  3. For an Expression Renderer:

    • Define the renderer using ExpressionRenderDefinition
    • Specify name, displayName, help, reuseDomNode
    • Implement render(domNode, config, handlers) — mounts the visualization
    • Call handlers.done() when rendering is complete
    • Register in setup() via expressions.registerRenderer(myRenderer)

Read the full file on GitHub · 97 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 97 lines · 20 tokens per session scan A 17d7fb94b7de

Subscribe to this mod's changes

expression is a command published in the GitHub repository ch-bas/kibana-plugin-helper (3 stars, last pushed 6mo ago), licensed MIT. It adds 20 tokens to every session and 1,052 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.