Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Hainrixz/agente-pagokitnpx agentmods add commands/hainrixz/agente-pagokit/testWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hainrixz/agente-pagokit/test)<a href="https://agentmods.dev/commands/hainrixz/agente-pagokit/test"><img src="https://agentmods.dev/badge/commands/hainrixz/agente-pagokit/test.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.00960 |
| Opus 5 | $0.00019 | $0.00480 |
| Sonnet 5 | $0.00008 | $0.00192 |
| Haiku 4.5 | $0.00004 | $0.00096 |
Grade A, and why
test scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
--url "http://localhost:<port><webhook_path>" --curl How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/pagokit:test
Prove the webhook handler actually works: that it accepts a genuine event, and — more
importantly — that it rejects a forged one and a replayed one. A handler that accepts
everything looks identical to a correct one until someone forges a payment.succeeded.
Phase A — Identify the integration
- Read
PAGOKIT_INTEGRATION.mdfor the provider id, the webhook path and the stack. If it is missing, ask which provider, then confirm the route by globbing for the provider'sexpected_filenames. - Work out the dev port from
package.jsonscripts (Next and Express default to 3000, FastAPI to 8000). Ask only if you cannot tell. - Read the provider entry to learn its
notification_model. If it is notwebhook, stop and say so — areturn_url_commitprovider never calls a webhook, and testing one proves nothing. For those, verify the commit call instead.
Phase B — Generate the events
PagoKit derives the signature from the same catalog data the verifier was generated from, so a passing test means the two agree. This works for every provider whose verification family is locally signable:
node scripts/sign-event.js --provider <id> --secret "$WEBHOOK_SECRET" \
--url "http://localhost:<port><webhook_path>" --curl
Read the real signing secret from the project's .env / .env.local — never echo it into
the transcript, and never pass a value the user has not set.
Run three cases, in this order:
| Case | Command | Expected |
|---|---|---|
| Valid | --mode valid |
2xx |
| Forged signature | --mode forged |
400 |
| Replayed timestamp | --mode replay |
400 |
--mode forged flips one character of an otherwise well-formed signature, so only the
cryptographic check can catch it — which is exactly what is being tested. --mode replay
backdates the timestamp past the provider's tolerance window.
If a provider has no signed timestamp, --mode replay is not meaningful. Test event-id
deduplication instead: send the same valid event twice and confirm the second one is a
no-op that still returns 200.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -14 lines · +11 tokens per session b649cde3acf0
- 8d ago First seen · 105 lines · 28 tokens per session scan A 3a56d0add8f5
test is a command published in the GitHub repository Hainrixz/agente-pagokit (39 stars, last pushed 8d ago), licensed MIT. It adds 39 tokens to every session and 960 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
cloudflare-durable-objects:setup
Interactive Durable Objects project initialization. Scaffolds new DO project with proper bindings, migrations, and boilerplate code.
cloudflare-workers:test-setup
Interactive Vitest setup wizard for Cloudflare Workers testing. Configures @cloudflare/vitest-pool-workers, mocks bindings, and creates example tests.
spec-check
Audit GWT acceptance test specs for implementation leakage. Optionally provide a specific file path.
record
Record a browser walkthrough of a URL using Antigravity (agy). Generates .webm video, screenshots, and a report. Auto-converts to MP4 if ffmpeg is available.
stark-quality-gate
Use this command when a web UI should be maintained, released, compared across runs, or used as public proof. It turns visual QA into a repeatable local/CI gate instead of a one-off screenshot check.
stark-qa
Use this command to require proof before calling a UI "good.".