Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Matt-Dionis/claude-code-configsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/matt-dionis/claude-code-configs/test-auth)<a href="https://agentmods.dev/commands/matt-dionis/claude-code-configs/test-auth"><img src="https://agentmods.dev/badge/commands/matt-dionis/claude-code-configs/test-auth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/matt-dionis/claude-code-configs/test-auth"><img src="https://agentmods.dev/badge/commands/matt-dionis/claude-code-configs/test-auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00008 | $0.00441 |
| Opus 5.5 | $0.00003 | $0.00176 |
| Sonnet 5.5 | $0.00002 | $0.00088 |
| Haiku 4.5 | $0.00001 | $0.00044 |
Grade B, and why
test-auth scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
- Check RPC connection: !`curl -s -X POST $EVMAUTH_RPC_URL -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' | jq -r '.result'` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Check RPC connection: !`curl -s -X POST $EVMAUTH_RPC_URL -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' | jq -r '.result'` What it actually says
Test Authentication Flow
Test the complete token-gated authentication flow for the specified tool.
Tool: $ARGUMENTS
Testing Steps
-
Check Current Configuration
- Verify environment variables: !
echo "Contract: $EVMAUTH_CONTRACT_ADDRESS, Chain: $EVMAUTH_CHAIN_ID" - Check RPC connection: !
curl -s -X POST $EVMAUTH_RPC_URL -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' | jq -r '.result'
- Verify environment variables: !
-
Start MCP Server
- Run the server if not already running
- Note the port and endpoint
-
Simulate Tool Call Without Auth
- Call the protected tool without __evmauth
- Verify EVMAUTH_PROOF_MISSING error
- Check error includes requiredTokens
-
Simulate Authentication
- Mock authenticate_and_purchase response
- Generate sample proof structure
- Verify proof format is correct
-
Test With Valid Proof
- Call tool with __evmauth parameter
- Verify successful execution or PAYMENT_REQUIRED
-
Test Error Scenarios
- Expired proof (> 30 seconds old)
- Wrong chain ID
- Invalid signature format
- Missing required fields
Create Test Script
Generate a test script that validates:
- Token protection is properly configured
- Error messages are AI-friendly
- Authentication flow works end-to-end
- Caching behaves correctly
Expected Results
✅ Success Criteria:
- Tool rejects calls without auth
- Error messages guide to authenticate_and_purchase
- Valid proofs are accepted
- Token ownership is properly verified
❌ Common Failures:
- Chain ID mismatch
- Contract address not configured
- RPC connection issues
- Debug mode enabled in production
Generate comprehensive test results and recommendations.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 69 lines · 8 tokens per session scan B 99cf09b42a4b
test-auth is a command published in the GitHub repository Matt-Dionis/claude-code-configs (619 stars, last pushed 1y ago), licensed MIT. It adds 8 tokens to every session and 441 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
verify-e2e-flow
Verify that the E2E scripts for the specified chain follow the documented transaction flow.
fix-bch-e2e-p1
Fix errors in BCH E2E test (Pattern 1: P2PKH Single-sig).
fix-btc-e2e-p1
Fix errors in BTC E2E test (Pattern 1: P2PKH Single-sig).
fix-btc-e2e-p11
Fix errors in BTC E2E test (Pattern 11: P2TR Tapscript M-of-N).
fix-btc-e2e-p2
Fix errors in BTC E2E test (Pattern 2: P2PKH 2-of-3 Multisig).
fix-bch-e2e-p2
Fix errors in BCH E2E test (Pattern 2: P2SH 2-of-3 Multisig).