Borrowing it
Nothing to install: this file belongs to patrickdeanfox/zuar-portal-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/patrickdeanfox/zuar-portal-mcp/main/.claude/commands/portal-build.mdgit clone --depth 1 https://github.com/patrickdeanfox/zuar-portal-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-build)<a href="https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-build"><img src="https://agentmods.dev/badge/commands/patrickdeanfox/zuar-portal-mcp/portal-build/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-build"><img src="https://agentmods.dev/badge/commands/patrickdeanfox/zuar-portal-mcp/portal-build.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00012 | $0.00973 |
| Opus 5 | $0.00006 | $0.00487 |
| Sonnet 5 | $0.00002 | $0.00195 |
| Haiku 4.5 | $0.00001 | $0.00097 |
Grade A, and why
portal-build scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- portal-build — 100% identical, 0 lines differ
What it actually says
Build one portal block end-to-end. Spec: $ARGUMENTS
Pre-flight. Confirm a portal is connected: call check_connection — one call answers all of it (portal, url, version, signed_in_as, writes, browser_assist). If it reports connected:false, relay its reason + fix and stop — for an unconfigured folder, tell the user to run /portal-setup first. Note browser_assist — when it's on (and the block lands on a page), the pipeline can visually verify the block (see step 6).
One-shot option. If the user just wants it done hands-off, offer the automated Workflow .claude/workflows/portal-block-pipeline.js — it fans the spec through the same gated pipeline below (looping while the adversary finds blocking issues) without step-by-step narration. Pass the page_id (so the block is placed and the Visual gate has a URL), and — when browser_assist is on — portal_url (the url from the same check_connection call) so the Visual gate can resolve the page without a round-trip. Pass a tier in the workflow args to dial cost vs. quality, inferred from how the user framed the ask:
tier:'fast'— a quick / rough / throwaway block ("just sketch", "rough draft", "while iterating"). Cheapest: sonnet/haiku at low effort.tier:'standard'(default) — a normal build. Balanced: sonnet builders, opus judgment gates.tier:'max'— a production / executive / "make it great" build. Opus builders + deepest-effort gates.
When in doubt use standard; only go max if the user signals it matters. (Running the pipeline manually below uses each agent's own default model — the standard blend.) Otherwise run the pipeline manually:
The pipeline (each stage via the Task tool; pass each stage's output — the block_id and its notes — to the next; blocks are never shipped raw):
- portal-block-builder — discovers data, verifies real columns, authors the two-field block, binds via
ui_queries, validates, creates. Returns theblock_id. - portal-block-stylist — applies
assets/design.md(hierarchy, color, type, spacing, elevation). CSS + structure only; never touches JS logic or the binding. - portal-responsive-specialist — breakpoints, fluid grids, touch targets, no overflow.
- portal-block-debugger — fixes runtime footguns (the
$trap, AMD/window.definerace,queryResultsshape, dropped:roottokens, missing loaded-callback, re-render leaks). - portal-block-adversary — read-only gate; red-teams the block for silent-data traps and edge cases. If it returns blocking findings, loop back to the debugger with those findings, then re-run the adversary. Cap at ~2 rounds; if still blocked, surface the remaining findings to the user.
- Visual gate (best-effort) — when
config.browser.claudeInChromeis on, the block is placed on a page, and the Claude for Chrome tools are connected: have the portal-block-adversary (it has browser eyes) open the live page, screenshot the block, and read the console — confirm it RENDERS with LIVE data (not the sample fallback), a clean console, and no overflow. A blocking visual failure loops back to the portal-block-debugger (cap ~2 rounds). If the extension isn't present or the block isn't on a page, skip with a note — never block on it. Seezportal://guide/visual-verification. - portal-block-advisor — read-only; does it serve the business question, the user, and the data?
Footgun to enforce across stages: any agent doing an update_block on an already-bound block MUST re-send the existing ui_queries, or the binding is wiped and the block goes blank.
Finish. Report: the block_id and name, what was built (datasource/query + columns bound), and the advisor's recommendations / any open questions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 32 lines · 12 tokens per session scan A c005c83ee1f0
portal-build is a command published in the GitHub repository patrickdeanfox/zuar-portal-mcp (1 stars, last pushed 1mo ago), licensed MIT. It adds 12 tokens to every session and 973 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
ui-flow-review
Review menus, HUD, navigation, and player flow from a UX perspective.
responsive-design-specialist
Use when a layout breaks between sizes. Arbitrary breakpoints, type that does not scale, images that blow out the grid, or a desktop design retrofitted onto mobile.
design-form
Design a form with the fewest fields that works, clear labels, and errors that help.
frontend-3d
You are an expert in 3D web development using Three.js, React Three Fiber, WebGL, and WebGPU. You create immersive 3D experiences for the web.
frontend-design
Read and follow the instructions in agents/frontend-design/design-all.md. Also read all referenced files in agents/frontend-design/reference/ as needed for the task.
get-component-source
The full TSX source of a component (append " demo" for its usage example).