gateway

A help command for the Sorify plugin, which creates and runs browser-based Playwright tests through Sorify's tool connection. It explains available tools and can retrieve current read-only information such as test suites and run results.

In plain words
What is it for?
Use it to get an overview, look up a specific tool, list or inspect test suites, view runs and statuses, and retrieve result screenshots.
Why use it?
It gives developers one place to learn the plugin and inspect live testing data instead of relying on static descriptions.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/rakutentech/sorify/gateway
Clone the repo
git clone --depth 1 https://github.com/rakutentech/sorify
Per session 117 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,875 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00117 $0.04875
Opus 5 $0.00059 $0.02438
Sonnet 5 $0.00023 $0.00975
Haiku 4.5 $0.00012 $0.00487

Measured 2d ago against content hash c3cd51c1044c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

gateway scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/sorify/commands/gateway.md · 264 lines

How it starts

The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.

sorify:gateway

Trigger

Invoked as /sorify:gateway {question}. The question may be empty (show full overview), about how the plugin works, about a specific MCP tool, or a request for live data from Sorify.


Step 1: Classify the input

empty / "help" / "overview" / "how does this work"
  → Full Overview (Step 2)

mentions a specific tool name, or "what tools", "what can I do with X"
  → Tool Reference (Step 3), scoped to the matching section if one is named

asks for live data: "list suites", "show suite {id}", "what tests are in
suite {id}", "list runs", "status of run {id}", "screenshots for result {id}"
  → Live Lookup (Step 4)

If the request is ambiguous, do the closest of these three rather than asking a clarifying question — this is a read-only help command, so a wrong guess costs nothing.


Step 2: Full Overview

Output this, filling in SORIFY_BASE_URL from ~/.sorify if present:

=== Sorify Plugin ===

Sorify is a Claude Code plugin that generates Playwright E2E tests from a
URL (optionally cross-referenced with source code), uploads them to a
Sorify TestSuite, runs them, and reports pass/fail.

It talks to the Sorify web app over MCP — every action available on the
Sorify dashboard (suites, tests, runs, screenshots) is also callable
as an MCP tool by Claude directly, without the dashboard UI.

Commands
──────────────────────────────────────────────
/sorify:generate {url} [source]      Generate + upload + run tests for a URL
/sorify:gateway [question]           This command — docs + live MCP lookups

Setup (~/.sorify)
──────────────────────────────────────────────
SORIFY_URL=https://your-sorify-host/sorify
[email protected]
SORIFY_PASSWORD=your-password

SORIFY_URL must be a real shell env var (source ~/.sorify with `set -a` in
your shell profile) so the MCP client can build the server URL from it.
USERNAME/PASSWORD are read directly by a helper script to build the
request's Basic-Auth header — they don't need to be exported.

These three values are MCP-connection credentials only — they authenticate the
plugin's MCP client to the Sorify server. They are PRIVATE and must never be
copied into, echoed as, or used as a suite variable `value` (suite variables are
for target-webpage test accounts — see "Suite variables" below).

MCP Server
──────────────────────────────────────────────
Name:    Sorify (registered in this plugin's .mcp.json as "sorify")
Purpose: Manage Sorify test suites, tests, runs, and screenshots
Tools:   34 total across 4 resource groups — run `/sorify:gateway tools` for
         the full reference, or `/sorify:gateway {topic}` for one group
         (suites / tests / runs / screenshots)

Dashboard: {SORIFY_BASE_URL}

Read the full file on GitHub · 264 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 264 lines · 117 tokens per session scan A c3cd51c1044c

Subscribe to this mod's changes

gateway is a command published in the GitHub repository rakutentech/sorify (5 stars, last pushed 4d ago), licensed Apache-2.0. It adds 117 tokens to every session and 4,875 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.