Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sigistry/marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sigistry/marketplace/mcp-migrate)<a href="https://agentmods.dev/commands/sigistry/marketplace/mcp-migrate"><img src="https://agentmods.dev/badge/commands/sigistry/marketplace/mcp-migrate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/sigistry/marketplace/mcp-migrate"><img src="https://agentmods.dev/badge/commands/sigistry/marketplace/mcp-migrate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00851 |
| Opus 5.5 | $0.00010 | $0.00340 |
| Sonnet 5.5 | $0.00005 | $0.00170 |
| Haiku 4.5 | $0.00002 | $0.00085 |
Grade A, and why
mcp-migrate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Migrate the MCP server at $ARGUMENTS (directory or entry file; current repo if omitted) to the MCP 2026-07-28 specification: from the removed HTTP+SSE transport and stateful sessions to the stateless Streamable HTTP core, with lifecycle, capabilities, and authorization brought up to spec. Load the mcp-2026-07-28 skill (transport + lifecycle + versioned extensions) and, for remote servers, mcp-authorization, then dispatch the mcp-migrator agent to apply the edits. Run /mcp-audit first if you have not already, and reuse its findings.
Process
Step 1: Establish the starting point
Detect the SDK/language and the current transport and protocol version (see /mcp-audit Step 1). Classify the server:
- HTTP+SSE (dual-endpoint) → the removed transport; the core migration target.
- Stateful Streamable HTTP (relies on a persisted
Mcp-Session-Id/ in-process session map) → migrate to stateless where the tools allow. - stdio → transport is fine; only lifecycle/version/capability and (n/a) auth items apply.
Step 2: Migrate the transport
Replace the SSE dual-endpoint (GET /sse + POST /messages) with a single Streamable HTTP endpoint. Bump the SDK to a version that speaks 2026-07-28. Preserve every registered tool, resource, and prompt and their handlers, this is a transport swap, not a rewrite. See references/transport-and-lifecycle.md for the before/after per SDK.
Step 3: Make it stateless where possible
Move per-session in-process state to either (a) the request itself (self-contained requests) or (b) an external store keyed by a stable id, so any replica can serve any request. Where a tool genuinely needs continuity (a long-running job), model it with the Tasks versioned extension rather than a sticky session. Call out honestly any state that cannot be made stateless and why.
Step 4: Fix lifecycle, capabilities, and auth
- Update the
initializeresult to report the newprotocolVersionand only the capabilities actually implemented. - For remote servers, align authorization to OAuth 2.1 / OIDC: validate the access token's audience against this server, add the Protected Resource Metadata document, and remove any token passthrough to downstream APIs (
mcp-authorization,references/oauth-oidc-patterns.md).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 39 lines · 24 tokens per session scan A 22692f9fcb2d
mcp-migrate is a command published in the GitHub repository sigistry/marketplace (3 stars, last pushed 4d ago), licensed MIT. It adds 24 tokens to every session and 851 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
dotnet-harden
Scan and harden .NET backend code against high-impact anti-patterns such as sync-over-async, lifetime bugs, fat endpoints, and fragile SignalR state.
dotnet-critique
Deep architecture critique of pure .NET backend code. Evaluates AI slop, OOP/SOLID, layer boundaries, DI lifetimes, endpoints, SignalR, data access, concurrency, and distributed-system choices.
py-critique
Deep architecture critique of Python backend code. Evaluates AI slop, SOLID compliance, layer boundaries, anti-patterns, and design quality.
dotnet-structure
Analyze and recommend .NET backend solution and folder structure improvements. Checks projects, layers, oversized files, and boundary clarity.
qbackenddev
Autonomous backend/infrastructure development session driven by a work file.
f5-design
Generate design documents and specifications (D1-D4).