Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/starter-series/create-starter/graduategit clone --depth 1 https://github.com/starter-series/create-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/starter-series/create-starter/graduate)<a href="https://agentmods.dev/commands/starter-series/create-starter/graduate"><img src="https://agentmods.dev/badge/commands/starter-series/create-starter/graduate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.00646 |
| Opus 5 | $0.00023 | $0.00323 |
| Sonnet 5 | $0.00009 | $0.00129 |
| Haiku 4.5 | $0.00005 | $0.00065 |
Grade A, and why
graduate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are walking the user through the vibe-coding-to-production graduation path documented in docs/graduation-from-vibe-coding.md. The path is workflow-only — there is no graduate MCP tool; instead, this command orchestrates audit_release, audit_cd, and audit_security, then guides the lift-in and verify steps.
Steps
-
Diagnose — Call all three MCP tools, in this order:
- Call the
audit_releaseMCP tool withpathset to the absolute path of the export repo. - Call the
audit_cdMCP tool with the samepath. - Call the
audit_securityMCP tool with the samepath.
Surface gaps from each report. The matched starter id from
audit_releasedetermines the target in step 2. - Call the
-
Pick a target — Map the matched starter (or app shape if
audit_releasereturnedid: null) to a Starter Series template:- Next.js / Vite / React →
docker-deploy(own VPS) orcloudflare-pages(static) - Browser extension →
browser-extensionstarter - Discord/Telegram bot → matching bot starter
- Cross-platform desktop →
electron-app - Mobile →
react-native - Reusable library →
npm-packageorpython-mcp-server
- Next.js / Vite / React →
-
Lift CI/CD — Copy
.github/workflows/+ Dockerfile (if applicable) +.gitleaks.tomlfrom the matching starter. Replace placeholder owner/repo references with the user's current remote. -
Wire secrets — Run the per-target secret list from the guide. Prefer OIDC trusted publishing (npm, PyPI) where supported — zero long-lived tokens.
-
Seed security guidance — Call the
seed_security_guidanceMCP tool with the samepathto generate a starterclaude-security-guidance.mdtailored to the matched starter type. -
Verify — Re-call
audit_release,audit_cd,audit_securityon the now-graduated repo. Suggest the tag/push that triggers publish (do not push the tag yourself — npm publish is hard to undo).
Positioning (2026-05 framing)
This is about vendor diversity, not "escaping" any platform. Vercel/Cloudflare/etc. have all evolved into "Agentic Infrastructure" providers — graduation gives the user a choice of multiple deploy targets, not a flight from one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 41 lines · 47 tokens per session scan A 53f0b0699bcc
graduate is a command published in the GitHub repository starter-series/create-starter (2 stars, last pushed 2d ago), licensed MIT. It adds 47 tokens to every session and 646 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
cicd-integration
Generate a CI/CD pipeline for design system quality checks.
setup
Bootstrap a repository with AI-native CI/CD, hooks, and templates in one command.
bootstrap
Scaffold test, lint, and CI infrastructure for projects that lack it.
redteam
Red Team Operations — 인프라 설정 보안 리뷰 + MITRE ATT&CK + Detection Engineering.
local-ci-dev
Run local CI to verify changes before completing work.
devops
DevOps and infrastructure with Masao (CI/CD, Docker, cloud).