Borrowing it
Nothing to install: this file belongs to SylphxAI/pdf-reader-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SylphxAI/pdf-reader-mcp/main/.opencode/command/saas-auth.mdgit clone --depth 1 https://github.com/SylphxAI/pdf-reader-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sylphxai/pdf-reader-mcp/saas-auth)<a href="https://agentmods.dev/commands/sylphxai/pdf-reader-mcp/saas-auth"><img src="https://agentmods.dev/badge/commands/sylphxai/pdf-reader-mcp/saas-auth.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00622 |
| Opus 5 | $0.00010 | $0.00311 |
| Sonnet 5 | $0.00004 | $0.00124 |
| Haiku 4.5 | $0.00002 | $0.00062 |
Grade A, and why
saas-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Identity & Account Security Review
Scope
Review identity systems: authentication methods, SSO providers, passkeys/WebAuthn, verification flows, session management, and account security surfaces.
Specification
Identity Providers (SSO)
- SSO providers (minimum): Google, Apple, Facebook, Microsoft, GitHub (prioritize by audience).
- If provider env/secrets are missing, hide the login option (no broken/disabled UI).
- Allow linking multiple providers and safe unlinking; server-enforced and abuse-protected.
Passkeys (WebAuthn)
- Passkeys are first-class with secure enrollment/usage/recovery.
- Must support cross-device authentication where platform allows.
Verification
- Email verification is mandatory baseline for high-impact capabilities.
- Phone verification is optional and used as risk-based step-up (anti-abuse, higher-trust flows, recovery); consent-aware and data-minimizing.
Membership and Entitlements
- Membership is entitlement-driven and server-enforced.
- All authorization/entitlements are server-enforced; no client-trust.
Account Security Surface
- Provide a dedicated Account Security surface.
- Minimum acceptance criteria:
- Session/device visibility and revocation
- MFA/passkey management
- Linked identity provider management
- Key security event visibility (and export where applicable)
- All server-enforced and auditable.
Session Management
- Session/device visibility + revocation available to user.
- Security event visibility with clear audit trail.
- Recovery governance (including support-assisted recovery) with strict audit logging.
- Step-up authentication for sensitive actions.
Password Security
- Password UX: masked + temporary reveal option.
- No plaintext passwords in logs/returns/storage/telemetry.
- MFA required for Admin/SUPER_ADMIN; step-up for high-risk actions.
Domain Discovery
After reviewing compliance with spec, explore improvements:
- Onboarding friction: Is sign-up flow optimized? Too many steps? Missing social providers for target market?
- Security vs UX balance: Are step-up challenges appropriate? Too frequent? Too rare?
- Recovery flows: Is account recovery secure yet accessible? Support burden from lockouts?
- Modern auth: Are passkeys properly promoted? Is passwordless an option?
- Trust signals: Are verified badges shown? Does verification unlock features appropriately?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 79 lines · 20 tokens per session scan A 2589040e1f4a
saas-auth is a command published in the GitHub repository SylphxAI/pdf-reader-mcp (917 stars, last pushed today), licensed MIT. It adds 20 tokens to every session and 622 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other commands, from other repositories
bib-filter
Filter a LaTeX project's bibliography to the entries actually cited, with Overleaf-source resolution, temporary staging, validation, approval-gated canonical replacement, and compilation. Use before submission or after large revisions.
bib-parse
Extract citations from a PDF and generate a validated .bib file. Use when the user asks to extract citations from a PDF and generate a validated .bib file. Reads the PDF, identifies referenced works, constructs BibTeX entries, and verifies metadata.
brief-compliance-check
Check a LaTeX coursework submission against the requirements in a supplied PDF assessment brief. Use when verifying format, required sections, word limits, or deliverables before submission. Not for general prose proofreading; use $proofread.
insights-deck
Archive an exported Claude Code insights HTML report and turn it into a timestamped Beamer presentation usable from either client. Use when the insights export is the source artifact for a presentation. Not for a general research talk; use $talk-deck.
latex-health-check
Compile all LaTeX projects and report cross-project build consistency. Use when checking whether a collection of papers builds cleanly. Not for rendered visual inspection after a clean build; use $latex-polish.
latex-polish
Inspect a cleanly compiling LaTeX document for source pathologies and rendered visual defects by linting and viewing selected PDF pages. Use when compilation succeeds but title pages, floats, tables, figures, or layout still need publication-quality review. Not for basic compilation health; use $latex-health-check.