Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/taewooopark/uiforge/clonegit clone --depth 1 https://github.com/TaewoooPark/UIForgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.02007 |
| Opus 5 | $0.00039 | $0.01004 |
| Sonnet 5 | $0.00016 | $0.00401 |
| Haiku 4.5 | $0.00008 | $0.00201 |
Grade A, and why
clone scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Clone the reference in $ARGUMENTS. Pick the mode from the flags and the user's words:
--archive, or the user asks for a copy that works / behaves / is interactive (tabs, filters, lists, click-to-swap, "동작까지", "실제로 작동") → Archive (§A, the flagship).--restore/--react, or the user wants editable / componentized source / their content → Restore (§B) — pixel-identical editable source from the archive.- otherwise, or
--freeze→ Freeze (§C).
Archive first (§A) whenever a Restore is wanted — the Restore builds from the archive's captured DOM/CSS, not a fresh scrape. (One caveat: Tier B back-fills assets the archive never fetched from the live origin by default — pass --no-fetch to stay fully offline.)
Before any node command below, run this once so $ROOT resolves and Playwright is findable — the snippets use $ROOT, and an unset one would run node /tools/…:
export ROOT="${CLAUDE_PLUGIN_ROOT}"
export NODE_PATH="$(npm root -g)"
Work in a fresh output dir. --headed/--profile <dir> pass through to reach a site behind Cloudflare or a login (a persistent --profile reuses the clearance/session). file:// inputs work too.
§A · Archive — the complete BEHAVIOR clone ⭐ (the flagship)
This is the only mode that reproduces behavior, because it keeps the site's own code and replays the data it actually fetched. Click a tab and content swaps; filter a list and it updates; scroll and it lazy-loads — the real JavaScript runs against cached responses. Use this whenever the user wants the clone to work, not just look right.
node $ROOT/tools/uiforge-archive.mjs <ref> --out-dir ./clone-archive --explore
- Always pass
--exploreunless told not to — it clicks in-page controls (tabs,[aria-controls], "load/show/more/next", pagination) and scrolls during capture, so the data those interactions fetch gets recorded. Without it, only what loaded on first paint is cached. - It writes a folder + a zero-dependency replay server. Start it and open the printed URL:
node ./clone-archive/serve.mjs # → http://localhost:8787
- It's a browsable, editable mirror, not a blob dump. Every response lands under
files/at a real path mirroring its URL, with a real extension (.html/.js/.css/.json/fonts/images) — open it, read it, and edit any text response; the server reads files fresh per request, so changes show up on reload.index.jsonmaps each request → its file. (To develop a clean copy — React with your content — use Restore--restore/--react(§B); the Archive is for behavior, the Restore for editing.) - Verify it behaves (don't just claim it): open the replayed URL, confirm the framework boots with no page errors, then exercise one real interaction (click a tab / nav item / "load more") and confirm the content changes without a full reload. Report what worked.
- Honest limit to state: a server-dependent action (search hitting an API, a fetch triggered by input you didn't type) only replays if its response was recorded — widen coverage by interacting more under
--explore. A request never made during capture has nothing to replay.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 88 lines · 79 tokens per session scan A 4d5dc25c8c25
clone is a command published in the GitHub repository TaewoooPark/UIForge (7 stars, last pushed 1mo ago), licensed MIT. It adds 79 tokens to every session and 2,007 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
openhop-flow
Render an animated OpenHop flow diagram for the prompt that follows. Sketches the YAML, pushes it to the local OpenHop server, and returns the per-flow render URL.
openhop-list
List every OpenHop flow currently stored on the local OpenHop server, with id, title, and per-flow URL.
providers
Display Better Auth available authentication providers and their configuration.
thread
Manage conversation threads (create, switch, update, delete, show).
verify
Verify any change surface against approved acceptance criteria and preserve evidence.
skill-inbox
Unified entry point for managing skill suggestions and browsing all installed skills. Provides two views: suggestions (default) and all skills.