Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/themoah/klag/connectgit clone --depth 1 https://github.com/themoah/klagWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.01232 |
| Opus 5 | $0.00010 | $0.00616 |
| Sonnet 5 | $0.00004 | $0.00246 |
| Haiku 4.5 | $0.00002 | $0.00123 |
Grade C, and why
connect scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Codex — `~/.codex/config.toml`: `[mcp_servers.klag]` with `url` and Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- Cursor — `~/.cursor/mcp.json`: `{"mcpServers":{"klag":{"url":"<url>/mcp","headers":{"Authorization":"Bearer <token>"}}}}` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w '%{http_code}\n' "$KLAG_URL/readyz" How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wire the user's running Klag into their AI client over MCP. URL hint: $ARGUMENTS.
Klag's MCP is read-only and served from an in-memory snapshot — it never queries Kafka on
demand. Tools: list_consumer_groups, get_consumer_group_lag, find_lagging_groups,
diagnose.
1. Find the endpoint
If $ARGUMENTS has a URL, use it. Otherwise look for a running Klag. Export the result as
KLAG_URL (and NS for the namespace) so the commands below stay quoted and copy-pasteable:
docker ps --filter ancestor=themoah/klag --format '{{.Names}} {{.Ports}}'
kubectl get deploy -A -l app.kubernetes.io/name=klag 2>/dev/null
For a cluster install, start a port-forward (confirm first) and use http://localhost:18888:
kubectl -n "$NS" port-forward svc/klag 18888:8888
A port-forward dies with the shell — tell the user the registration points at a tunnel they must keep open, and that a real setup should expose Klag through a Service/Ingress and register that URL instead.
2. Check the prerequisites
curl -s -o /dev/null -w '%{http_code}\n' "$KLAG_URL/readyz"
# Drop the Authorization line when MCP_AUTH_TOKEN is unset — do not send the literal placeholder.
curl -s -X POST "$KLAG_URL/mcp" -H 'Content-Type: application/json' \
-H "Authorization: Bearer $KLAG_MCP_TOKEN" \
--data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
404on/mcp→MCP_ENABLEDis nottrue. Offer to enable it (mcp.enabled=truein the chart,-e MCP_ENABLED=truefor docker) and redeploy.401→MCP_AUTH_TOKENis set; get the token from the user or read it from the Secret with their confirmation. Never print it back.405→ that was a GET; MCP here is POST only.- Empty snapshot → the collector has nothing to publish. Check in this order:
METRICS_REPORTERis set (defaultnonemeans no collection at all),/metricsactually hasklag_consumer_lagseries,METRICS_GROUP_FILTER/METRICS_GROUP_EXCLUDEdo not exclude every group, and the cluster really does have groups with committed offsets. Only the first needs a redeploy.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 90 lines · 20 tokens per session scan C 121df058e6e1
connect is a command published in the GitHub repository themoah/klag (81 stars, last pushed 2d ago), licensed Apache-2.0. It adds 20 tokens to every session and 1,232 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (reads agent configuration directories, reads mcp configuration, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
code-review-swarm
Deploy specialized AI agents to perform comprehensive, intelligent code reviews that go beyond traditional static analysis.
auto-agent
Automatically spawn and manage agents based on task requirements.
github-swarm
Create a specialized swarm for GitHub repository management.
post-task
Execute post-task cleanup, performance analysis, and memory storage.
pre-edit
Execute pre-edit validations and agent assignment before file modifications.
session-end
Cleanup and persist session state before ending work.