Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/vanamthrishul/ovb3-bridge/linkgit clone --depth 1 https://github.com/vanamthrishul/ovb3-bridgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00713 |
| Opus 5 | $0.00008 | $0.00357 |
| Sonnet 5 | $0.00003 | $0.00143 |
| Haiku 4.5 | $0.00002 | $0.00071 |
Grade A, and why
link scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Guide the user through linking either a VB Studio (VBS) project or a standalone VBCS instance, so the rest of the toolkit knows what to work against. Ask, don't assume:
-
Ask whether they're linking a VB Studio project (git-backed — pages/flows/chains live as files in a git repo) or a standalone VBCS instance (REST-only, no git remote for the app).
-
If VB Studio:
- Ask whether they already have a local checkout, or need one cloned.
- Already checked out: ask for its absolute path. Read
.env's currentVBS_WORKSPACE_DIR. If the checkout's parent directory matches it, nothing to do — just confirm withlist_repos. Otherwise, useEditto setVBS_WORKSPACE_DIRin.envto the checkout's parent directory (orVBCS_REPO_PATHdirectly to the checkout itself, for a single-repo setup), then confirm withlist_repos. - Needs cloning: ask for the git remote URL and a short destination folder name, then call
git_clone(mcp__vbcs__git_clone) with those. Report the resulting path. - If the repo hosts more than one app (check via
list_appsafter cloning/pointing), ask which one is the default and setVBCS_APP_NAMEin.envviaEdit. - Tell the user their VB Studio git credentials (
VBSTUDIO_GIT_USERNAME/VBSTUDIO_GIT_TOKENin.env) must already be filled in forgit_clone/git_pull/git_pushto work, and that filling those in is on them, never in this conversation.
-
If standalone VBCS:
- Ask for the instance's base URL only (not a secret). Use
Editto setVBCS_BASE_URLin.envto that value. - Explicitly tell the user: their IDCS username and password must be filled into
VBCS_IDCS_USERNAME/VBCS_IDCS_PASSWORDin.envby them, directly — never paste credentials into this conversation. - Explain that a session restart is required afterward (env vars load once at server startup), and that once restarted,
/vbcs-list-apps(orvbcs_list_applications) can be used to verify the connection. - Do not attempt to call
vbcs_list_applicationsyet if the credentials were just requested — it will fail until the user has filled them in and restarted.
- Ask for the instance's base URL only (not a secret). Use
-
Only ever use
Editto write non-secret fields (VBS_WORKSPACE_DIR,VBCS_REPO_PATH,VBCS_APP_NAME,VBCS_BASE_URL). Never write, ask for, or echo back any credential/secret field — those are always the user's to fill in directly in.env. -
Finish with a short summary of what's now configured and what (if anything) the user still needs to fill in themselves before it's fully working.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 25 lines · 16 tokens per session scan A 8ee4c2d31384
link is a command published in the GitHub repository vanamthrishul/ovb3-bridge (0 stars, last pushed 20d ago), licensed MIT. It adds 16 tokens to every session and 713 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
speckit.tasks
Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.
dev
Runs Vendure in development mode. By default it starts three processes: the GraphQL server (ts-node ./src/index.ts), the worker (ts-node ./src/index-worker.ts), and the dashboard (a Vite dev server).
start
Runs a project that has already been compiled with vendure build.
pipeline-undo
Undo a pipeline run's result. With worktree isolation (the current engine), this is clean and low-risk: a run never touches your checkout — its result lives only on a pipeline/ branch (and, for a --push run, on the remote). "Undo" therefore means deleting that branch and its worktree, not reverting your working tree.
rank-vertical
E-Commerce and Local Business SEO checks with auto-detection.
create_worktree
description: Create worktree and launch implementation session for a plan.