Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/vast-ai/vast-claude-plugin/launchgit clone --depth 1 https://github.com/vast-ai/vast-claude-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/vast-ai/vast-claude-plugin/launch)<a href="https://agentmods.dev/commands/vast-ai/vast-claude-plugin/launch"><img src="https://agentmods.dev/badge/commands/vast-ai/vast-claude-plugin/launch.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01577 |
| Opus 5 | $0.00013 | $0.00788 |
| Sonnet 5 | $0.00005 | $0.00315 |
| Haiku 4.5 | $0.00003 | $0.00158 |
Grade C, and why
launch scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
vastai create ssh-key "$(cat ~/.ssh/id_ed25519.pub)" --raw How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/vastai:launch
Launch a Vast.ai GPU instance from an offer ID. Defaults to the Vast-curated PyTorch image and the --ssh --direct --cancel-unavail connection mode — what most renters want.
Steps
-
Parse
$ARGUMENTSas:<offer-id> [image] [--disk N] [--label STR] [--bid PRICE]. The offer ID is required; everything else has a default. -
Ensure an SSH key is registered BEFORE launching. Launching without a registered key produces an unreachable instance.
vastai show ssh-keys --rawIf the response is
[], register the user's default key first (public key is POSITIONAL — there is no--ssh-keyflag):vastai create ssh-key "$(cat ~/.ssh/id_ed25519.pub)" --rawFall back to
~/.ssh/id_rsa.pubif no ed25519 key exists; instruct the user to generate one if neither file exists. -
Honor pricing-mode intent from the arguments.
vastai search offersdoes not support filtering byid=, so there is no clean way to "look up the offer" before launching — accept the user's stated intent:- If
$ARGUMENTSincludes--bid PRICE, the user wants interruptible pricing — pass--bid_price PRICEtocreate instance(step 5). - Otherwise, launch on-demand. Every offer can be rented either way; the on-demand price is the offer's
dph_baseand the bid floor is itsmin_bid. The user picks the mode at launch.
- If
-
Build the create command with these defaults:
--image→ user-provided, elsevastai/pytorch:@vastai-automatic-tag(Vast-curated image;@vastai-automatic-tagonly resolves onvastai/*images, NOTpytorch/pytorchor other third-party images)--disk→ user-provided, else20--label→ user-provided, elseclaude-launch-$(date +%s)(so the instance is greppable later)- Always include
--ssh --direct --cancel-unavail --raw.--cancel-unavailfails the launch if the machine becomes unavailable mid-call instead of silently producing a stopped instance that accrues disk charges while you poll forever. - If a bid price was supplied, also add
--bid_price <PRICE>. (No need to pass--type bidoncreate instance—--bid_priceselects bid mode.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 83 lines · 26 tokens per session scan C 9896c26acada
launch is a command published in the GitHub repository vast-ai/vast-claude-plugin (3 stars, last pushed 2mo ago), licensed MIT. It adds 26 tokens to every session and 1,577 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
deploy
Build, test, deploy with staged rollout.
deploy
Deploy a frontend (React, Next.js, or static HTML) to a live URL on Butterbase.
cf-scaffold-project
Scaffold a Cloudflare project — Worker, Pages, or Worker+D1+R2 starter — with Wrangler config, Terraform skeleton, and GitHub Actions deploy using scoped API tokens.
scan
Scan AWS account for cost optimization.
finops-feedback
Step 5 (Feedback Loop & Celebration) — measure realized against projected savings, compute a labelled Cloud Entropy proxy, close the opportunity, and emit at least one new idea or policy update so the loop actually closes. Applies the double-loop gate. Mutates on the closure path.
run-panguweather
Guide the user through running PanguWeather end-to-end on an AMD cluster.