Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/cboxdk/statamic-mcp/claude-mdgit clone --depth 1 https://github.com/cboxdk/statamic-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.09690 | $0.09690 |
| Opus 5 | $0.04845 | $0.04845 |
| Sonnet 5 | $0.01938 | $0.01938 |
| Haiku 4.5 | $0.00969 | $0.00969 |
Grade A, and why
statamic-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 1,113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
This is a Statamic addon that functions as an MCP (Model Context Protocol) server, built on top of Laravel's MCP server. The addon extends Statamic CMS v6.6+ and requires laravel/mcp ^0.6 || ^0.7 || ^0.8 || ^0.9 as a runtime dependency. It includes scoped API token authentication, a Vue 3 CP dashboard, and web MCP endpoints.
Key Dependencies
- PHP: ^8.3
- Statamic CMS: ^6.6 (v6 only — v5 support was removed in v2.0)
- Laravel: ^12.0 || ^13.0 (via Statamic v6)
- Laravel MCP: ^0.6 || ^0.7 || ^0.8 || ^0.9 (required - must be in
requiresection, notrequire-dev) - Orchestra Testbench: ^10.0 || ^11.0 (dev dependency for testing)
- Pest: ^4.1 (stable release with PHP 8.3 requirement)
- Symfony YAML: ^7.0 || ^8.0 (for YAML processing)
Authentication System
Scoped API Tokens
The addon provides scoped API tokens for fine-grained MCP access control:
- Token Management: Via Statamic CP dashboard (Tools → MCP → Tokens)
- Token Storage: Eloquent model (
McpToken) with SHA-256 hashed tokens - Guard: Custom
McpTokenGuardregistered as themcpauth guard - Scopes: 21 granular scopes via
TokenScopeenum (e.g.,content:read,content:write,*)
Key Auth Classes
src/Auth/TokenScope.php— Backed string enum with scope helperssrc/Auth/McpToken.php— Eloquent model with UUID primary keyssrc/Auth/TokenService.php— Token CRUD, validation, and pruningsrc/Auth/McpTokenGuard.php— Laravel Guard implementation for Bearer tokenssrc/Auth/AuthServiceProvider.php— Registers singletons and auth guard
Middleware
HandleMcpCors— CORS headers for browser-based clients (only whenallowed_originsconfigured)EnsureSecureTransport— Rejects plain HTTP in production (whenrequire_httpsenabled)AuthenticateForMcp— Bearer token + Basic Auth fallbackRequireMcpPermission— Validates token scopes and expiry
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 1,113 lines · 9,690 tokens per session scan A 422a0679b9d1
statamic-mcp CLAUDE.md is an instructions file published in the GitHub repository cboxdk/statamic-mcp (36 stars, last pushed 6d ago), licensed MIT. It adds 9,690 tokens to every session, about $0.0485 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
agentic-playwright selectors.instructions.md
Instructions for idavidov13/agentic-playwright, covering selector strategy, critical, instructions, phase 1: open and authenticate and phase 2: explore like a user.
awesome-copilot-id AGENTS.md
Instructions for GulajavaMinistudio/awesome-copilot-id, covering communication, explanation and documentation, markdown formatting, user communication style and workflow & methodology.
llm-ide-rules pytest-integration-tests.instructions.md
Instructions for iloveitaly/llm-ide-rules, covering pytest integration tests and example integration test.
toki AGENTS.md
Instructions for choi138/toki, covering workspace rules, source of truth, toki workflow, required checks and global safety rules.
agentdex CLAUDE.md
Instructions for CaptainYouz/agentdex, covering claude.md — agentdex, purpose, commands, architecture and what gets scanned.
kleosrules AGENTS.md
Instructions for kleosr/kleosrules, a project described as: Cursor harness pack: user rules, skills, Bash hooks, local HANDOFF memory. macOS, Linux, Windows (WSL).