Borrowing it
Nothing to install: this file belongs to cyanheads/mcp-reporter. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/cyanheads/mcp-reporter/main/CLAUDE.mdgit clone --depth 1 https://github.com/cyanheads/mcp-reporterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/cyanheads/mcp-reporter/claude-md)<a href="https://agentmods.dev/instructions/cyanheads/mcp-reporter/claude-md"><img src="https://agentmods.dev/badge/instructions/cyanheads/mcp-reporter/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/cyanheads/mcp-reporter/claude-md"><img src="https://agentmods.dev/badge/instructions/cyanheads/mcp-reporter/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01132 | $0.01132 |
| Opus 5 | $0.00566 | $0.00566 |
| Sonnet 5 | $0.00226 | $0.00226 |
| Haiku 4.5 | $0.00113 | $0.00113 |
Grade A, and why
mcp-reporter CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
mcp-reporter
mcp-reporter is an MCP client and Markdown report generator. It connects to configured stdio or Streamable HTTP servers and enumerates their advertised tools, resources, resource templates, prompts, and identity. It does not serve MCP, execute tools, read resource contents, or expand prompts.
Start here
Read this file, run bun run list-skills, then read the task-specific skill. AGENTS.md points here; skills/ is canonical, with .claude/skills and .agents/skills symlinks for discovery. Adapted workflows use the public mcp-ts-core conventions; they do not add a framework runtime dependency.
Implementation
- TypeScript strict mode, ESM, explicit
.jsrelative imports, Bun for development.package.jsonis the version and runtime authority;src/version.tssupplies both CLI and handshake identity. src/config.tsvalidates all configuration before connections start. Preserve existing command/args/env/disabled entries. Exactly one of command or HTTP(S) URL selects the transport; optional type must agree.src/index.tsowns connection lifecycle and typed page-level requests. Legacy handshake is the default; auto/pinned modern negotiation is opt-in. Do not add a discovery probe to the default path.- Read every
nextCursor, including empty strings. Bound each list and detect repeated cursors. Incomplete lists retain collected entries with a visible status. Never equate not-advertised, successful empty, and failed collection. - Preserve protocol descriptors. The SDK's high-level list helpers may aggregate or filter advertisements; reporting uses the public typed request API to retain page boundaries and server-provided definitions.
- Configured env/header values, raw args, and credential-bearing URLs stay out of reports and diagnostics. Child stderr is suppressed. Peer/transport error messages are untrusted; report stable classifications. Escape Markdown/HTML and choose fences longer than any embedded backtick run.
- The library is quiet unless a progress callback is supplied. The CLI writes progress to stderr. Close every created transport on success and failure, including a failed report write.
src/utils/markdown.tsowns presentation. Keep summaries readable without CSS or remote media loads. Server annotations are reported hints, not verified safety guarantees. Preserve caller-supplied examples; the MCP collector does not invent them.- Add JSDoc to exports and a file-purpose header. Use protocol types and
unknowninstead ofany. Read complete files before editing; test behavior at transport and rendering boundaries.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 42 lines · 1,132 tokens per session scan A 9fb104bccb3e
mcp-reporter CLAUDE.md is an instructions file published in the GitHub repository cyanheads/mcp-reporter (12 stars, last pushed yesterday), licensed Apache-2.0. It adds 1,132 tokens to every session, about $0.0057 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.