Borrowing it
Nothing to install: this file belongs to eschatus/roll20-dm-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/eschatus/roll20-dm-mcp/master/CLAUDE.mdgit clone --depth 1 https://github.com/eschatus/roll20-dm-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/eschatus/roll20-dm-mcp/claude-md)<a href="https://agentmods.dev/instructions/eschatus/roll20-dm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/eschatus/roll20-dm-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/eschatus/roll20-dm-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/eschatus/roll20-dm-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.05522 | $0.05522 |
| Opus 5 | $0.02761 | $0.02761 |
| Sonnet 5 | $0.01104 | $0.01104 |
| Haiku 4.5 | $0.00552 | $0.00552 |
Grade A, and why
roll20-dm-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 271 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — roll20-dm-mcp
Orientation for an agent doing development in this repo. Read this first; it points to the canonical deep-dive docs rather than duplicating them. Two domains have their own sections below: Maps development and Combat development.
What this is
AI-assisted D&D 5e session management for Roll20. Three components:
roll20-dm— live-combat MCP server over HTTP (src/index-http.ts→src/server-combat.ts). HP, conditions, initiative, dice, narration, turn hooks, AoE, mob-plan storage. Roll20 ONLY — no D&D Beyond, no LLM, no browser (#171, #179). Also keeps the dual-use zones tools it needs live (fixed-area spells).screenshot_roll20is GONE — a screenshot needs a renderer.roll20-dm-maps— map-prep MCP server over stdio (src/index-maps.ts). Owns the full map/wall/zone domain: battlemap upload, Claude-Vision wall detection, DL walls/doors, token creation, zones, screenshots. The prep-only analysis/wall tools (registerVisionTools) live here only;zones.tsis a shared module registered in both servers.- DM Whisper — the Electron voice gem (PTT → Whisper STT → Claude agent). No longer in this
repo. Split out to https://github.com/eschatus/dm-whisper on 2026-08-11 and closed source; it
consumes this repository as a pinned dependency and bundles
skills/dm-rules.md,mod-scripts/ai-relay.jsand the server itself into its installer. Changes to those files reach the gem only when it re-pins. This repository stays open under MIT — see LICENSE and NOTICE.
There is also a stdio combat server entry (src/index-combat.ts, npm start → dist/index-combat.js).
Build / run / test / deploy
- Node 20+ (TypeScript 6 build needs it).
npm install— no browser step: this repo has no Playwright dependency at all (#179). npm run serve— runs the HTTP server viatsx(no build step needed for dev). First run generatesROLL20_MCP_TOKEN, writes it to.env, and injects it into.mcp.json.npm run build—tsc→dist/. Required for the stdio servers referenced in.mcp.json(dist/index-maps.js) andnpm start. Not required fornpm run serve.npm test— vitest (src/**/*.test.ts+test/*.test.ts).npm run test:watchto iterate. Single file:npx vitest run test/zone-semantics.test.ts; single case: add-t "name substring".npm run lint— eslint oversrc/+test/.- Mod redeploy is EXTERNAL to this repo (#175). The relay (
mod-scripts/ai-relay.js) runs in the Roll20 API sandbox and only takes effect once deployed — but deploying means driving a browser against a live account, so it is a human-attended act, not something an MCP server or a dev session does. Pastemod-scripts/ai-relay.jsinto the campaign's API console yourself (or use the gem's attended flow). Verify the LOAD, never the write: the sandbox banner[GM_AI_Bridge] Relay script loaded (vX.Y.Z)or apingreturning the version. Deploys are per-campaign — each campaign carries its own copy, so one can run a newer relay than another. CI runsnode --check mod-scripts/ai-relay.jsas a syntax gate. - Relay version handshake:
AI_RELAY_VERSION(mod-scripts/ai-relay.js) andEXPECTED_RELAY_VERSION(src/bridge/relay-version.ts) are a hand-synced pair, locked bytest/relay-version.test.ts— bump BOTH when changingai-relay.jsin a way worth flagging to a DM on a stale deploy. A mismatch warns once (never throws) and surfaces viatransport_status. src/recon/*are manual live scripts (real campaign), run withtsx— the smoke/soak layer. They are excluded from the prod build.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 271 lines · 5,522 tokens per session scan A b2e0dd5cc206
roll20-dm-mcp CLAUDE.md is an instructions file published in the GitHub repository eschatus/roll20-dm-mcp (7 stars, last pushed today), licensed MIT. It adds 5,522 tokens to every session, about $0.0276 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.