Borrowing it
Nothing to install: this file belongs to lacvietanh/aki-mcp-sv. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lacvietanh/aki-mcp-sv/main/CLAUDE.mdgit clone --depth 1 https://github.com/lacvietanh/aki-mcp-svWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md)<a href="https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md"><img src="https://agentmods.dev/badge/instructions/lacvietanh/aki-mcp-sv/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md"><img src="https://agentmods.dev/badge/instructions/lacvietanh/aki-mcp-sv/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02577 | $0.02577 |
| Opus 5.5 | $0.01031 | $0.01031 |
| Sonnet 5.5 | $0.00515 | $0.00515 |
| Haiku 4.5 | $0.00258 | $0.00258 |
Grade A, and why
aki-mcp-sv CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Do not trust local `curl https://$HOST`** — macOS WireGuard mesh (`100.100.100.100`) returns a false 200. Always probe the public IP via `--resolve`: How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
aki-mcp-sv — project guidance
Local MCP server (filesystem, search, shell, agy) for claude.ai & ChatGPT over Tailscale Funnel + OAuth 2.1. Entry: npm start → scripts/start.js (foreground, manual stop/start). Rule loader: akirule skill.
RECURRING #1 — "Couldn't connect" / no POST /token: Tailscale Funnel desync, NOT the code
Signature: npm start is healthy, funnel status says "on", but client reports "Couldn't connect" and gatekeeper stops at POST /authorize -> 302 with no POST /token. The local serve-config did not sync to Tailscale's public edge; external calls fail at the TLS layer.
- Do not debug
scripts/oauth.jsorscripts/gatekeeper.js— OAuth & bridge code are correct. - Do not trust local
curl https://$HOST— macOS WireGuard mesh (100.100.100.100) returns a false 200. Always probe the public IP via--resolve:HOST=$(tailscale status --json | jq -r .Self.DNSName | sed 's/\.$//'); PUB=$(dig @8.8.8.8 $HOST +short | head -1) curl --resolve $HOST:443:$PUB https://$HOST/.well-known/oauth-authorization-server # exit 35 / 000 = desync - Reset cycle:
tailscale funnel --https=443 off && tailscale serve reset && tailscale funnel --bg 9999 - Bypass / Ingress precedence:
--tunnel <cred.json>(Cloudflare) >PUBLIC_ORIGIN> Tailscale Funnel.
Two client paths, one OAuth server
scripts/oauth.js serves both without handler-level branching:
- Claude, ChatGPT, Grok, Gemini, Notion, ClickUp: URL + passphrase only; they self-register via RFC 7591 DCR (
POST /register), PKCE only, stored inoauth-dcr-clients.json. - Pre-issued confidential client in
oauth-client.json(client_secret_post): any client that wants a static client;scripts/start.jsprints its ID/secret. - Bearer clients (Buda): no DCR, so they send the shared access token as
Authorization: Bearer; no OAuth code involved, and Roll token breaks them until the new token is set again. - Invariants:
resolveClient()is the single SSoT lookup for both. Redirect URIs are strictly allowlisted inisAllowedRedirect(claude.ai,chatgpt.com,oauth-redirect*.googleusercontent.com,grok.com, Notion hosts, the ClickUp callback). Auth codes and refresh tokens are bound to their issuing client ID.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +9 tokens per session 3f0efaa80535
- 12d ago Changed · +9 lines · +525 tokens per session 636e1bb041be
- 1mo ago Changed · +17 lines · +621 tokens per session 97bcc929ce52
- 1mo ago Changed · +1 lines · +47 tokens per session 124df955190d
- 1mo ago Changed · -8 tokens per session 240a985e6829
- 1mo ago Changed 6d290fa6a789
- 1mo ago Changed · +68 tokens per session b4c50daf35ca
- 2mo ago Changed · +144 tokens per session 91efc9e744d3
- 2mo ago First seen · 51 lines · 1,171 tokens per session scan A 067690024f78
aki-mcp-sv CLAUDE.md is an instructions file published in the GitHub repository lacvietanh/aki-mcp-sv (145 stars, last pushed 3d ago), licensed MIT. It adds 2,577 tokens to every session, about $0.0103 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
aki-mcp-sv CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| aki-mcp-sv CLAUDE.mdlacvietanh/aki-mcp-sv | Instructions file | 145 | 3d ago | MIT | A | 2,577 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |