Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/maderwin/pinchtab-mcp/agents-mdgit clone --depth 1 https://github.com/maderwin/pinchtab-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/maderwin/pinchtab-mcp/agents-md)<a href="https://agentmods.dev/instructions/maderwin/pinchtab-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/maderwin/pinchtab-mcp/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00728 | $0.00728 |
| Opus 5 | $0.00364 | $0.00364 |
| Sonnet 5 | $0.00146 | $0.00146 |
| Haiku 4.5 | $0.00073 | $0.00073 |
Grade A, and why
pinchtab-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Guidelines for pinchtab-mcp
For project structure, tools, configuration, and code style see PROJECT_INDEX.md.
Key Decisions (Non-Obvious)
- McpServer, not Server — uses
registerTool()+ zod schemas from@modelcontextprotocol/sdk/server/mcp.js. TheServerclass is deprecated. - Auto-start — PinchTab binary starts on first API call. Lookup order:
PINCHTAB_BINenv →node_modules/.bin/pinchtab→ system PATH. - Stdio transport — MCP over stdin/stdout. All logging → stderr (
console.error). - Element refs —
e0,e1, … are accessibility tree identifiers, not DOM selectors. They exist only in snapshot responses, not in the DOM. Stale after navigation or major DOM changes. - No null — the codebase uses
undefinedeverywhere (includingtoJson():JSON.stringify(value, undefined, 2)). - Sorted keys — all object literals have alphabetically sorted keys, including
z.object()fields and MCP tool config objects. - Real interactions by default —
humanClick(real mouse events) andhumanType(character-by-character) are defaults. Programmatic variants are opt-in fallbacks.
Recommended Workflow
- Navigate with
waitMsto get a snapshot in one call:pinchtab_navigate({ url, waitMs: 3000 }). - Prefer snapshot over screenshot — snapshot costs ~3K tokens, screenshot costs 10-50K+ tokens. Use screenshot only when visual layout matters.
- Use
filter='interactive'for snapshot when you only need buttons/links/inputs. - Click with
waitMsto get post-click state in one call:pinchtab_click({ ref, waitMs: 1000 }). - Wait for dynamic content with
pinchtab_wait_for_selector({ selector: '.loaded' })instead of fixed delays. - React/Vue/Angular forms — use
clearFirst: trueinpinchtab_typeto properly trigger framework state updates. - Avoid stale refs — always re-snapshot after navigation or major DOM changes.
When Modifying Tools
- Correct file:
src/tools/{instances,navigation,interaction,content}.ts. - Pattern:
server.registerTool(name, { description, inputSchema, title }, handler)— keys sorted. inputSchema:z.object({...})with fields sorted alphabetically.- Name prefix:
pinchtab_. - Return format:
{ content: [{ text, type: "text" as const }] }— keys sorted. - Use
toJson(result)from../utils.jsfor pretty-printing, neverJSON.stringify(x, null, 2)directly. - Use
pinch(method, path, body?)from../pinchtab/client.jsfor all HTTP calls.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 39 lines · 728 tokens per session scan A b142a31d623d
pinchtab-mcp AGENTS.md is an instructions file published in the GitHub repository maderwin/pinchtab-mcp (0 stars, last pushed 2mo ago), licensed MIT. It adds 728 tokens to every session, about $0.0036 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
flyto-core AGENTS.md
AGENTS.md instructions for flytohub/flyto-core, covering flyto-core agent rules, flyto2 project memory contract, flyto2 frontend quality gate and repo notes.
apitap CLAUDE.md
Instructions for n1byn1kt/apitap, covering claude.md, using apitap as an mcp tool, commands, architecture and module map.
web-developer-mcp CLAUDE.md
Instructions for Artmann/web-developer-mcp, covering claude instructions for webdev mcp server, development guidelines, code style & organization, project structure and browser management.
qa-use CLAUDE.md
Instructions for desplega-ai/qa-use, covering claude.md, project map and tech stack.
GhostDesk CLAUDE.md
Claude Code instructions for YV17labs/GhostDesk, a project described as: Give any AI agent a full desktop — it sees the screen, clicks, types, and runs apps like a human. Automate anything with a UI: browsers, legacy software, internal tools. No API needed. One Docker command.
browsermcp-ext GEMINI.md
Instructions for derailed-dash/browsermcp-ext, covering browsermcp agent instructions, capabilities, limitations and usage.