publisher AGENTS.md

Instructions for working with Malloy Publisher, an open-source server that turns Malloy data models into queryable data services. Malloy is a language for describing and querying data.

In plain words
What is it for?
Starting the server, exploring environments and fields, answering plain-English data questions, validating and reloading Malloy models, and building HTML data apps.
Why use it?
They explain how to discover available data, connect an agent, and safely work with the local server.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/malloydata/publisher/agents-md
Clone the repo
git clone --depth 1 https://github.com/malloydata/publisher

Made for: Codex, OpenCode.

Per session 5,582 This file is loaded in full into every session.
When invoked 5,582 The same file — it is already loaded in full.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.05582 $0.05582
Opus 5 $0.02791 $0.02791
Sonnet 5 $0.01116 $0.01116
Haiku 4.5 $0.00558 $0.00558

Measured yesterday against content hash 69d4e5f6f333, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

publisher AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

Codex: add to `~/.codex/config.toml`:

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s http://localhost:4000/api/v0/status | jq .operationalState # -> "serving"
AGENTS.md · 194 lines

How it starts

The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Working with Malloy Publisher

Publisher is the open-source semantic model server for Malloy. It serves one or more Malloy model packages over a REST API and a single MCP endpoint. If you are an AI agent working in this repo, here is what you can do with it and how to start.

What you can do

  • Discover what data exists: environments, packages, models, sources, and fields, without knowing any names in advance.
  • Answer plain-English questions by running Malloy queries, which Publisher compiles to SQL and runs against the connected database.
  • Build and change Malloy models: validate an edit with malloy_compile, save it, then malloy_reloadPackage to run it by name. The malloy-modeling skill covers the workflow.
  • Build a data app: a hand-authored HTML page in a package's public/ directory, backed by that package's models and served by Publisher with no build step. The malloy-html-data-apps skill covers it.
  • Review Malloy for correctness with the malloy-review skill.

All of it runs against a local server you start in step 1 and reach over MCP in step 2, or over REST when you work unattended (section 7).

1. Start the server first

The MCP tools talk to a running server, so nothing works until it is up.

From a clone:

bun install
bun run build && bun run start        # REST on :4000, MCP on :4040

To re-initialize the sample storage on a later run, build first and then start with --init: bun run build && bun run start:init. Without cloning, npx @malloy-publisher/server@latest --port 4000 runs the published build. Start one npx server at a time: concurrent first runs can race in the shared npx cache and corrupt the install (docs/deployment.md has the recovery step).

Keep the @latest. npx resolves through a shared cache and will happily re-run a build it downloaded weeks ago, so a bare npx @malloy-publisher/server can serve an old version while looking like a fresh start. The server does not report its own version, so a stale build is invisible until it behaves like one — a fixed bug that appears to still be there is the usual first sign.

Read the full file on GitHub · 194 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 194 lines · 5,582 tokens per session scan B 69d4e5f6f333

Subscribe to this mod's changes

publisher AGENTS.md is an instructions file published in the GitHub repository malloydata/publisher (99 stars, last pushed 2d ago), licensed MIT. It adds 5,582 tokens to every session, about $0.0279 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.