Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add nirholas/three.wsnpx agentmods add plugins/nirholas/three.ws/marketplacegit clone --depth 1 https://github.com/nirholas/three.wsGrade A, and why
three-ws scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"name": "three-ws",
"owner": {
"name": "nirholas"
},
"description": "Official plugin marketplace for three.ws — wallet operations, x402 payments, MCP tools, pump.fun trading, and agent scaffolding.",
"version": "1.0.0",
"plugins": [
{
"name": "three-ws-core",
"source": "./.agents",
"displayName": "three.ws Core",
"description": "Core wallet and x402 payment skills — authenticate, fund, send tokens, trade, search the bazaar, pay for services, monetize APIs, and query onchain data.",
"version": "1.0.0",
"author": {
"name": "nirholas"
},
"homepage": "https://three.ws",
"repository": "https://github.com/nirholas/three.ws",
"license": "Apache-2.0",
"keywords": [
"wallet",
"x402",
"usdc",
"payments",
"trade",
"base",
"solana",
"polygon"
],
"category": "payments",
"tags": [
"wallet",
"x402",
"defi",
"payments"
]
},
{
"name": "three-ws-developer",
"source": "./marketplace/plugins/three-ws-developer",
"displayName": "three.ws Developer Tools",
"description": "Developer tools for three.ws — scaffold agents, configure MCP servers, and get runnable code examples for paid MCP tools.",
"version": "1.0.0",
"author": {
"name": "nirholas"
},
"homepage": "https://three.ws",
"repository": "https://github.com/nirholas/three.ws",
"license": "Apache-2.0",
"keywords": [
"developer",
"scaffold",
"mcp",
"tools",
"agent"
],
"category": "developer-tools",
"tags": [
"developer",
"mcp",
"scaffold",
"agent-kit"
]
},
{
"name": "three-ws-pump-fun",
"source": "./pump-fun-skills",
"displayName": "three.ws Pump.fun Trading",
"description": "Pump.fun on-chain trading skills — create What ships with it
1 file beside marketplace.json in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 127 lines scan A 256431978ecf
three-ws is a plugin published in the GitHub repository nirholas/three.ws (107 stars, last pushed 2d ago), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
hyperframes
Plugin marketplace listing 2 plugins: core-skills, hyperframes.
genjutsu
Genjutsu - the art of illusion for Claude Code and claude.ai. Cast motion and paint visual signatures into Web, Android (Compose), and Apple (SwiftUI) interfaces. Anti-AI-slop creative coding.
after-effects
Control Adobe After Effects with AI — describe the animation you want and it gets built: layers, keyframes, effects, expressions and text, all editable afterwards.
engine-room
Plugin marketplace listing 1 plugin: after-effects.
uiforge
Clone any website's design into clean, editable React + Tailwind, with your content. Renders a reference, extracts its full design (every color, gradient, shadow, font, box) into a Tailwind v4 theme, replays a faithful reconstruction, loops a visual diff against the original until it matches, then exports an editable…
motionspec
Verified web motion for AI-built sites: write a MotionSpec JSON spec, validate it against a strict schema, and compile deterministic GSAP/CSS with reduced-motion support and performance budgets enforced by construction. Reports WCAG 2.2.2 pause-path candidates (reduced-motion guard = 2.3.3, AAA). Includes a…