Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/abderrahimghazali/drupal-boost/rest-jsonapinpx skills add abderrahimghazali/drupal-boost --skill rest-jsonapigit clone --depth 1 https://github.com/abderrahimghazali/drupal-boostWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.01007 |
| Opus 5 | $0.00026 | $0.00504 |
| Sonnet 5 | $0.00011 | $0.00201 |
| Haiku 4.5 | $0.00005 | $0.00101 |
Grade A, and why
rest-jsonapi scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drupal 11 REST & JSON:API Development
JSON:API (Recommended for Entity CRUD)
JSON:API is enabled by default. Endpoints follow the pattern:
/jsonapi/{entity_type_id}/{bundle_id}
/jsonapi/{entity_type_id}/{bundle_id}/{uuid}
Examples
GET /jsonapi/node/article # List articles
GET /jsonapi/node/article/{uuid} # Get single article
POST /jsonapi/node/article # Create article
PATCH /jsonapi/node/article/{uuid} # Update article
DELETE /jsonapi/node/article/{uuid} # Delete article
Filtering & Sorting
/jsonapi/node/article?filter[status]=1
/jsonapi/node/article?sort=-created
/jsonapi/node/article?include=uid,field_tags
/jsonapi/node/article?fields[node--article]=title,body
/jsonapi/node/article?page[limit]=10&page[offset]=0
JSON:API Request Body (POST/PATCH)
{
"data": {
"type": "node--article",
"attributes": {
"title": "My Article",
"body": {
"value": "<p>Content</p>",
"format": "basic_html"
}
},
"relationships": {
"uid": {
"data": { "type": "user--user", "id": "USER_UUID" }
}
}
}
}
Custom REST Resources
For non-entity data or complex business logic:
namespace Drupal\MODULE_NAME\Plugin\rest\resource;
use Drupal\rest\Plugin\ResourceBase;
use Drupal\rest\ResourceResponse;
#[RestResource(
id: "my_resource",
label: new TranslatableMarkup("My Resource"),
uri_paths: [
"canonical" => "/api/my-resource/{id}",
"create" => "/api/my-resource",
]
)]
class MyResource extends ResourceBase {
public function get(string $id): ResourceResponse {
$data = ['id' => $id, 'message' => 'Hello'];
$response = new ResourceResponse($data, 200);
$response->addCacheableDependency(CacheableMetadata::createFromRenderArray([
'#cache' => ['max-age' => 3600],
]));
return $response;
}
public function post(array $data): ModifiedResourceResponse {
// Validate and process $data
return new ModifiedResourceResponse($result, 201);
}
}
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 153 lines · 53 tokens per session scan A 85ad3a9a80b0
rest-jsonapi is a skill published in the GitHub repository abderrahimghazali/drupal-boost (1 stars, last pushed 5mo ago), licensed MIT. It adds 53 tokens to every session and 1,007 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cms-detection
Identify CMS, frameworks, and server technology stacks on live hosts.
angular-developer
Generates Angular code and provides architectural guidance. Trigger when creating projects, components, or services, or for best practices on reactivity (signals, linkedSignal, resource), forms, dependency injection, routing, SSR, accessibility (ARIA), animations, styling (component styles, Tailwind CSS), testing, or…
drupal-htmx
HTMX in Drupal 11.3+ core — the Htmx PHP fluent builder, dynamic forms with swapOob, partial routes with htmxroute, response headers, and Drupal.behaviors integration. Use when building interactive UI without full-page reloads using Drupal's native HTMX support.
drupal-search-api
Search API — index configuration, boost processors, field types, number field boosting, engagement metrics, and reindexing workflows.
drupal-contrib-mgmt
Drupal contrib module upgrade triage — Drupal.org issue queue research, local patch creation (git diff), composer-patches workflows, Drupal 11 compatibility via coreversionrequirement, Drupal Lenient handling, and upgradestatus analysis. Not for generic Composer dependency management.
drupal-migrations
Drupal migration API — D7-to-D11 upgrades, CSV imports, JSON API imports, and custom source/process/destination plugins.