Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agentfront/frontmcp/frontmcp-auth-uinpx skills add agentfront/frontmcp --skill frontmcp-auth-uigit clone --depth 1 https://github.com/agentfront/frontmcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agentfront/frontmcp/frontmcp-auth-ui)<a href="https://agentmods.dev/skills/agentfront/frontmcp/frontmcp-auth-ui"><img src="https://agentmods.dev/badge/skills/agentfront/frontmcp/frontmcp-auth-ui.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00184 | $0.03055 |
| Opus 5 | $0.00092 | $0.01528 |
| Sonnet 5 | $0.00037 | $0.00611 |
| Haiku 4.5 | $0.00018 | $0.00305 |
Grade A, and why
frontmcp-auth-ui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
FrontMCP Custom Authorization UI (auth.ui)
Entry point for replacing FrontMCP's built-in OAuth pages (login, consent, federated, incremental, error) with your own React components. Custom UI is a simple slot→file map (auth.ui) plus an extras name→handler map (auth.extras) on the auth config — there is no decorator and no class. The references/custom-auth-ui.md reference has the full API; the examples/ show a single login slot and a multi-step extras form.
When to Use This Skill
Must Use
- Branding or fully replacing the
local/remotemode login page with a custom React component - Building a custom consent screen, federated provider picker, incremental authorization, or error page
- Adding a server-validated multi-step field to an authorization page (e.g. "add another item") via
auth.extras
Recommended
- Understanding which half is the server (
auth.ui/auth.extrasin@frontmcp/sdk) and which is the client (@frontmcp/ui/auth) - Looking up the
AuthFlowStatefields a slot component receives, or the/oauth/ui/extraroute - Confirming that the framework (not your component) owns CSRF + CSP
Skip When
- You only need to add/rename fields on the built-in login page or run a custom verifier — use the declarative
login/authenticateconfig infrontmcp-config→configure-authinstead (no React, no build step) - You are customizing a tool widget (not an auth page) — use
create-tool→ui-widgets - You don't need a custom page at all — configuring no
auth.uikeeps the built-in pages
Decision: Use this skill when you want to render your OWN component for an auth slot. Use
configure-auth's declarativeloginconfig when tweaking the built-in page's fields is enough.
Prerequisites
- A FrontMCP server in
localorremoteauth mode (seefrontmcp-config→configure-auth) @frontmcp/ui,react, andreact-dominstalled (react/react-domare peer deps of@frontmcp/ui)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 147 lines · 184 tokens per session scan A 21e8cecb3a47
frontmcp-auth-ui is a skill published in the GitHub repository agentfront/frontmcp (146 stars, last pushed 2d ago), licensed Apache-2.0. It adds 184 tokens to every session and 3,055 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
totp-oauth
Fermi's own OAuth 2.0 + TOTP owner authentication - how clients connect, how the 2FA login works, and how to roll it back.
typescript-expert
TypeScript and JavaScript expert with deep knowledge of type-level programming, performance optimization, monorepo management, migration strategies, and modern tooling. Use PROACTIVELY for any TypeScript/JavaScript issues including complex type gymnastics, build performance, debugging, and architectural decisions. If…
starchild-auth
Starchild Auth SDK: add OAuth login to any web app with one SDK. Use when integrating Starchild login into a project (e.g. add Starchild sign-in to my React app, set up OAuth with iamstarchild.com, implement login/logout with Starchild Auth SDK). Also use for local OAuth/CORS testing guidance (localhost:6066 web…
gh-pr-description
Drafts and reviews GitHub pull request descriptions for the eve repository. Use when opening, updating, or reviewing a PR, or when summarizing a branch for reviewers.
coss
Helps implement coss UI components correctly. Use when building UIs with coss primitives (buttons, dialogs, selects, forms, menus, tabs, inputs, toasts, etc.), migrating from shadcn/Radix to coss/Base UI, composing trigger-based overlays, or troubleshooting coss component behavior. Covers imports, accessibility…
build-with-tinybase
Scaffold, extend, and verify reactive local-first JavaScript or TypeScript applications with TinyBase. Use when choosing TinyBase for in-memory tabular or key-value state, generating an app with create-tinybase, adding schemas or UI bindings, configuring browser or database persistence, configuring MergeableStore…