Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add agentic-community/mcp-gateway-registry --skill agentcore-registergit clone --depth 1 https://github.com/agentic-community/mcp-gateway-registryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agentic-community/mcp-gateway-registry/agentcore-register)<a href="https://agentmods.dev/skills/agentic-community/mcp-gateway-registry/agentcore-register"><img src="https://agentmods.dev/badge/skills/agentic-community/mcp-gateway-registry/agentcore-register/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agentic-community/mcp-gateway-registry/agentcore-register"><img src="https://agentmods.dev/badge/skills/agentic-community/mcp-gateway-registry/agentcore-register.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 179 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 3 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 59 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01818 |
| Opus 5 | $0.00024 | $0.00909 |
| Sonnet 5 | $0.00010 | $0.00364 |
| Haiku 4.5 | $0.00005 | $0.00182 |
Grade A, and why
agentcore-register scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Given an MCP server URL, probe the server via curl to discover its metadata and tools, then generate a markdown file with copy-pasteable content for each field in the Amazon Bedrock AgentCore "Create record" How it starts
The opening of the file, as written. The whole thing — 205 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentCore Register
Given a remote MCP server URL, probe it to discover server info and tools, then generate a markdown file containing copy-pasteable values for every field in the Amazon Bedrock AgentCore Create record form.
The MCP server URL is provided as $ARGUMENTS.
If $ARGUMENTS is empty, ask the user for the MCP server URL using AskUserQuestion.
Steps
1. Initialize the MCP session
Send the MCP initialize request and capture the response headers (for the session ID) and body (for server info).
curl -s --max-time 15 -D /tmp/_agentcore_mcp_headers.txt \
-X POST "$MCP_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"capabilities": {},
"clientInfo": {"name": "agentcore-register", "version": "1.0.0"}
}
}' > /tmp/_agentcore_mcp_init.json 2>&1
Parse the response to extract:
serverInfo.name- the server nameserverInfo.version- the server versionprotocolVersion- the MCP protocol versioncapabilities- what the server supports
Extract the mcp-session-id header value from /tmp/_agentcore_mcp_headers.txt.
Error handling
- If the curl request fails or times out, tell the user the server is unreachable and stop.
- If the response is a 502/503/504, tell the user the server backend is down and stop.
- If the response is HTML (not JSON), tell the user the URL may not be an MCP endpoint and stop.
2. List the tools
Using the session ID from step 1, send a tools/list request:
SESSION_ID=$(grep -i 'mcp-session-id' /tmp/_agentcore_mcp_headers.txt | awk '{print $2}' | tr -d '\r')
curl -s --max-time 15 \
-X POST "$MCP_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "mcp-session-id: $SESSION_ID" \
-d '{"jsonrpc": "2.0", "id": 3, "method": "tools/list", "params": {}}' \
> /tmp/_agentcore_mcp_tools.json 2>&1
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 205 lines · 49 tokens per session scan A bdcb03a82d3e
agentcore-register is a skill published in the GitHub repository agentic-community/mcp-gateway-registry (899 stars, last pushed yesterday), licensed Apache-2.0. It adds 49 tokens to every session and 1,818 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
architecture-patterns
Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or…
saga-orchestration
Implement saga patterns for distributed transactions and cross-aggregate workflows. Use this skill when implementing distributed transactions across microservices where 2PC is unavailable, designing compensating actions for failed order workflows that span inventory, payment, and shipping services, building…
event-store-design
Design and implement event stores for event-sourced systems. Use when building event sourcing infrastructure, choosing event store technologies, or implementing event persistence patterns.
error-handling-patterns
Master error handling patterns across languages including exceptions, Result types, error propagation, and graceful degradation to build resilient applications. Use when implementing error handling, designing APIs, or improving application reliability.
fastapi-templates
Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.
api-design-principles
Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.