Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agentic-control-plane/codex-acp-plugin/cost-xraynpx skills add agentic-control-plane/codex-acp-plugin --skill cost-xraygit clone --depth 1 https://github.com/agentic-control-plane/codex-acp-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agentic-control-plane/codex-acp-plugin/cost-xray)<a href="https://agentmods.dev/skills/agentic-control-plane/codex-acp-plugin/cost-xray"><img src="https://agentmods.dev/badge/skills/agentic-control-plane/codex-acp-plugin/cost-xray.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.00980 |
| Opus 5 | $0.00022 | $0.00490 |
| Sonnet 5 | $0.00009 | $0.00196 |
| Haiku 4.5 | $0.00004 | $0.00098 |
Grade A, and why
cost-xray scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cost X-ray
Produce a ranked, evidence-backed report on where this agent's model spend goes and what to change. ACP sits in the request path, so it sees composition (cache blend, context breakdown, per-tool output bytes, loop share) — not just totals. Your job: pull the data, run the decompositions below, and deliver a report the user can act on before scaling to production.
Data sources (in order of preference)
- ACP MCP tools if connected:
acp_optimize(composition),acp_trace(one run's steps),acp_recommendations(policy findings),acp_cost(spend by model). - REST fallback with the key in
~/.acp/credentials(or~/.acp/proxy-key):GET https://api.agenticcontrolplane.com/api/v1/runs?window=7d— run rollupsGET https://api.agenticcontrolplane.com/api/v1/runs/{runKey}— one run with ordered stepsGET https://api.agenticcontrolplane.com/api/v1/introspect/cost-insights?window=7d— ranked recommendations Auth:Authorization: Bearer <key>.
Analysis steps
- Headline: total cost, run count, window. If
byoAuth, label costs "@ API rates" (subscription traffic priced at what it would cost). - Cache economics — decompose before concluding. A low headline hit rate has at least four distinct causes with different fixes. Compute from step data (
model,tMs,promptTokens,cachedTokens):- per-model hit rate — Anthropic caches are per-model; if one model is cold, switching is the cause → route or batch by model;
- hit rate by gap since the previous same-model call (<1min / 1–5min / 5–60min) — decay over gaps = TTL expiry → schedule work closer together or accept it;
- full-price share immediately after a model switch — high = switching cost, low = rules it out;
- uniform ~50% across models and gaps = structural: likely cache writes of new tool output being counted as misses (heavy tool-result appending), or genuine prefix instability. Say which is more consistent with the context composition, and say what you cannot distinguish from the data.
- Context composition: system vs history vs tool-results share. If tool results dominate, name the top tools by re-read bytes (
toolResultBytesByTool) and the worst offender's MB. - Loop share: report the number. Only recommend a subagent split for autonomous agents (background/api tier) — for interactive agents the growing loop IS the work.
- Failure waste: only from
runOutcome === "failed"runs. Runs without a terminal outcome NEVER get a waste claim. - Recommendations: merge
/cost-insightsitems, ranked byimpactUsd.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 53 lines · 43 tokens per session scan A 1fb3bcbd1257
cost-xray is a skill published in the GitHub repository agentic-control-plane/codex-acp-plugin (1 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 980 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
safedeps
Gate dependency installs (npm/pip/cargo/go/gem/maven/nuget) with OSV-backed advisory checks, approved-spec ledger, and post-install reorg rollback. Run safedeps check @ before any install command.
docs-sync
Multi-step workflow to audit MCPKernel documentation against the codebase and update README.md, docs/ MkDocs site, CHANGELOG.md. Use when synchronizing documentation with code changes, auditing doc accuracy, or before releases.
test-and-merge
Multi-step workflow to run the full MCPKernel test suite, validate code quality, and merge development branch to main when all checks pass. Use when validating changes, preparing for merge, or checking if development is ready for main.
research-and-improve
Multi-step workflow to research latest MCP security techniques, async Python patterns, sandboxing approaches, and implement improvements to MCPKernel. Use when upgrading architecture, adding new security features, or optimizing performance based on latest research.
search-and-fix
Multi-step workflow to discover issues in MCPKernel and similar repos, implement fixes, and validate with tests. Use when finding and fixing bugs, addressing security gaps, or implementing improvements discovered from issue analysis.
jp-harness-tune
Skill "jp-harness-tune" from Sora-bluesky/ja-output-harness, covering jp-harness-tune — jplint ルールの対話チューニング, 呼び出し方, step 1: 現状の把握, step 2: 操作意図のヒアリング and step 2b: discover フロー(意図 6 の場合).