Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/alibaba/webmcp-nexus/skillnpx skills add alibaba/webmcp-nexus --skill skillgit clone --depth 1 https://github.com/alibaba/webmcp-nexusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alibaba/webmcp-nexus/skill)<a href="https://agentmods.dev/skills/alibaba/webmcp-nexus/skill"><img src="https://agentmods.dev/badge/skills/alibaba/webmcp-nexus/skill.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00159 | $0.07895 |
| Opus 5 | $0.00079 | $0.03947 |
| Sonnet 5 | $0.00032 | $0.01579 |
| Haiku 4.5 | $0.00016 | $0.00789 |
Grade A, and why
webmcp-nexus scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 763 lines — stays where its author put it; the contents beside it link to each section on GitHub.
webmcp-nexus-skill
本技能用于指导 AI 编码 Agent（Cursor / Claude Code / Qoder / Continue 等）在已接入或即将接入 webmcp-nexus-sdk 的业务项目中进行以下四类工作：
- 约束开发规范 —— 工具函数的签名、JSDoc、TS 类型写法。
- 生成新工具函数 —— 按规范从零写一个符合 WebMCP schema 抽取要求的函数。
- 改造现有方法为工具函数（核心） —— 把项目里已有的业务函数（可能是位置参数、缺 JSDoc、参数类型是
any等）改造成合规工具函数。红线：只改签名与注释，绝不修改原方法的功能与业务逻辑。 - SDK / 构建插件接入引导 ——
webmcp-nexus-sdk、vite-plugin-webmcp-nexus、webpack-plugin-webmcp-nexus的安装与配置。
本技能不关心项目的代码风格（分号、引号、缩进、Prettier 配置）、ESLint 规则、tsconfig 其他选项——这些不影响 WebMCP 工具的提取与注册。
0. 三级约束（TL;DR）
WebMCP 构建插件（Vite/Webpack plugin）通过 ts-morph 从 registerGlobalTools(...) / useWebMcpTools(...) / withWebMcpTools(...) 的调用位置向上追踪工具函数的定义，提取 JSDoc 与参数类型，在构建阶段把 __webmcpSchema（description / inputSchema / annotations）注入到每个函数对象上。SDK 在运行时读取该字段向 navigator.modelContext 注册。
约束严重度分三级，递减：
MUST —— 违反将导致函数无法注册，或 schema 被污染而无法被 LLM 调用
| # | 约束 |
|---|---|
| M1 | 工具函数必须可被追踪。三种可追踪形式：① 作为对象字面量属性传入 registerGlobalTools({ fn }) / useWebMcpTools({ fn })；② 在 import * as api from './module' 的 ./module 里作为具名导出（避免 export default，否则工具名会被解析成字符串 "default"）；③ 作为 class 组件内带 JSDoc 的方法，通过 withWebMcpTools(MyClass) 注册 |
| M2 | 工具函数必须接受单一对象类型参数（命名 interface / type alias / 内联对象字面量）。原始类型 / 数组 / any / 泛型会让 ts-morph 吐出原型链上的一堆属性（length、charAt…），schema 被污染，LLM 调用必失败 |
SHOULD —— 违反不阻止注册，但 schema 质量差，LLM 难以理解
| # | 约束 |
|---|---|
| S1 | 工具函数本身有 /** 一行描述 */ JSDoc。缺失时 description 为空字符串，LLM 不知道工具用途 |
| S2 | 参数类型每个字段有 /** 描述 */ JSDoc。缺失时字段仍进 schema，只是没 description，LLM 不知字段含义 |
| S3 | 只读工具（查询 / 搜索 / 不改状态）在函数 JSDoc 追加 @readonly，宿主 Agent 据此判断是否需要用户确认 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 763 lines · 159 tokens per session scan A f79719e26717
webmcp-nexus is a skill published in the GitHub repository alibaba/webmcp-nexus (41 stars, last pushed 2mo ago), licensed MIT. It adds 159 tokens to every session and 7,895 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
youtube-transcripts
Read and search YouTube videos through VidWords. Use when the user supplies a YouTube URL, a bare 11-character video id, a youtu.be or Shorts link, or a channel handle, and wants any of: the transcript or subtitles (TXT/SRT/VTT), what a video says about a topic, a quote with a citable timestamp, only the words spoken…
notion-recipes
Use this skill when a user wants to turn meeting notes into a tracked Action Items database in Notion, or to bulk-edit, find-replace, normalize, or repair Notion database rows or page text at a scale past Notion's native find-and-replace limits. Uses easy-notion's MCP tools.
repo-context
Use repo-context-mcp tools to map, search, and pack repository context before large edits or PR review.
social-scrape
Collect public posts and discussion from X, LinkedIn and Hacker News through a local signed-out browser, then report them in chat or write them to a document. Use when the user wants to scrape, monitor or research specific accounts, topics, hashtags or discussions on social platforms.
MCP Integration Assistant
Helps design and implement Model Context Protocol (MCP) server integrations for AI agents.
MCP Server Builder
Step-by-step guidance for creating a new MCP server with FastMCP or the TypeScript SDK — tool definitions, resource handlers, error responses, and usage examples.