Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Alignbase/sunpeak --skill test-mcp-servergit clone --depth 1 https://github.com/Alignbase/sunpeakWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alignbase/sunpeak/test-mcp-server)<a href="https://agentmods.dev/skills/alignbase/sunpeak/test-mcp-server"><img src="https://agentmods.dev/badge/skills/alignbase/sunpeak/test-mcp-server/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alignbase/sunpeak/test-mcp-server"><img src="https://agentmods.dev/badge/skills/alignbase/sunpeak/test-mcp-server.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 329 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.04988 |
| Opus 5.5 | $0.00030 | $0.01995 |
| Sonnet 5.5 | $0.00015 | $0.00998 |
| Haiku 4.5 | $0.00007 | $0.00499 |
Grade A, and why
test-mcp-server scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 466 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test MCP Server
sunpeak includes a testing framework that works with any MCP server, regardless of language or framework. It provides four testing layers: e2e tests (inspector-based), visual regression, live tests (against real ChatGPT), and evals (multi-model tool calling).
For sunpeak app projects, testing integrates automatically. For non-sunpeak MCP servers (Python, Go, Rust, etc.), sunpeak test init scaffolds a self-contained test directory.
Getting Started
sunpeak test init # Interactive setup (detects project type)
sunpeak test init --server http://localhost:8000/mcp # URL-based server
sunpeak test init --server "python server.py" # Command-based server
sunpeak test init detects three project types:
- sunpeak projects -- Adds
defineConfig()and eval boilerplate - JS/TS projects -- Adds Playwright config, smoke test, and evals at project root
- Non-JS projects -- Creates a self-contained
tests/sunpeak/directory with its ownpackage.json
Getting Reference Code
Clone the sunpeak repo for working test examples:
git clone --depth 1 https://github.com/Alignbase/sunpeak /tmp/sunpeak
Test examples live at /tmp/sunpeak/packages/sunpeak/template/tests/. This includes e2e tests, simulations, evals, and live tests.
Commands
sunpeak inspect # Inspect any MCP server in the inspector (standalone)
sunpeak test # Run unit (if configured) + e2e tests
sunpeak test --e2e # Run e2e tests only (Playwright)
sunpeak test --visual # Run e2e tests with visual regression comparison
sunpeak test --visual --update # Update visual regression baselines
sunpeak test init # Scaffold test infrastructure into a project
sunpeak test --live # Run live tests against real ChatGPT (requires tunnel + browser session)
sunpeak test --eval # Run evals against multiple LLM models (requires API keys)
sunpeak test --unit # Run unit tests (sunpeak app framework only, not standalone)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +5 lines 9bf2dac15d40
- 2mo ago First seen · 461 lines · 74 tokens per session scan A fd2c07b52d25
test-mcp-server is a skill published in the GitHub repository Alignbase/sunpeak (218 stars, last pushed 7d ago), licensed MIT. It adds 74 tokens to every session and 4,988 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
next-cache-components-optimizer
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route and entry point at a time; the shipped test then guards…
next-partial-prefetching-optimizer
Optimize what selected Next.js client navigations include before the click under Partial Prefetching. Use after Cache Components and Partial Prefetching are adopted when the user wants selected URL-specific UI to be instant, wants reusable content to wait for navigation, or needs to choose between default, viewport…
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).
uat-signoff
Walk a business/UAT approver through a plain-language demo of a verified feature and capture business acceptance signoff.
verify-bug
Post-merge UAT verification workflow. Walks JIRA reproduce steps, performs comparative audits (Before/After), attaches evidence to JIRA, and transitions status on PASS.
verify-work
Verify feature, bug, UI, API, mobile, security, or deployment work against acceptance criteria.