Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aliyun/alibabacloud-devops-mcp-server --skill alibabacloud-devopsgit clone --depth 1 https://github.com/aliyun/alibabacloud-devops-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops)<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 33 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 19 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 47 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 415 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 418 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 421 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 424 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 433 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 436 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 439 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 442 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 451 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 454 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 457 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 460 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 19 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.04263 |
| Opus 5 | $0.00022 | $0.02132 |
| Sonnet 5 | $0.00009 | $0.00853 |
| Haiku 4.5 | $0.00004 | $0.00426 |
Grade A, and why
alibabacloud-devops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 469 lines — stays where its author put it; the contents beside it link to each section on GitHub.
阿里云云效 DevOps MCP Server
这是阿里云云效 DevOps 平台的 MCP Server Skill，提供全面的 DevOps 工具集，包括代码管理、项目管理、流水线管理、应用交付、制品管理和测试管理等能力。
渐进式披露模式
本 Skill 采用渐进式披露模式，按需获取工具详情和调用工具。
查看工具列表和参数
获取所有工具及其详细参数信息：
npx -y mcporter list --stdio "npx -y alibabacloud-devops-mcp-server" --schema
如果已配置服务器，也可以直接使用：
npx -y mcporter list yunxiao --schema
调用工具
使用 key:value 或 key=value 格式传递参数：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" <tool_name> param1:"value1" param2:"value2"
示例：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" list_repositories organizationId:"your-org-id"
环境变量配置
MCP Server 需要配置以下环境变量：
YUNXIAO_ACCESS_TOKEN: 云效访问令牌（必需）
可通过 --env 参数传递：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" --env YUNXIAO_ACCESS_TOKEN=your-token <tool_name> ...
工具列表
共 165 个工具，按功能分类如下：
基础工具（Base）
| 工具名 | 描述 |
|---|---|
get_current_organization_info |
获取当前用户和组织信息（基于 token） |
get_user_organizations |
获取当前用户所属的组织列表 |
get_current_user |
获取当前用户信息（基于 token） |
代码管理（Code Management）
分支管理
| 工具名 | 描述 |
|---|---|
create_branch |
创建代码仓库分支 |
get_branch |
获取分支信息 |
delete_branch |
删除分支 |
list_branches |
列出仓库所有分支 |
文件操作
| 工具名 | 描述 |
|---|---|
get_file_blobs |
获取文件内容 |
create_file |
创建新文件 |
update_file |
更新文件内容 |
delete_file |
删除文件 |
list_files |
列出目录下的文件 |
compare |
代码比较 |
仓库管理
| 工具名 | 描述 |
|---|---|
get_repository |
获取仓库详情 |
list_repositories |
列出代码仓库 |
变更请求（Merge Request）
| 工具名 | 描述 |
|---|---|
get_change_request |
获取变更请求详情 |
list_change_requests |
列出变更请求 |
create_change_request |
创建变更请求 |
review_change_request |
评审变更请求（提交 PASS / NOT_PASS 意见） |
merge_change_request |
合并变更请求（ff-only / no-fast-forward / squash / rebase） |
create_change_request_comment |
创建变更请求评论 |
list_change_request_comments |
列出变更请求评论 |
update_change_request_comment |
更新变更请求评论 |
list_change_request_patch_sets |
列出变更请求的补丁集 |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 469 lines · 43 tokens per session scan A 7af7f5fdf3d2
alibabacloud-devops is a skill published in the GitHub repository aliyun/alibabacloud-devops-mcp-server (168 stars, last pushed 5d ago), licensed Apache-2.0. It adds 43 tokens to every session and 4,263 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nx-workspace-patterns
Configure and optimize Nx monorepo workspaces. Use when setting up Nx, configuring project boundaries, optimizing build caching, or implementing affected commands.
bazel-build-optimization
Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.
babysit
Same-session monitoring loop for PRs, CI runs, tickets, and deployments using the monitorstart / monitorupdate / autonudgestop MCP tools. The loop re-injects your check instructions into THIS session on an idle interval — same context, same tools — and works from dashboard chat, Slack threads, and Discord DMs. Use…
add-azuredevops
Adds Azure DevOps connector to a Power Apps code app. Use when querying work items, creating bugs, managing pipelines, or making ADO API calls.
atmos-modernization
Atmos Modernization: migrate deprecated or legacy Atmos patterns to current names, Native CI, Atmos Pro drift detection, dependencies.components, nametemplate, and declared secrets.
gitlab-devops
GitLab DevOps operations — issues, merge requests, CI/CD pipelines, repository browsing, labels, milestones, releases, and wiki management. Use when querying GitLab project status, monitoring pipeline executions, browsing repository files, creating issues for network findings, opening merge requests for config…