Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aliyun/alibabacloud-devops-mcp-server --skill alibabacloud-devopsgit clone --depth 1 https://github.com/aliyun/alibabacloud-devops-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops)<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-devops-mcp-server/alibabacloud-devops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 33 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 19 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 24 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 47 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 415 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 418 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 421 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 424 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 433 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 436 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 439 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 442 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 451 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 454 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 457 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 460 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 19 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.04338 |
| Opus 5.5 | $0.00017 | $0.01735 |
| Sonnet 5.5 | $0.00009 | $0.00868 |
| Haiku 4.5 | $0.00004 | $0.00434 |
Grade A, and why
alibabacloud-devops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 473 lines — stays where its author put it; the contents beside it link to each section on GitHub.
阿里云云效 DevOps MCP Server
这是阿里云云效 DevOps 平台的 MCP Server Skill，提供全面的 DevOps 工具集，包括代码管理、项目管理、流水线管理、应用交付、制品管理和测试管理等能力。
渐进式披露模式
本 Skill 采用渐进式披露模式，按需获取工具详情和调用工具。
查看工具列表和参数
获取所有工具及其详细参数信息：
npx -y mcporter list --stdio "npx -y alibabacloud-devops-mcp-server" --schema
如果已配置服务器，也可以直接使用：
npx -y mcporter list yunxiao --schema
调用工具
使用 key:value 或 key=value 格式传递参数：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" <tool_name> param1:"value1" param2:"value2"
示例：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" list_repositories organizationId:"your-org-id"
环境变量配置
MCP Server 需要配置以下环境变量：
YUNXIAO_ACCESS_TOKEN: 云效访问令牌（必需）
可通过 --env 参数传递：
npx -y mcporter call --stdio "npx -y alibabacloud-devops-mcp-server" --env YUNXIAO_ACCESS_TOKEN=your-token <tool_name> ...
工具列表
共 203 个工具，按功能分类如下：
基础工具（Base）
| 工具名 | 描述 |
|---|---|
get_current_organization_info |
获取当前用户和组织信息（基于 token） |
get_user_organizations |
获取当前用户所属的组织列表 |
get_current_user |
获取当前用户信息（基于 token） |
代码管理（Code Management）
分支管理
| 工具名 | 描述 |
|---|---|
create_branch |
创建代码仓库分支 |
get_branch |
获取分支信息 |
delete_branch |
删除分支 |
list_branches |
列出仓库所有分支 |
文件操作
| 工具名 | 描述 |
|---|---|
get_file_blobs |
获取文件内容 |
create_file |
创建新文件 |
update_file |
更新文件内容 |
delete_file |
删除文件 |
list_files |
列出目录下的文件 |
compare |
代码比较 |
仓库管理
| 工具名 | 描述 |
|---|---|
get_repository |
获取仓库详情 |
list_repositories |
列出代码仓库 |
变更请求（Merge Request）
| 工具名 | 描述 |
|---|---|
get_change_request |
获取变更请求详情 |
list_change_requests |
列出变更请求 |
create_change_request |
创建变更请求 |
update_change_request |
更新变更请求标题或描述 |
review_change_request |
评审变更请求（提交 PASS / NOT_PASS 意见） |
merge_change_request |
合并变更请求（ff-only / no-fast-forward / squash / rebase） |
create_change_request_comment |
创建变更请求评论 |
list_change_request_comments |
列出变更请求评论 |
update_change_request_comment |
更新变更请求评论 |
list_change_request_patch_sets |
列出变更请求的补丁集 |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed 8ac0d2d1efa2
- 1mo ago Changed · +4 lines 7fa4153995fc
- 1mo ago First seen · 469 lines · 43 tokens per session scan A 7af7f5fdf3d2
alibabacloud-devops is a skill published in the GitHub repository aliyun/alibabacloud-devops-mcp-server (178 stars, last pushed 3d ago), licensed Apache-2.0. It adds 43 tokens to every session and 4,338 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bazel-build-optimization
Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.
nx-workspace-patterns
Configure and optimize Nx monorepo workspaces. Use when setting up Nx, configuring project boundaries, optimizing build caching, or implementing affected commands.
babysit
Use when a user asks to babysit, monitor, keep checking, keep an eye on, or report when a pull request, CI run, ticket, deployment, or other changing target reaches an outcome.
add-azuredevops
Adds Azure DevOps connector to a Power Apps code app. Use when querying work items, creating bugs, managing pipelines, or making ADO API calls.
atmos-modernization
Atmos Modernization: migrate deprecated or legacy Atmos patterns to current names, Native CI, Atmos Pro drift detection, dependencies.components, nametemplate, and declared secrets.
factory
Experimental workflow for configuring an autonomous software delivery factory. Use when choosing feedback sources, schedules, worktree behavior, autonomy gates, or host automations.