What is using-alpacon?

A set of instructions for operating servers through Alpacon's MCP tools. MCP is a way for an AI agent to call external tools; these instructions cover work sessions, server identifiers, approvals, and handling uncertain command results.

Use it to find workspaces and servers, open approved work sessions, run commands or file transfers, request the right permissions, and retry safely when a write's result is unknown.

It prevents common operational mistakes such as using a server name instead of its ID, acting without an active work session, or switching to an unapproved SSH or command-line route.

using-alpacon — Skill for Claude Code by alpacax/alpacon-mcp

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add alpacax/alpacon-mcp --skill using-alpacon

Clone the repo

git clone --depth 1 https://github.com/alpacax/alpacon-mcp

Made for: Claude Code.

Or install alpacon, the plugin that ships this one along with the rest of its 1 skill, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/alpacax/alpacon-mcp/using-alpacon/github.svg)](https://agentmods.dev/skills/alpacax/alpacon-mcp/using-alpacon)

Your own site

<a href="https://agentmods.dev/skills/alpacax/alpacon-mcp/using-alpacon"><img src="https://agentmods.dev/badge/skills/alpacax/alpacon-mcp/using-alpacon/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/alpacax/alpacon-mcp/using-alpacon"><img src="https://agentmods.dev/badge/skills/alpacax/alpacon-mcp/using-alpacon.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 99 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,736 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00099	$0.01736
Opus 5.5	$0.00040	$0.00694
Sonnet 5.5	$0.00020	$0.00347
Haiku 4.5	$0.00010	$0.00174

Measured 2d ago against content hash 18f83c6a7fcf, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

using-alpacon scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

description: Rules for operating servers through the Alpacon MCP tools—server UUIDs, Work Sessions, human-only approvals, sudo and refusal results, MFA, and never resending a write whose outcome is unknown. Use whenever

plugins/alpacon/skills/using-alpacon/SKILL.md · 61 lines

How it starts

The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Using Alpacon

Alpacon is reached only through its MCP tools. Clients name them differently (list_servers may appear behind a prefix such as mcp__alpacon__ or mcp__plugin_alpacon_alpacon__); this skill uses the bare tool names. When a call fails on a read or a connection error, report the exact error, try another Alpacon tool that answers the same question, or ask the person for the missing sign-in or permission. A refusal or a pending_approval result is not such a failure: follow the sections below, and never move the same work to another tool to get past it. Never fall back to the alpacon CLI, ssh, or another shell route.

Find the workspace and server

Call list_workspaces and use a workspace name exactly as it returns it. Pass region (ap1 or us1) only when the same workspace appears in both.
Call list_servers and take the server's id. Every server_id and servers argument is a UUID; a server name is refused before the request is sent. The list is paginated, so follow next when count is larger than the page.

Read every result before the next call

Branch on status, not on prose: success, error, pending_approval, purpose_required, and mfa_required are the common values. For any other value, read message and next_action.
When a result carries next_action, do what it says. requires_human_approval: true means a person decides; approvable_by_agent: false means no tool of yours can.
A command result can say success and still carry sudo_denial or sudo_hint: the sudo inside it did not run. With sudo_denial, a person can resolve it; rerun the command after they act, knowing the whole line runs again. With sudo_hint alone, it is a hard denial: do not wait for it and do not rerun it unchanged.
A refusal carrying rejection_cause, gate, or missing is not cleared by resending it unchanged. Follow its hint: some ask you to fix the call, some to wait for a person's decision or MFA, after which the same call can succeed.

Read the full file on GitHub · 61 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed · +29 lines · +32 tokens per session scan A → B 18f83c6a7fcf
8d ago First seen · 32 lines · 67 tokens per session scan A 114a7f3d78c7

Subscribe to this mod's changes

using-alpacon is a skill published in the GitHub repository alpacax/alpacon-mcp (1 stars, last pushed yesterday), licensed MIT. It adds 99 tokens to every session and 1,736 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-31.

DevOps and cloud Security mcp operations vibe-coding

using-alpacon next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
using-alpaconalpacax/alpacon-mcp	Skill	1	yesterday	MIT	B	99	Claude Code
admin-access-registersickn33/agentic-awesome-skills	Skill	49k	yesterday	MIT	A	49	Claude Code
access-matrixsickn33/agentic-awesome-skills	Skill	49k	yesterday	MIT	A	41	Claude Code
alumni-re-hire-trackersickn33/agentic-awesome-skills	Skill	49k	yesterday	MIT	A	54	Claude Code
moai-workflow-worktreemodu-ai/moai-adk	Skill	1.3k	today	Apache-2.0	A	41	Claude Code
moai-lane-watchdogmodu-ai/moai-adk	Skill	1.3k	today	Apache-2.0	A	86	Claude Code
moai-workflow-thinkingmodu-ai/moai-adk	Skill	1.3k	today	Apache-2.0	A	43	Claude Code

using-alpacon