Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/andyleimc-source/mdymcp/datanpx skills add andyleimc-source/mdymcp --skill datagit clone --depth 1 https://github.com/andyleimc-source/mdymcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00108 | $0.01618 |
| Opus 5 | $0.00054 | $0.00809 |
| Sonnet 5 | $0.00022 | $0.00324 |
| Haiku 4.5 | $0.00011 | $0.00162 |
Grade A, and why
mdymcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
mdymcp 使用指南
Andy 自研包（andyleimc-source/mdymcp，PyPI）。两套独立凭证，分别供两组工具用——这是绝大多数困惑的根源。
两套凭证心智模型
| v1 协作 API | HAP 网关 | |
|---|---|---|
| 凭证 | server 模式：access_token 从腾讯云常驻服务器现取（见下） | MD_HAP_PAT（个人 PAT，pat_ 开头，自助生成） |
| token 函数 | ensure_access_token()（按 MD_V1_TOKEN_MODE 分流：server / local / 旧 hook） |
ensure_hap_token()（直接返回 PAT，无网络） |
| 稳定性 | 稳（服务器单点 refresh-daemon 刷，客户端只读，不抢刷） | 稳（PAT 长期有效、用户自管） |
| 覆盖工具 | 日程 calendar_*、组织 company_*、群组 group_*、动态 post_*、私信 webchat_*、用户 user_*/find_member(注：find_member 走 HAP)、消息 message_*、通行证 passport_* |
应用/工作表/记录/审批/角色：get_app_list、get_worksheet_structure、get_record_list、create_record、update_record、find_member、find_department 等 |
判断某工具走哪套：操作"低代码应用/工作表/记录/审批/成员"= HAP；操作"协作动态/日程/群组/私信"= v1。 拿不准就看报错前缀（[HAP] / [v1]）。
v1 token 怎么来（v0.5.1 默认 server 模式）
Andy 三台 mac 现在都跑 server 模式（.env 里 MD_V1_TOKEN_MODE=server）：
ensure_access_token()→_ensure_server_token()：用受限 SSH key 远程读常驻服务器上的 token 文件，取出access_token。- 服务器：
[email protected]（腾讯云内地）。SSH host/user/key/远程路径配在~/.mdymcp/.env（MD_V1_TOKEN_SSH_HOST/SSH_USER/SSH_KEY/REMOTE_PATH）。 - 客户端不写本地 token 文件、不持有 refresh_token、绝不本地 refresh；取到的 token 只进内存缓存，缓存到当地午夜。
- 真正的刷新由服务器上的 refresh-daemon 单点负责。
- 为什么：明道 oauth2 每次 refresh 都轮换 refresh_token，多个端各自本地刷会互相把对方顶成孤儿 → token 失效。集中到服务器单点刷、客户端只读，才稳。
- 配置/重配：
mdymcp-server-setup。
另两条只是回落路径，正常用不到：
MD_V1_TOKEN_MODE=local：mdymcp-auth浏览器授权 → 本地~/.mdymcp/v1_token.json，本地 refresh（access ~7 天、refresh 14 天滚动）。多端共用同一账号时不要用（会抢刷）。- 旧 hook（
MD_ACCOUNT_ID+MD_KEY）：未迁移机器的远端 hook 换 token，迁完即弃。
故障 SOP
报 [HAP] / 600100 / "token无效或过期" / "PAT 已失效" = HAP 的 MD_HAP_PAT 失效或缺失。
- 去 https://www.mingdao.com/personal?type=pat 重新生成 PAT（已登录直接生成；未登录先登录会自动跳回）。
- 把新
pat_xxx更新到.env的MD_HAP_PAT，或重跑mdymcp-install。 - 不再有"自愈/register"——PAT 由用户自管，没有自动续期这一步。
报 [v1]（server 模式）= 取不到服务器上的 token：
server 模式取 token 失败（SSH 连不上 …）→ 腾讯云101.43.4.46不通 / SSH key 失效，先ssh [email protected]验连通；连不上查服务器和受限 key。server 模式缺配置/SSH key 不存在→~/.mdymcp/.env缺MD_V1_TOKEN_*，跑mdymcp-server-setup重配。服务器 token 文件里没有 access_token→ 服务器上的 refresh-daemon 挂了，登服务器查 daemon（见仓库server/与handoff-mdymcp-server-refresh.md）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 67 lines · 108 tokens per session scan A 694d9839434d
mdymcp is a skill published in the GitHub repository andyleimc-source/mdymcp (5 stars, last pushed 2mo ago), licensed MIT. It adds 108 tokens to every session and 1,618 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…