Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aoreshkov/oracle-forms-mcp --skill trace-formgit clone --depth 1 https://github.com/aoreshkov/oracle-forms-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aoreshkov/oracle-forms-mcp/trace-form)<a href="https://agentmods.dev/skills/aoreshkov/oracle-forms-mcp/trace-form"><img src="https://agentmods.dev/badge/skills/aoreshkov/oracle-forms-mcp/trace-form/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aoreshkov/oracle-forms-mcp/trace-form"><img src="https://agentmods.dev/badge/skills/aoreshkov/oracle-forms-mcp/trace-form.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.03829 |
| Opus 5.5 | $0.00032 | $0.01532 |
| Sonnet 5.5 | $0.00016 | $0.00766 |
| Haiku 4.5 | $0.00008 | $0.00383 |
Grade A, and why
trace-form scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Trace a Forms interaction
Tracing a Forms application is following one value across objects that hide where they are defined.
The oracle-forms MCP server answers every step of that; this is the order to ask in, and the five
places where a naive reading is not merely incomplete but wrong.
Tool names below are the plain ones. Through this plugin they are namespaced —
mcp__plugin_oracle-forms_oracle-forms__get_block — which is the form to use in permission rules,
a subagent's tools list, or a hook matcher.
Read through the tools, not the files
The converted XML and the extracted PL/SQL live in a cache the server owns and fingerprints against
the .fmb. Opening those files directly — grep, sed, a directory walk — reads text that may
describe a form that is no longer the one being served; that drift is exactly what a STALE status
reports. The paths in a result are cache-relative by design, so they are not host paths you could
open anyway.
A STALE row's staleReason says which kind of drift it is: SOURCE_CHANGED (the .fmb moved on)
or INDEX_OUTDATED (an older build of the server indexed it — its answers can be wrong in ways
that read as plausible, such as an inherited trigger reported empty). Both are healed by
fetch_module; the second re-parses the converted file and runs no conversion. After upgrading the
server, list_modules(status="stale") is the one call worth making before trusting a warm cache.
Every reflex has a call:
| Reflex | Call instead |
|---|---|
ls/find the forms directory |
list_modules with pattern, type, status (filtered and paged) |
grep a module for an item, prompt or property |
get_block (verbosity: "detailed" for data type, column, canvas, LOV and the DML properties) |
grep across the whole directory |
search_modules (every fetched module at once) |
grep one attribute across a block |
search_source with scope: "xml" — one call, with line numbers |
sed -n '320,340p' on the XML |
get_object_xml for one named object, read_source for a line range |
| open the sidecar a hit named | read_source with the hit's uri |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago Changed · +69 lines 8d4f3306d05a
- 29d ago Changed · +3 lines bedf76f5999a
- 1mo ago Changed · +18 lines ab2961cfa7b3
- 1mo ago Changed · +6 lines 4633f49a1f1a
- 1mo ago First seen · 134 lines · 81 tokens per session scan A 8c05b5fd2d0a
trace-form is a skill published in the GitHub repository aoreshkov/oracle-forms-mcp (4 stars, last pushed today), licensed Apache-2.0. It adds 81 tokens to every session and 3,829 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-12.
Other skills, from other repositories
xcodebuildmcp-cli
Official skill for the XcodeBuildMCP CLI. Use when doing iOS/macOS/watchOS/tvOS/visionOS work (build, test, run, debug, log, UI automation).
opik-diagnose
Surface the Opik traces worth a developer's attention, ranked by signal — Diagnostics issues first, then errors, failed tool calls, latency, regressions, and low online-eval scores. With the Opik MCP connected it lists the project's agentinsightsissue entities, offers to turn Diagnostics on when the project has it…
opik-explain
Root-cause a specific Opik trace, or a pattern across traces, and return a grounded explanation. Uses the hosted Opik MCP when it is connected, and falls back to SDK scripting otherwise. Returns the root cause, the evidence spans as clickable Opik UI links, and one suggested next step. Use for "why did this trace…
Multi-Language Project Analysis with PMAT
Analyzes polyglot codebases with multiple programming languages using PMAT (Pragmatic AI Labs MCP Agent Toolkit). Use this skill when: Working with projects containing multiple programming languages Assessing cross-language integration patterns and quality Understanding language distribution and architectural…
triage
Diagnose and fix broken MCP servers in mcptoon — doctor, health, per-server probes, and the common failure playbook.
maintenance
Investigate, adopt, and verify dependency updates. Captures what changed, understands why, cross-references against the codebase, and runs final checks. Supports two entry modes: run the full flow end-to-end, or review updates you already applied.