Apache Magpie is a framework of agent-assisted workflows for maintaining Apache software projects, including issue triage, pull-request review, contributor mentoring, and security-report handling. Apache maintainers and developers use it to delegate repetitive project work to coding agents while retaining human review. Its catalogue entries are the skills, instructions, plugin, and settings that implement these workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add apache/magpie --skill setup-isolated-setup-doctorgit clone --depth 1 https://github.com/apache/magpieWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apache/magpie/setup-isolated-setup-doctor)<a href="https://agentmods.dev/skills/apache/magpie/setup-isolated-setup-doctor"><img src="https://agentmods.dev/badge/skills/apache/magpie/setup-isolated-setup-doctor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.03230 |
| Opus 5 | $0.00046 | $0.01615 |
| Sonnet 5 | $0.00018 | $0.00646 |
| Haiku 4.5 | $0.00009 | $0.00323 |
Grade A, and why
magpie-setup-isolated-setup-doctor scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
import socket, urllib.request, threading, http.server, sys How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
setup-isolated-setup-doctor
Runtime routing (run before the Claude-specific probes)
When the active harness is Codex, first require the static verification in
docs/adapters/codex.md, then run the
shared live environment probes inside the active Codex sandbox. Attribute
failures separately to native sandbox/network denial, approval policy, or
the POSIX agent-iso layer. Do not prescribe a .claude settings change for
a Codex failure. Then stop before the Claude-specific branch below.
When the harness is Claude Code, continue below. If the harness cannot be determined, ask once.
The diagnostic layer over the secure agent setup. Complements the existing setup skills:
setup-isolated-setup-installinstalls the secure setup.setup-isolated-setup-verifyanswers "is the secure setup installed correctly?" — static checks on settings.json shape, hook wiring, pinned tool versions. Catches drift and missing pieces.setup-isolated-setup-updatesurfaces drift against the framework's latest.setup-isolated-setup-doctor(this skill) answers "are common workflows functionally blocked by the current sandbox?" — live probes of SSH agent, port binding, docker / podman socket. Catches over-restrictive allowlists.
Run verify first when the install is in question (fresh
machine, recent framework upgrade, sandbox-state surprise). Run
doctor when the install is known good but a workflow fails in
a sandbox-shaped way — agent unreachable, socket error, port
permission error.
Every probe maps to a numbered entry in
docs/setup/sandbox-troubleshooting.md;
the doctor's job is to identify which entry applies right now,
not to re-explain the remediation. If a fail surfaces a failure
mode not catalogued there, propose appending a new entry per the
catalog's Adding a new entry section.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 293 lines · 92 tokens per session scan A b0a72212990e
magpie-setup-isolated-setup-doctor is a skill published in the GitHub repository apache/magpie (87 stars, last pushed 5d ago), licensed Apache-2.0. It adds 92 tokens to every session and 3,230 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
atmos-helmfile
Helmfile orchestration: sync/apply/destroy/diff, Kubernetes deployments, varfile generation, EKS integration, source management.
atmos-devcontainer
Devcontainer orchestration: start/stop/attach/shell/exec/rebuild, instance management, config handling, VS Code integration.
atmos-container
Atmos container components: components.container, Docker Compose migration, build/run/push/pull/up/down/list/ps/logs/exec, stack-scoped persistent containers, container workflow steps, compositions, and hooks.
atmos-emulator
Atmos emulator components: local AWS/GCP/Azure/Kubernetes/Vault/OpenBao/registry emulators, components.emulator, !emulator, identities, persistence, health checks, and emulator commands.
detecting-cryptomining-in-cloud
This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring…
securing-kubernetes-on-cloud
This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workload identity, RBAC scoping, image admission controls, and runtime security monitoring. It addresses cloud-specific security features including IRSA for EKS, Workload Identity for…