Borrowing it
Nothing to install: this file belongs to avdiam/mcp-agent-hub. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/avdiam/mcp-agent-hub/master/.claude/skills/verify/SKILL.mdgit clone --depth 1 https://github.com/avdiam/mcp-agent-hubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/avdiam/mcp-agent-hub/verify)<a href="https://agentmods.dev/skills/avdiam/mcp-agent-hub/verify"><img src="https://agentmods.dev/badge/skills/avdiam/mcp-agent-hub/verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/avdiam/mcp-agent-hub/verify"><img src="https://agentmods.dev/badge/skills/avdiam/mcp-agent-hub/verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00736 |
| Opus 5.5 | $0.00014 | $0.00294 |
| Sonnet 5.5 | $0.00007 | $0.00147 |
| Haiku 4.5 | $0.00003 | $0.00074 |
Grade A, and why
verify scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **SSE stream**: `curl -sN --max-time 30 http://127.0.0.1:8001/api/events` → expect one How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Verifying MCP Agent Hub changes
The hub is a FastAPI + FastMCP server (mcp_hub/hub.py) with a browser dashboard at /,
REST under /api/*, and the MCP endpoint at /mcp. hub.db is CWD-relative (D27), so
verify against a scratch instance launched from a throwaway directory — never against the
repo root unless you intend to touch the real DB.
Launch a scratch instance (port 8001, isolated DB)
# from any scratch dir (its hub.db lands there):
& <repo>\venv\Scripts\python.exe -m uvicorn --app-dir <repo> mcp_hub.hub:app --host 127.0.0.1 --port 8001
Ready when GET http://127.0.0.1:8001/api/state returns 200. The venv is venv\ at repo
root (not .venv). The real deployment uses python run_hub.py (supervisor, port 8000) —
check nothing is already on :8000 before assuming the field is clear.
Drive the real surfaces
- MCP tools (through the middleware, real streamable-HTTP):
from fastmcp import Client async with Client('http://127.0.0.1:8001/mcp') as c: await c.call_tool('register_agent', {'agent_id': 'probe', 'skills': []}) - SSE stream:
curl -sN --max-time 30 http://127.0.0.1:8001/api/events→ expect onedata:snapshot immediately, a new one after any mutation,: keepalivecomments when idle (20 s). - REST mutations:
POST /api/broadcast({"payload": "..."}) is the easiest state-change trigger; hostile-origin probes (-H "Origin: http://evil.com"or a badHost:) must 403 on/mcpand/api/*. - Dashboard: open
http://localhost:8001/via claude-in-chrome; confirm panels update live (Refresh = "Live") with only two/api/requests in the network log (/api/statefirst paint + the/api/eventsstream). Mutate via MCP/REST and screenshot — panels must change without a reload.
Gotchas
- httpx
ASGITransport(used bytests/test_mcp.py) buffers whole bodies — it can never consume/api/events; the SSE tests use a real uvicorn on an ephemeral port (live_serverfixture) for this reason. Don't "simplify" them back. - Module-global asyncio primitives (
hub.notifier) bind to the first event loop that uses them; tests get a fresh one per test via the autouse fixture. - PowerShell backgrounds long
pytest/uvicorninvocations; pipe throughSelect-Object -Last Nshows nothing until the process exits — a silent run may be a hung SSE consumer, not a slow suite.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 53 lines · 34 tokens per session scan A 76cf92f72f76
verify is a skill published in the GitHub repository avdiam/mcp-agent-hub (0 stars, last pushed 3mo ago), licensed MIT. It adds 34 tokens to every session and 736 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
foundry-hosted-agent-validation
Step-by-step process for validating a Python Foundry hosted agent sample (under python/samples/04-hosting/foundry-hosted-agents/) end to end — running it locally (native runtime and azd ai agent run) and after deploying it to an Azure AI Foundry project with azd. Use this when asked to validate a hosted agent sample.
verify-samples-tool
How to use the verify-samples tool to run, verify, and manage sample definitions in the Agent Framework repository. Use this when adding, updating, or running sample verification.
build-and-test
How to build and test .NET projects in the Agent Framework repository. Use this when verifying or testing changes.
verify-dotnet-samples
How to build, run and verify the .NET sample projects in the Agent Framework repository. Use this when a user wants to verify that the samples still function as expected.
regex-tester
Validate, test, and debug regular expressions by executing them against sample inputs. Use when asked to build, verify, or explain a regex pattern.
verify-omnigent
Drive Omnigent the way a user does and prove a behavior with recorded evidence, using an isolated server, runner, and mock model plus a feature map of every user entry point. Load before reproducing a user-facing bug, before claiming a fix works, or when reviewing whether a change covered every surface (session vs.…