Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bablsoft/accessflow/add-enginenpx skills add bablsoft/accessflow --skill add-enginegit clone --depth 1 https://github.com/bablsoft/accessflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00110 | $0.02324 |
| Opus 5 | $0.00055 | $0.01162 |
| Sonnet 5 | $0.00022 | $0.00465 |
| Haiku 4.5 | $0.00011 | $0.00232 |
Grade A, and why
add-engine scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
add-engine
Adding an engine is ~12 areas of wiring, most of it outside engines/. The plugin itself is the
easy half; the half that gets forgotten is DbType → migration → credential gates → i18n ×7 →
frontend → docs → website → CI matrix.
Read first, in order: docs/15-engine-sdk.md (authoritative —
the SPI surface, QueryEngineContext semantics, and the checklist at its end),
.claude/patterns/engine-plugin.md, and
.claude/patterns/engine-fanout.md.
Inputs
Ask for anything not supplied — do not guess:
- engine id (lowercase; it is simultaneously the folder name, the connector id, and the
engineId()return value — all automation derives from it) - display name, vendor, documentation URL
DbTypevalue (SCREAMING_SNAKE) andcategory—WAREHOUSE|DOCUMENT|KEY_VALUE|WIDE_COLUMN|SEARCH|GRAPH- driver coordinates, or "REST API, no driver" (the
engines/databricks/shape) - default port and default SSL mode
- connection model — host/port/db/user/pass, or cloud credentials (region + keys, service account JSON, workspace host + token)
- a Testcontainers image, or "none" (the Snowflake precedent: unit + mocked-facade tests only)
Pick the closest existing engine and follow it
| Shape | Follow |
|---|---|
| SQL dialect over JDBC | engines/snowflake/ |
| SQL dialect over REST, no vendor driver at all | engines/databricks/ |
| Cloud credentials instead of host/port | engines/dynamodb/ |
| Document | engines/mongodb/ |
| Key-value | engines/redis/ |
| Graph | engines/neo4j/ |
Workflow
1. Build the host jar the plugin compiles against
mvn -f backend/pom.xml install -DskipTests
2. Scaffold engines/<id>/pom.xml
Non-negotiables (copy from the reference engine): its own <version> starting at 1.0.0;
maven.compiler.release 25; a fixed project.build.outputTimestamp; accessflow and slf4j-api
at provided scope; shade with shadedArtifactAttached=true, classifier all, and every
third-party library except the vendor driver relocated under
com.bablsoft.accessflow.engine.<id>.shaded.*; surefire + failsafe wired.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 178 lines · 110 tokens per session scan A a44ba32b159c
add-engine is a skill published in the GitHub repository bablsoft/accessflow (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 110 tokens to every session and 2,324 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
wire-capability-probe
Establish what a provider wire can and cannot carry, and fix the gateway when the answer is "we send the wrong form". Use when an upstream refuses a request (4xx/422 naming a content type, a field, a modality, a URL form), when a catalog capability is about to be written from a refusal, or when a codec translation is…
datadog-inspector-expert
Interpret datadog-inspector findings and translate Datadog monitoring, audit, log-retention, SSO, and RBAC results into GRC evidence and remediation.
splunk-inspector-expert
Interpret splunk-inspector findings and translate Splunk retention, RBAC, audit, search ACL, and auth posture into compliance evidence and remediation.
cross-domain-translator
Translates adjacent-domain patterns into GRC learning frames. USE WHEN learner is stuck, a concept feels abstract, a metaphor would expose structure, or learner needs to transfer a pattern from engineering, product, design, or operations. NOT FOR direct concept teaching when plain explanation is enough; use…
linmas-threat-research-analyst
Threat research skill for IOC analysis, adversary tracking, campaign reporting, and intelligence-to-detection translation.
connect_polaris_catalog
Guides the agent to ask the user for their preferred authentication mode and credentials when they request to connect to the Polaris catalog, rather than using default credentials.