A guide for using Bloom tools that read and edit code on canvas pages. It explains how to identify the right project, branch, page, and code frame before making changes.

Use it when working with Bloom projects to inspect, search, write, edit, or delete code frames, or to start codebase work through an agent.

It prevents edits from being sent to the wrong canvas or failing because the target page was not selected.

bloom-mcp — Skill for Claude Code by BloomLabsInc/agent-skills

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add BloomLabsInc/agent-skills --skill bloom-mcp

Clone the repo

git clone --depth 1 https://github.com/BloomLabsInc/agent-skills

Made for: Claude Code.

Or install bloom-agent-skills, the plugin that ships this one along with the rest of its 3 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/bloomlabsinc/agent-skills/bloom-mcp/github.svg)](https://agentmods.dev/skills/bloomlabsinc/agent-skills/bloom-mcp)

Your own site

<a href="https://agentmods.dev/skills/bloomlabsinc/agent-skills/bloom-mcp"><img src="https://agentmods.dev/badge/skills/bloomlabsinc/agent-skills/bloom-mcp/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/bloomlabsinc/agent-skills/bloom-mcp"><img src="https://agentmods.dev/badge/skills/bloomlabsinc/agent-skills/bloom-mcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 708 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00055	$0.00708
Opus 5.5	$0.00022	$0.00283
Sonnet 5.5	$0.00011	$0.00142
Haiku 4.5	$0.00006	$0.00071

Measured 2mo ago against content hash 7be1f9ce73e2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bloom-mcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/bloom-mcp/SKILL.md · 42 lines

How it starts

The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Using the Bloom MCP

The Bloom MCP has one governing idea: frames, not files. The file-shaped tools (write_files, edit_files, read_files, delete_files) operate on canvas frames — React TSX at @bloom-frame/<uuid> — not on your repo and not on the app's sandbox source. Get this wrong and you'll write to the wrong place or have a call rejected.

Full tool catalog (generated from the API): references/tools.md.

Orient before you touch anything

Run these in order; each must return before the next:

whoami → confirms the token and what it can reach (accessibleProjectCount).
list_projects → pick projectId.
list_branches → pick branchId (note isMain).
list_canvas_pages → pick canvasPageId. Required when a branch has more than one page — otherwise calls fail with MCP_PAGE_AMBIGUOUS.

Completion criterion: you hold a concrete { projectId, branchId, canvasPageId } from live calls — never invented IDs.

Frames, not files — the rules that keep you out of the ditch

Frame paths are @bloom-frame/<uuid>. To create one, write a @bloom-frame/_new_<localName> placeholder; the result echoes a placeholderMintingMap giving you the real UUID. Use that UUID from then on.
@/<path> is the app's sandbox, not your editor's repo. Reading it is fine (read_files); writing a sandbox path is rejected (MCP_SANDBOX_PATH_REJECTED).
kind: artboard (default) vs canvasComponent (importable from other frames). Set it on create; on overwrite it's ignored — promote later with edit_files.
edit_files needs the current content — read_files the frame first, then edit against what's actually there.

Frames vs. the agent — pick the right tool for the change

Editing what's on the canvas (a design, a mockup, a plan frame) → write_files / edit_files. This is direct and immediate.
Full-stack or codebase work (routes, backend, sandbox source, multi-file features) → trigger_agent on a branch. Don't try to hand-edit sandbox source through the canvas tools — you can't (@/ writes are rejected), and the agent is the right instrument.

Read the full file on GitHub · 42 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/tools.md 4.5 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 42 lines · 55 tokens per session scan A 7be1f9ce73e2

Subscribe to this mod's changes

bloom-mcp is a skill published in the GitHub repository BloomLabsInc/agent-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 708 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents

bloom-mcp next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
bloom-mcpBloomLabsInc/agent-skills	Skill	2	1mo ago	MIT	A	55	Claude Code
imagegenopenai/codex	Skill	134k	today	Apache-2.0	A	113	Codex
local-ai-agentsmicrosoft/ai-agents-for-beginners	Skill	79k	today	MIT	A	200	Claude Code, Codex
playwright-climicrosoft/playwright	Skill	99k	today	Apache-2.0	A	19	Claude Code
systematic-debuggingobra/superpowers	Skill	314k	4d ago	MIT	A	21	Claude Code
next-cache-components-adoptionvercel/next.js	Skill	143k	today	MIT	A	95	Claude Code
chat-pet-sprite-creationmicrosoft/vscode	Skill	195k	today	MIT	A	53	Claude Code, Codex