What is ossa-agent-authoring?

A toolset and guide for creating, checking, and publishing OSSA agent manifests. An OSSA manifest is a standard file describing an AI agent and how it can be used.

It validates manifests, creates starter agent directories, generates agent-card.json files, and publishes manifests to a registry when configured.

It helps ensure agent descriptions follow the required format before they are shared or published.

ossa-agent-authoring — Skill for Claude Code and Codex by blueflyio

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add blueflyio/openstandardagents --skill ossa-agent-authoring

Clone the repo

git clone --depth 1 https://github.com/blueflyio/openstandardagents

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/blueflyio/openstandardagents/ossa-agent-authoring.svg)](https://agentmods.dev/skills/blueflyio/openstandardagents/ossa-agent-authoring)

Your own site

<a href="https://agentmods.dev/skills/blueflyio/openstandardagents/ossa-agent-authoring"><img src="https://agentmods.dev/badge/skills/blueflyio/openstandardagents/ossa-agent-authoring.svg" alt="Measured on agentmods" height="20"></a>

Per session 73 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 546 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00073	$0.00546
Opus 5	$0.00036	$0.00273
Sonnet 5	$0.00015	$0.00109
Haiku 4.5	$0.00007	$0.00055

Measured 8d ago against content hash 4ace6673b888, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

ossa-agent-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

examples/agent-skills/ossa-agent-authoring/SKILL.md · 63 lines

What it actually says

OSSA Agent Authoring

Overview

Guidelines for authoring and validating OSSA agent manifests. Use the OSSA MCP server tools when available; otherwise use the OSSA CLI.

When to Apply

Creating or editing manifest.ossa.yaml or OSSA JSON manifests
Validating manifests against the OSSA schema
Scaffolding a new agent directory and manifest
Generating .well-known/agent-card.json from a manifest
Publishing an OSSA agent to a registry (agentregistry/arctl)

MCP Tools (OSSA MCP server)

When the OSSA MCP server is attached (e.g. ossa-mcp in Cursor/Claude), use:

Tool	Purpose
`ossa_validate`	Validate a manifest file; returns errors and warnings
`ossa_scaffold`	Create a new agent directory and default manifest
`ossa_generate`	Generate agent-card JSON from a manifest
`ossa_publish`	Publish to registry (or get instructions if not configured)

CLI Fallback

From the project root or a path with manifests:

# Validate
npx @bluefly/openstandardagents validate <path-to-manifest>

# Scaffold
npx @bluefly/openstandardagents scaffold [name] -o .agents --with-prompts --with-tools

# Agent card
npx @bluefly/openstandardagents agent-card <path-to-manifest>

Manifest Minimum

A valid OSSA v0.4 manifest must have:

apiVersion (e.g. ossa/v0.4)
kind: Agent
metadata.name (DNS-1123)
spec.role or spec.prompts.system.template

Governance

Use schema version matching the manifest apiVersion when validating.
For platform-specific validation (kagent, langchain, etc.), use the CLI --platform flag or the MCP ossa_validate platform argument when supported.

Publish Path

To publish to agentregistry: use arctl publish when installed and configured, or POST the manifest and agent-card to the registry API. The ossa_publish MCP tool returns next steps when the registry is not configured.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 63 lines · 73 tokens per session scan A 4ace6673b888

Subscribe to this mod's changes

ossa-agent-authoring is a skill published in the GitHub repository blueflyio/openstandardagents (5 stars, last pushed 20d ago), licensed Apache-2.0. It adds 73 tokens to every session and 546 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Building agents agents ai mcp openapi

api-design

API contract design for REST and GraphQL, covering resource shape, URL and header versioning with deprecation windows, RFC 9457 Problem Details error handling, and OpenAPI specs. Use when specifying the wire contract an endpoint exposes, choosing a versioning scheme, or standardizing error response bodies across…

yonatangross/orchestkit · 76 tokens

documentation-patterns

Technical documentation patterns for READMEs, ADRs, API docs (OpenAPI 3.1), changelogs, and writing style guides. Use when creating project documentation, writing architecture decisions, documenting APIs, or maintaining changelogs.

yonatangross/orchestkit · 53 tokens

installing-caplets

Use when a user wants to install, set up, bootstrap, configure, wire, or troubleshoot Caplets for an agent, MCP client, Pi, OpenCode, Codex, Claude Code, self-hosted remote runtime, or local daemon-first setup.

spiritledsoftware/caplets · 56 tokens

writing-caplets

Use when creating, updating, reviewing, or validating Caplet files in any project or user environment, including Caplet manifests, agent-facing Caplet bodies, setup/auth metadata, Project Binding declarations, Vault references, runtime requirements, Caplet sets, or install-ready Caplets for private or public use.

spiritledsoftware/caplets · 64 tokens

caplets

Always use when the user asks to use a capability that may not appear in your visible toolset, or when accessing configured backend capabilities through Caplets, including APIs, CLIs, resources, prompts, backend operations, capability handles, tool schemas, or compact Code Mode CLI results.

spiritledsoftware/caplets · 59 tokens

aomi-build

Scaffold new Aomi apps and plugins from API docs, OpenAPI/Swagger specs, or SDK references. aomi-build generates production-ready Rust SDK crates (lib.rs, client.rs, tool.rs) with tool schemas, preambles, host-interop flows, and validation — turning a vendor's API surface into AI-agent-callable tools. It covers the…

aomi-labs/skills · 244 tokens