Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/bmob/agent-skillsnpx agentmods add skills/bmob/agent-skills/bmob-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bmob/agent-skills/bmob-mcp)<a href="https://agentmods.dev/skills/bmob/agent-skills/bmob-mcp"><img src="https://agentmods.dev/badge/skills/bmob/agent-skills/bmob-mcp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bmob/agent-skills/bmob-mcp"><img src="https://agentmods.dev/badge/skills/bmob/agent-skills/bmob-mcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00310 | $0.05800 |
| Opus 5 | $0.00155 | $0.02900 |
| Sonnet 5 | $0.00062 | $0.01160 |
| Haiku 4.5 | $0.00031 | $0.00580 |
Grade C, and why
bmob-mcp scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
"filePath": { "type": "string", "description": "本地文件路径，用于生成 curl --data-binary @路径。远程 MCP 读不到磁盘。" } Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- [ ] **配置文件不入 git**：`.cursor/mcp.json` / `.mcp.json` / `~/.codex/config.toml` 若含真实 Key，必须在 `.gitignore` 排除。 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: "Use when the user has the Bmob MCP server configured (http://mcp.bmobapp.com/mcp) and wants to perform LIVE operations against their Bmob backend cloud project from the IDE. Triggers: 'list bmob tables', 's How it starts
The opening of the file, as written. The whole thing — 443 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bmob MCP Server
Bmob 官方托管的 MCP 服务器，端点 http://mcp.bmobapp.com/mcp，传输是 MCP 2024-11-05 的 HTTP+SSE。通过 X-Bmob-Application-Id + X-Bmob-REST-API-Key 两个 HTTP 头部鉴权，agent 配置好后即可在 IDE 内对你的真实 Bmob 项目进行增删改查、设计 schema、生成 curl 样板。
操作级路由：MCP 工具 vs
generate_codevs SDK/REST 的对照表见shared/operation-routing.md。
工具数量：tools/list返回 12 个；agent 调用 11 个（不含内部工具mcp_endpoint_mcp_post）。
HTTP 明文警告：当前 MCP 端点是 HTTP（非 HTTPS）。仅建议在本机开发环境使用；请勿把含真实 Key 的
.cursor/mcp.json/.mcp.json提交进公开 git 仓库。
何时用 MCP vs 何时用 SDK skill
| 场景 | 走 MCP | 走 SDK skill |
|---|---|---|
| 想知道项目里有哪些表、字段是什么类型 | ✅ get_project_tables |
— |
| 设计新表 / 增字段 / 改 schema | ✅ create_table |
— |
| 在 IDE 里测试增删改查（开发期手工触发） | ✅ add_single_data / update_single_data / delete_single_data |
— |
| 上传 / 部署云函数源码并验证 | ✅ deploy_cloud_function；单独执行 → invoke_cloud_function |
— |
| 同步 / 拉取线上云函数到本地 | ✅ list_cloud_functions → get_cloud_function（agent 写本地文件） |
— |
执行 / 试跑云函数（REST POST /1/functions/<name>） |
✅ invoke_cloud_function；生成 curl → generate_code（调用云函数） |
— |
| 一键部署网站 / 静态托管（单页 HTML 或 dist.zip 到 CDN） | ✅ deploy_static_site 或 generate_code（部署静态站点单页 / 部署静态站点dist） |
— |
| 想要任意语言的 curl 样板（备份、迁移脚本） | ✅ generate_code |
— |
| 写到 app 里要发布的代码（生产代码） | — | ✅ bmob-database-{javascript,android,ios,swift,flutter,restful} |
| 配 ACL / 权限规则 | — | ✅ bmob-acl-and-roles |
| 写运行在 Bmob 服务器上的云函数 | — | ✅ bmob-cloud-function-development |
安装
把以下任一片段复制到对应工具的 MCP 配置文件，详细见 shared/mcp-install-snippets.md：
{
"mcpServers": {
"bmob": {
"url": "http://mcp.bmobapp.com/mcp",
"headers": {
"X-Bmob-Application-Id": "<your-application-id>",
"X-Bmob-REST-API-Key": "<your-rest-api-key>"
}
}
}
}
凭证位置：Bmob 控制台 → 你的应用 → 设置 / 应用密钥。
强制工作流
任何写操作前必须先调用 get_project_tables 拿到当前项目的真实表结构，禁止凭推测生成字段名 / 类型。这是因为：
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +3 lines scan B → C 76dac4d486b3
- 10d ago First seen · 440 lines · 310 tokens per session scan B e77c45bd0f0a
bmob-mcp is a skill published in the GitHub repository bmob/agent-skills (3 stars, last pushed 3d ago), licensed MIT. It adds 310 tokens to every session and 5,800 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it C with 3 findings (sends data to an external url, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sf-schema
Scaffold custom objects, fields, validation rules, permission sets, and other schema metadata as SFDX source XML. Use when asked to create objects, custom fields, permission sets, validation rules, or generate metadata XML. Activate on mentions of "custom object", "custom field", "permission set", "validation rule"…
sf-soql
Build and optimize SOQL queries including relationship queries, aggregate functions, polymorphic TYPEOF, and selective filters. Use when asked to write queries, debug slow queries, optimize existing SOQL, or enforce query security. Activate on mentions of "SOQL", "query", "SELECT", "WHERE", "aggregate", "relationship…
butterbase
AI-native, open-source backend-as-a-service with a built-in Model Context Protocol server. Postgres, auth, storage, functions, AI gateway.
supabase-node
Express/Hono with Supabase and Drizzle ORM.
nodejs-backend
Node.js backend patterns with Express/Fastify, repositories.
django-patterns
Django architecture patterns, REST API design with DRF, ORM best practices, caching, signals, middleware, and production-grade Django apps.