Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bobmatnyc/claude-mpm-skills --skill hono-cloudflaregit clone --depth 1 https://github.com/bobmatnyc/claude-mpm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-cloudflare)<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-cloudflare"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/hono-cloudflare/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-cloudflare"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/hono-cloudflare.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 10 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 13 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 84 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 87 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 720 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 723 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 726 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 729 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 732 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 735 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 738 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.03990 |
| Opus 5 | $0.00015 | $0.01995 |
| Sonnet 5 | $0.00006 | $0.00798 |
| Haiku 4.5 | $0.00003 | $0.00399 |
Grade A, and why
hono-cloudflare scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
async fetch(request: Request): Promise<Response> { How it starts
The opening of the file, as written. The whole thing — 752 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hono on Cloudflare Workers
Overview
Hono was originally built for Cloudflare Workers and provides first-class support for the entire Cloudflare ecosystem including KV, D1, R2, Durable Objects, Queues, and more.
Key Features:
- Native Workers support
- Type-safe bindings access
- KV, D1, R2, Durable Objects integration
- Static asset serving
- Cloudflare Pages support
- Queue and scheduled handlers
When to Use This Skill
Use Hono on Cloudflare when:
- Building edge APIs with global distribution
- Need serverless SQLite with D1
- Building real-time apps with Durable Objects
- Storing files with R2
- Need fast key-value storage with KV
- Deploying full-stack apps to Pages
Quick Start
Create New Project
npm create hono@latest my-app
# Select: cloudflare-workers
cd my-app
npm install
npm run dev
Project Structure
my-app/
├── src/
│ └── index.ts # Main entry point
├── wrangler.toml # Cloudflare configuration
├── package.json
└── tsconfig.json
Basic Application
// src/index.ts
import { Hono } from 'hono'
const app = new Hono()
app.get('/', (c) => c.text('Hello Cloudflare Workers!'))
export default app
Deploy
# Deploy to Cloudflare
npx wrangler deploy
# Local development
npx wrangler dev
Environment Bindings
Typed Bindings
import { Hono } from 'hono'
// Define your bindings
type Bindings = {
// Environment variables
API_KEY: string
DATABASE_URL: string
// KV Namespaces
MY_KV: KVNamespace
// D1 Databases
DB: D1Database
// R2 Buckets
BUCKET: R2Bucket
// Durable Objects
COUNTER: DurableObjectNamespace
// Queues
MY_QUEUE: Queue
}
const app = new Hono<{ Bindings: Bindings }>()
app.get('/config', (c) => {
// Fully typed access
const apiKey = c.env.API_KEY
return c.json({ configured: !!apiKey })
})
export default app
wrangler.toml Configuration
name = "my-app"
main = "src/index.ts"
compatibility_date = "2024-01-01"
[vars]
API_KEY = "your-api-key" # pragma: allowlist secret
[[kv_namespaces]]
binding = "MY_KV"
id = "your-kv-id"
[[d1_databases]]
binding = "DB"
database_name = "my-database"
database_id = "your-d1-id"
[[r2_buckets]]
binding = "BUCKET"
bucket_name = "my-bucket"
[[queues.producers]]
binding = "MY_QUEUE"
queue = "my-queue"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 752 lines · 29 tokens per session scan A 52346c0df97e
hono-cloudflare is a skill published in the GitHub repository bobmatnyc/claude-mpm-skills (74 stars, last pushed 1mo ago), licensed MIT. It adds 29 tokens to every session and 3,990 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cloudflare
Use when working on Cloudflare's edge platform — wrangler.jsonc bindings, choosing between D1/KV/R2/Durable Objects/Queues, deploying a Worker or SPA via Static Assets, or designing around a Workers runtime limit. NOT generic CI/release (that is deployment), NOT Next.js framework wiring (that is nextjs), NOT DNS…
binding-hono-client
Typed HTTP clients for Cloudflare service bindings — bindingHonoClient, WorkerBindingRegistry, Worker RPC with clientApp, HonoClientApp. Use when calling env.CHATROOM or any WorkerRef/BoundWorker over fetch with @firtoz/hono-fetcher, adding a worker Hono app RPC type, or fixing JsonResponse / missing .delete on…
durable-object-package
Add or change a Durable Object worker package under durable-objects/ (Alchemy, env.d.ts, Hono on the DO). Use when scaffolding with turbo gen durable-object, editing durable-objects//alchemy.run.ts, workers/app.ts, or env.d.ts for a DO. Not for web app bindings or cross-worker rpc—see web-alchemy-bindings and…
web-alchemy-bindings
Wire @internal/web to durable-objects workers—workspace dep, alchemy.run.ts ReactRouter bindings, and env patterns. Use when adding workspace: for a worker, editing apps/web/alchemy.run.ts, or debugging missing worker types after a new package.
cloudflare-worker-dev
Cloudflare Workers, KV, Durable Objects, and edge computing development. Use for serverless APIs, caching, rate limiting, real-time features. Activate on "Workers", "KV", "Durable Objects", "wrangler", "edge function", "Cloudflare". NOT for Cloudflare Pages configuration (use deployment docs), DNS management, or…
cloudflare-bundler-apps
Author Cloudflare Worker Bundler-compatible apps that build and preview correctly inside a space. Use this skill whenever you scaffold, modify, or deploy a project that will be built with @cloudflare/worker-bundler (i.e. anything served from /space/:name/preview/:branch/). Covers wrangler config, project layout…