Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bobmatnyc/claude-mpm-skills --skill hono-coregit clone --depth 1 https://github.com/bobmatnyc/claude-mpm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-core)<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-core"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/hono-core/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bobmatnyc/claude-mpm-skills/hono-core"><img src="https://agentmods.dev/badge/skills/bobmatnyc/claude-mpm-skills/hono-core.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.03122 |
| Opus 5 | $0.00013 | $0.01561 |
| Sonnet 5 | $0.00005 | $0.00624 |
| Haiku 4.5 | $0.00003 | $0.00312 |
Grade A, and why
hono-core scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 511 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hono - Ultrafast Web Framework
Overview
Hono is a small, simple, and ultrafast web framework built on Web Standards. It runs on Cloudflare Workers, Deno, Bun, Node.js, and more with the same codebase. The name means "flame" in Japanese.
Key Features:
- Built on Web Standards (Request/Response/fetch)
- Multi-runtime: Cloudflare Workers, Deno, Bun, Node.js, Vercel, AWS Lambda
- Ultrafast routing with RegExpRouter
- First-class TypeScript support
- Lightweight (~14KB minified)
- Rich middleware ecosystem
Installation:
# Create new project (recommended)
npm create hono@latest my-app
# Or install in existing project
npm install hono
# Runtime-specific adapters
npm install @hono/node-server # Node.js
When to Use This Skill
Use Hono when:
- Building APIs for edge/serverless environments (Cloudflare Workers, Vercel Edge)
- Need multi-runtime portability (same code on Bun, Deno, Node.js)
- Want TypeScript-first development with excellent type inference
- Building lightweight, high-performance APIs
- Need built-in middleware for common patterns (CORS, auth, compression)
Hono vs Other Frameworks:
- Hono: Multi-runtime, Web Standards, ultrafast, edge-optimized
- Express: Node.js only, larger ecosystem, slower
- Fastify: Node.js only, schema-based, good performance
- Elysia: Bun only, excellent performance, different API style
Core Concepts
Creating an Application
import { Hono } from 'hono'
const app = new Hono()
app.get('/', (c) => c.text('Hello Hono!'))
export default app
With TypeScript Generics (for bindings/variables):
type Bindings = {
DATABASE_URL: string
API_KEY: string
}
type Variables = {
user: { id: string; name: string }
}
const app = new Hono<{ Bindings: Bindings; Variables: Variables }>()
The Context Object (c)
The context c provides access to request data and response methods:
app.get('/users/:id', async (c) => {
// Request data
const id = c.req.param('id') // Path parameter
const query = c.req.query('sort') // Query parameter ?sort=asc
const queries = c.req.queries('tags') // Multiple: ?tags=a&tags=b
const header = c.req.header('Authorization')
const body = await c.req.json() // JSON body
const form = await c.req.formData() // Form data
// Environment (Cloudflare Workers bindings)
const db = c.env.DATABASE_URL
// Custom variables (set by middleware)
const user = c.get('user')
// Response methods
return c.text('Plain text')
return c.json({ id, name: 'User' })
return c.html('<h1>Hello</h1>')
return c.redirect('/login')
return c.notFound()
})
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 511 lines · 26 tokens per session scan A 26107a1a934c
hono-core is a skill published in the GitHub repository bobmatnyc/claude-mpm-skills (74 stars, last pushed 1mo ago), licensed MIT. It adds 26 tokens to every session and 3,122 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
add-a-lib
Scaffold a new shared library under libs/ in the builders-stack monorepo. Use when code is needed in two or more places (apps or services) and should become a single source of truth consumed by package name. Covers the package.json, tsconfig, the one-public-door src/index.ts barrel, and wiring it into a consumer…
nifra
Use when writing, reviewing, or debugging code in a Nifra project (@nifrajs/ packages, nifra CLI, server()/defineContract, loaders and actions, file routes under routes/). Explains how to reach Nifra's live MCP tools so signatures come from the installed version instead of memory, and which sibling skill to load for…
tsq-hono
A set of backend development guidelines for Hono, a lightweight web framework for Node.js. It covers API routes, input checking, error handling, authentication, configuration, and clean separation of application layers.
bun
Bun all-in-one JavaScript runtime and toolkit reference. Covers runtime APIs (file I/O, HTTP server, SQLite, shell), ultra-fast package manager, built-in bundler with plugins, test runner with mocking, TypeScript support, and Node.js compatibility.
psl-ast-layers
How to use the PSL syntax tree layers (green tree, red tree, strongly-typed AST classes) correctly. Use for any PSL-related work: PSL interpreters (contract-psl), helpers inside the psl-parser package, the language server, formatters, or anything else that consumes parse() output from @internal/psl-parser.
ast-visitor-pattern
Use the frozen-class/visitor pattern for discriminated unions that have multiple dispatch sites. Use when creating a new set of variants (commands, IR nodes, factory calls) that will be switched over in 2+ places, or when refactoring an existing union type that has grown multiple switch sites.