Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add caelum29/calibre-mcp --skill calibre-mcp-setupgit clone --depth 1 https://github.com/caelum29/calibre-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/caelum29/calibre-mcp/calibre-mcp-setup)<a href="https://agentmods.dev/skills/caelum29/calibre-mcp/calibre-mcp-setup"><img src="https://agentmods.dev/badge/skills/caelum29/calibre-mcp/calibre-mcp-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/caelum29/calibre-mcp/calibre-mcp-setup"><img src="https://agentmods.dev/badge/skills/caelum29/calibre-mcp/calibre-mcp-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 10 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 6 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Rogue Agent · line 3 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 11 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 149 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 119 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 157 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 158 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 201 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 200 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 200 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00194 | $0.03370 |
| Opus 5 | $0.00097 | $0.01685 |
| Sonnet 5 | $0.00039 | $0.00674 |
| Haiku 4.5 | $0.00019 | $0.00337 |
Grade A, and why
calibre-mcp-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. **Content Server reachable**: `curl -s http://localhost:8080/interface-data/init` How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
calibre-mcp setup
Take this machine from "has Calibre" to "calibre-mcp verified working in the user's client(s)". Work phase by phase; a phase is complete only when its VERIFY produced the stated evidence as a tool result in this session — never claim progress without one. If a VERIFY fails twice, stop and report; don't improvise workarounds.
Scope: install + configure + verify, including guiding the user through the Calibre-side configuration (Content Server, write permission). Out of scope: building a whole-library semantic index (offer the command, don't run it), modifying the Calibre library, installing Calibre or Node themselves.
Decisions reserved for the user (never default them yourself): enabling the write gate, starting the Content Server (GUI vs headless daemon), running the index build, and which client(s) to install into.
Phase 0 — Preflight
Check in order. Apply reversible remediations; stop for the rest.
- Node ≥ 22.5 (not needed for the Claude Desktop
.mcpbpath — Desktop ships its own runtime):node --version. Missing/old → if the user only wants Desktop, continue; otherwise stop (user installs Node). - Calibre present — try
calibredb --version, then the platform default:- macOS:
/Applications/calibre.app/Contents/MacOS/calibredb --version - Windows:
& "C:\Program Files\Calibre2\calibredb.exe" --version - Linux:
/usr/bin/calibredb --versionMissing → stop; user installs from https://calibre-ebook.com/download. (The server auto-discovers calibredb per platform — a non-default location only needsCALIBRE_MCP_CALIBREDB_PATHlater.)
- macOS:
- Content Server reachable:
curl -s http://localhost:8080/interface-data/init(PowerShell:curl.exe, orInvoke-WebRequest). Non-default port → adjust the URL here and setCALIBRE_MCP_SERVER_URLin Phase 2. Not reachable → tell the user: Calibre → Connect/share → Start Content server, or headlesscalibre-server --port 8080; wait, re-verify. Don't start it yourself — GUI vs daemon is their call. Warn: the two are mutually exclusive — Calibre's server lock is global, socalibre-serverrefuses to start while the GUI is open ("Another calibre program … is running"). GUI open = use the GUI's own Content Server, nothing else. - Optional, note only:
pdftotext -v(poppler:brew install poppler/winget install poppler/ distro package). Absent = degraded PDF extraction, not a blocker. Footnote it; install nothing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 230 lines · 194 tokens per session scan A ac7bb1d9731f
calibre-mcp-setup is a skill published in the GitHub repository caelum29/calibre-mcp (14 stars, last pushed 21d ago), licensed MIT. It adds 194 tokens to every session and 3,370 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
semantic_search
Description: Find books by meaning using LanceDB over title, authors, tags, comments, and series. Supports hybrid keyword + vector search across your entire Calibre library.
reading_recommendations
Description: Get personalized reading recommendations from your Calibre library using series progress, ratings, tags, reading history, and collaborative filtering across similar books.
bastra-recall
Persistent external brain for ChatGPT, Codex, Claude, and other MCP clients — documents (PDFs, contracts, scans with OCR), personal facts (appointments, decisions, items, amounts), AND code lessons / preferences / project topology. USE PROACTIVELY in three modes. (1) RECALL — whenever the user asks about anything from…
bastra-recall
Proactive private local memory for ChatGPT and Codex — recall before acting, save durable rules, lessons and decisions without being asked. Requires the local bastra-recall MCP server installed by bastra install codex.
himalayas-employer
AI hiring assistant for Himalayas. Post remote jobs, manage company profiles, source talent, message candidates, and benchmark salaries using the Himalayas MCP server.
usage-guard
Arm proactive 5-hour usage protection for long Claude Code sessions (batch, subagents, high window % at start). Daemon reads account-level 5-hour window usage (not per-session). User types /usage-guard at session start. Re-arm every sitting. If user mentions usage-guard by name, read this file and run arm.sh.