Caliber is a tool that generates and continuously updates AI context and configuration files for software repositories, including CLAUDE.md, AGENTS.md, and platform-specific rules. Development teams use it to keep coding agents aligned with the current codebase across tools such as Claude Code, Cursor, Codex, OpenCode, and GitHub Copilot. Its catalogue entries include skills, hooks, rules, instructions, and settings for configuring that workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add caliber-ai-org/ai-setup --skill setup-calibergit clone --depth 1 https://github.com/caliber-ai-org/ai-setupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/caliber-ai-org/ai-setup/setup-caliber)<a href="https://agentmods.dev/skills/caliber-ai-org/ai-setup/setup-caliber"><img src="https://agentmods.dev/badge/skills/caliber-ai-org/ai-setup/setup-caliber/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/caliber-ai-org/ai-setup/setup-caliber"><img src="https://agentmods.dev/badge/skills/caliber-ai-org/ai-setup/setup-caliber.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 32 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 34 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 34 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Excessive Agency · line 76 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 78 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 76 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 78 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.02062 |
| Opus 5.5 | $0.00024 | $0.00825 |
| Sonnet 5.5 | $0.00012 | $0.00412 |
| Haiku 4.5 | $0.00006 | $0.00206 |
Grade A, and why
setup-caliber scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Caliber
Dynamic onboarding for Caliber — automatic AI agent context sync. Run all diagnostic steps below on every invocation to determine what's already set up and what still needs to be done.
Instructions
Run these checks in order. For each step, check the current state first, then only act if something is missing.
Step 1: Check if Caliber is installed
command -v caliber >/dev/null 2>&1 && caliber --version || echo "NOT_INSTALLED"
-
If a version prints → Caliber is installed globally. Set
CALIBER="caliber"and move to Step 2. -
If NOT_INSTALLED → Install it globally (faster for daily use since the pre-commit hook runs on every commit):
npm install -g @rely-ai/caliberSet
CALIBER="caliber".If npm fails (permissions, no sudo, etc.), fall back to npx:
npx @rely-ai/caliber --version 2>/dev/null || echo "NO_NODE"- If npx works → Set
CALIBER="npx @rely-ai/caliber". This works but adds ~500ms per invocation. - If NO_NODE → Tell the user: "Caliber requires Node.js >= 20. Install Node first, then run /setup-caliber again." Stop here.
- If npx works → Set
Step 2: Check if pre-commit hook is installed
grep -q "caliber" .git/hooks/pre-commit 2>/dev/null && echo "HOOK_ACTIVE" || echo "NO_HOOK"
- If HOOK_ACTIVE → Tell the user: "Pre-commit hook is active — configs sync on every commit." Move to Step 3.
- If NO_HOOK → Tell the user: "I'll install the pre-commit hook so your agent configs sync automatically on every commit."
$CALIBER hooks --install
Step 3: Detect agents and check if configs exist
First, detect which coding agents are configured in this project:
AGENTS=""
[ -d .claude ] && AGENTS="claude"
[ -d .cursor ] && AGENTS="${AGENTS:+$AGENTS,}cursor"
[ -d .agents ] || [ -f AGENTS.md ] && AGENTS="${AGENTS:+$AGENTS,}codex"
[ -f .github/copilot-instructions.md ] && AGENTS="${AGENTS:+$AGENTS,}github-copilot"
echo "DETECTED_AGENTS=${AGENTS:-none}"
If no agents are detected, ask the user which coding agents they use (Claude Code, Cursor, Codex, GitHub Copilot). Build the agent list from their answer as a comma-separated string (e.g. "claude,cursor").
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 211 lines · 61 tokens per session scan A 0d5a028b72e4
setup-caliber is a skill published in the GitHub repository caliber-ai-org/ai-setup (1,309 stars, last pushed 28d ago), licensed MIT. It adds 61 tokens to every session and 2,062 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
atomic-git-discipline
Compressed commit message and PR body generator. Cuts noise from both while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious; PR bodies state only what the diff can't show, 120 words max. Use when user says "write a commit", "commit message", "generate…
commit-messages
Generate clear, conventional commit messages from git diffs. Use when writing commit messages, reviewing staged changes, or preparing releases.
commit
Use when asked to commit, "commit this", "/commit", or to write a commit for the pending change — reviews what the change reaches outside its diff first, then commits with a message that names it.
commit
Commit the current session's changes only, gateway-inline. Session-isolated (never -A, never stages into the shared index; what commits is read back against the session list), doc-sync-gated. The gateway runs the commit inline — it already holds the diff, session file list, and change intent; on a mechanical gate hit…
git-workflow
Git branching, commit conventions, rebase vs merge, conflict resolution, and release tagging. Use when setting up a git workflow, writing commits, resolving conflicts, or preparing a release.
git-workflow
Branching, committing, PR creation, merge strategies, and git history management.