Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/chrischall/groupon-mcp/grouponnpx skills add chrischall/groupon-mcp --skill groupongit clone --depth 1 https://github.com/chrischall/groupon-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chrischall/groupon-mcp/groupon)<a href="https://agentmods.dev/skills/chrischall/groupon-mcp/groupon"><img src="https://agentmods.dev/badge/skills/chrischall/groupon-mcp/groupon.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.00661 |
| Opus 5 | $0.00030 | $0.00331 |
| Sonnet 5 | $0.00012 | $0.00132 |
| Haiku 4.5 | $0.00006 | $0.00066 |
Grade A, and why
groupon scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
description: Search and read Groupon deals from the terminal via curl — the consumer GraphQL API (deal search/browse, deal detail, category taxonomy). Anonymous, no key or login. Use when asked to find Groupon deals, loo How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Groupon deals via curl
Groupon's consumer deal data comes from one GraphQL endpoint that answers a
plain server-side curl with no cookies, no key, no login, no bot wall:
POST https://www.groupon.com/mobilenextapi/graphql
-H 'content-type: application/json'
-H 'apollographql-client-name: mobilenextapi'
Requests are a batched JSON array of Apollo persisted-query operations
(operationName + variables + extensions.persistedQuery.sha256Hash, no query
text — introspection is off and the server masks GraphQL errors as opaque 400
HTML, so you cannot hand-author queries). The response is a JSON array;
.[0].data.<field> holds the payload. Ready-to-run bodies + jq recipes are in
references/graphql-queries.md.
The three operations
| Need | Op | Root field |
|---|---|---|
| Search / browse a city's deals | BrowseDealFeed |
.[0].data.browseDealFeed.cards |
| One deal's full detail (options, price, reviews, fine print) | getDeal |
.[0].data.getDeal |
| Category taxonomy | GetMainNavigation |
.[0].data... |
division is a Groupon city slug (new-york, chicago, syracuse, los-angeles, …).
dealId for getDeal is a deal's permalink slug = the last path segment of a
card's .url (https://www.groupon.com/deals/<dealId>).
Two failure modes
- Empty / non-JSON 2xx → almost always a challenge interstitial; retry, don't
JSON.parseit blind. {"errors":[{"message":"PersistedQueryNotFound"}]}→ the bakedsha256Hashwent stale (Groupon redeployed its frontend queries). Re-capture it:- Open a Groupon search page in a signed-in-or-not browser, DevTools → Network.
- Filter for
mobilenextapi/graphql, click the request whose payloadoperationNamematches the one you need. - Copy
extensions.persistedQuery.sha256Hashfrom the request payload and replace the stale hash inreferences/graphql-queries.md. (The hash is a public query fingerprint, not a secret.)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 50 lines · 59 tokens per session scan A 5c7d321d63a7
groupon is a skill published in the GitHub repository chrischall/groupon-mcp (1 stars, last pushed today), licensed MIT. It adds 59 tokens to every session and 661 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
purchasing
Create approved purchase orders with the create-purchase-order tool.
refunds
Check refund eligibility and use the refund-order tool safely.
seller-research
Use when researching a merchant, storefront, marketplace seller, or merchant of record for a buying decision, especially when identity, refund terms, fulfillment, counterfeit risk, domain history, or independent buyer outcomes are uncertain.
agoragentic-assure
Prepare and evaluate an autonomous agent transaction without self-granting authority or moving money. Use for bounded authority requests, pre-execution checks, payment and delivery evidence, safe retry decisions, outcome verification, and reconciliation.
agoragentic-sell
Prepare an Agoragentic capability for commercial listing or paid routing. Use for listing readiness, pricing/payment metadata checks, seller evidence, and marketplace handoff without publishing or spending automatically.
trusty-squire
Use when a coding agent needs to sign up for a website or SaaS, provision an OAuth client or API key, pay a checkout, or otherwise act on a real website on the user's behalf — and the secret or card must NOT land in chat, source code, or a .env file. Trusty Squire is an MCP server that drives a real browser through…