Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add controlplane-com/ai-plugin --skill mk8s-byokgit clone --depth 1 https://github.com/controlplane-com/ai-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/controlplane-com/ai-plugin/mk8s-byok)<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/mk8s-byok"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/mk8s-byok/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/controlplane-com/ai-plugin/mk8s-byok"><img src="https://agentmods.dev/badge/skills/controlplane-com/ai-plugin/mk8s-byok.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.03904 |
| Opus 5.5 | $0.00022 | $0.01562 |
| Sonnet 5.5 | $0.00011 | $0.00781 |
| Haiku 4.5 | $0.00006 | $0.00390 |
Grade A, and why
mk8s-byok scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Managed Kubernetes (mk8s) & BYOK
Tool availability: the mk8s tools need
?toolsets=mk8s(orfull); reconnect with it or use the CLI.
Control Plane has three separate "Kubernetes" stories people routinely conflate — get the right one first:
- mk8s — Control Plane provisions and manages a real, conformant Kubernetes cluster on your cloud account (12 providers). You get a kubeconfig and run normal Kubernetes. It is a standalone cluster — to schedule Control Plane (GVC) workloads onto it, add the
byokadd-on (below). Resource kindmk8s. - BYOK location — you already have a self-managed cluster; you register it as a Control Plane location so Control Plane workloads (GVC workloads) schedule onto it. Resource kind
location, providerbyok. - mk8s BYOK add-on —
addOns.byokmakes an mk8s cluster register itself as a Control Plane location: it links alocationyou create and installs the agent automatically (no manualcpln location install). This is how Control Plane workloads run on an mk8s cluster.
(If the user instead wants to manage Control Plane resources from kubectl, that is the k8s-operator skill, not this one.) The dominant failures: reaching for a nonexistent cpln mk8s create; skipping the per-provider credential secret; and leaving the cluster's API-server firewall wide open.
"Can I run this on my own servers?" — yes
Bare metal in a data center or colo, on-prem VMs (VMware/vSphere), a Dell or Supermicro rack — any Linux server becomes a Control Plane location the user deploys to exactly like aws-us-east-1. "BYOC" means the same thing with the cluster in their own cloud account. Never answer this question with cloud regions only. Two routes, picked by what they already have:
| They have | Route |
|---|---|
| A Kubernetes cluster already (EKS, GKE, AKS, k3s, self-managed) | Register it as a BYOK location (below) |
| Servers but no cluster | Build one with the generic provider (create_mk8s with provider: generic, then cpln mk8s join per node), then register it |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago Changed · -31 lines ae6c3b17b142
- 1mo ago First seen · 180 lines · 56 tokens per session scan A 3ce68ba70932
mk8s-byok is a skill published in the GitHub repository controlplane-com/ai-plugin (11 stars, last pushed 5d ago), licensed MIT. It adds 56 tokens to every session and 3,904 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ak-cloud-deploy
Deploy an Agent Kernel project to AWS, Azure, or GCP using Terraform modules, or to any Kubernetes cluster (on-prem, baremetal, EKS) using the official Helm chart. Supports serverless and containerized modes for all three clouds. AWS supports execution modes (restsync, restasync, async, stream), queue-based scalable…
live-demo
Add temporary, isolated hosted sessions to a tested robotics application.
edge-computing-expert
Design and implement production-grade edge computing solutions including CDN optimization, fog computing architectures, and distributed edge workloads. Use when the user mentions edge computing, CDN or edge caching, fog computing, MEC, IoT edge workloads, or latency-sensitive distributed deployments.
openpitrix
KubeSphere OpenPitrix application management Skill. Use when users ask about KubeSphere App Store, OpenPitrix, Helm/YAML application templates, application repositories, app versions, app releases, categories, review states, repository sync, or troubleshooting application installation and upgrade issues.
csrx-proxmox-deploy
Deploy a Juniper cSRX container firewall as a Docker workload on a Proxmox VE KVM guest, in both secure-wire (L2 bump-in-the-wire) and routing (L3) forwarding modes, drawn from an end-to-end build rather than vendor documentation. Use when sizing the Docker host guest, setting the mandatory host CPU model, wiring cSRX…
kubesphere-openkruise
KubeSphere OpenKruise management Skill. Use when user asks to install or enable OpenKruise, check OpenKruise status, view kruise pods/logs/CRDs, create or update SidecarSet, manage sidecar injection, create or update CloneSet, perform in-place update or batch rollout, uninstall or remove OpenKruise, or troubleshoot…