Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/coreyhaines31/makerskills/toolifynpx skills add coreyhaines31/makerskills --skill toolifygit clone --depth 1 https://github.com/coreyhaines31/makerskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/coreyhaines31/makerskills/toolify)<a href="https://agentmods.dev/skills/coreyhaines31/makerskills/toolify"><img src="https://agentmods.dev/badge/skills/coreyhaines31/makerskills/toolify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00261 | $0.02907 |
| Opus 5 | $0.00130 | $0.01453 |
| Sonnet 5 | $0.00052 | $0.00581 |
| Haiku 4.5 | $0.00026 | $0.00291 |
Grade B, and why
toolify scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
# For MCP: restart Claude Code, run any command that touches the MCP server Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -H "Authorization: Bearer $STRIPE_SECRET_KEY" https://api.stripe.com/v1/customers?limit=1 How it starts
The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/toolify — Wire up an integration or MCP server
Interactive wizard for adding an external tool / API / MCP into a project. Ends with working code + env vars set + a verification path.
Scope
- Primary stacks: Next.js (App Router + TypeScript) and Rails. Reason: those are the two stacks the user actually ships in; supporting every stack bloats the wizard.
- What toolify handles: auth pattern (API key, OAuth, JWT, session cookie), env var setup, official SDK vs raw fetch, client wrapper location, example usage, webhook handling (if applicable), MCP
.mcp.jsonwiring (if MCP server). - What toolify does NOT handle: writing business logic on top of the integration (that's for the human). It scaffolds the plumbing, not the feature.
Step 0 — Get the tool name
Ask if not provided: "Which tool are we integrating?"
Detect category from name:
| Category | Examples | Extra steps |
|---|---|---|
| Payments | Stripe, LemonSqueezy, Paddle | Webhook signature verification, customer model, event handlers |
| Auth | NextAuth/Auth.js, Clerk, Supabase Auth, Devise | Session management, protected routes, callbacks |
| Resend, Postmark, SendGrid, Kit | From address, template setup, unsubscribe handling | |
| CMS/DB | Sanity, Prisma, Drizzle, Neon, Supabase | Schema location, migration path, client singleton pattern |
| AI/LLM | Anthropic, OpenAI, Gemini, Vercel AI SDK | Model choice, streaming vs non-streaming, rate limits |
| Analytics | Fathom, PostHog, Plausible | Script placement, event tracking API |
| Scheduling/Comms | SavvyCal, Cal.com, Twilio, Riverside | Webhook events, embed patterns |
| Scraping | ScrapeCreators, Apify, Playwright | Rate limits, response caching, retry policy |
| Affiliate/Referral | Rewardful, PartnerStack | Cookie handling, webhook events, dashboard access |
| Storage | Vercel Blob, S3, R2 | Bucket setup, signed URL pattern, presigned upload |
| MCP server | Any MCP — Sanity, Stripe, GitHub, Kit, etc. | .mcp.json entry + env vars, no client wrapper |
| Custom / other | Internal API, unknown tool | Ask more questions |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 195 lines · 261 tokens per session scan B 66a6cd760968
toolify is a skill published in the GitHub repository coreyhaines31/makerskills (772 stars, last pushed today), licensed MIT. It adds 261 tokens to every session and 2,907 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it B with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
service-desk
Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets…
session-cleanup
Identify stale and empty Claude Code sessions in the Agent Monitor and explain the cleanup endpoint (POST /api/settings/cleanup), always showing the exact list of what WOULD be removed before anything is deleted. Cleanup permanently deletes data, so this skill previews first and requires explicit user confirmation.…
session-search
Find Claude Code sessions tracked by the Agent Monitor by project (cwd), model, status, or date, then rank the matches by cost or recency. Pulls the session list and the distinct cwd / facet values so filters use real values rather than guesses. Use when locating a session — "find my EstateWise sessions", "which Opus…
044-planning-jira
Use when you need Jira CLI (jira) installation/authentication guidance and a maintainer-authored Jira issue inventory workflow. The agent does not ingest raw Jira issue or JQL output directly; it asks the Jira project maintainer/operator to author sanitized issue summaries before analysis or @014-agile-user-story…
suede-onboarding
Suede-affiliated onboarding and activation strategy for first-run sequencing, empty states, setup checklists, activation milestones, time to value, and retention-linked measurement. Use when users sign up but fail to reach first value or the product needs a new first-session flow. NOT FOR: registration optimization…
init-deep
Generates hierarchical context files (CLAUDE.md) throughout a project directory tree, providing AI agents with directory-specific knowledge for better code understanding. Use when setting up a new project for AI-assisted development.