Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/cyanheads/git-mcp-server/field-testnpx skills add cyanheads/git-mcp-server --skill field-testgit clone --depth 1 https://github.com/cyanheads/git-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyanheads/git-mcp-server/field-test)<a href="https://agentmods.dev/skills/cyanheads/git-mcp-server/field-test"><img src="https://agentmods.dev/badge/skills/cyanheads/git-mcp-server/field-test.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.03276 |
| Opus 5 | $0.00039 | $0.01638 |
| Sonnet 5 | $0.00015 | $0.00655 |
| Haiku 4.5 | $0.00008 | $0.00328 |
Grade C, and why
field-test scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$TEST_REPO" && mkdir -p "$TEST_REPO" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Exercise git tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, and produces a tight report with concrete findi How it starts
The opening of the file, as written. The whole thing — 278 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context
Unit tests verify handler logic with mocked context. Field testing exercises the real HTTP transport with real JSON-RPC: starts the server, calls initialize, surfaces the catalog, runs inputs, and checks what a client actually sees. It catches what unit tests miss — awkward input shapes, unhelpful errors, missing responseFormatter output, drift between structuredContent and content[], edge-case surprises, and git-specific behavior around conflicts, bare repos, protected branches, working directory state, etc.
Actively call the tools. Don't read code and guess.
For git tools specifically: prefer a throwaway test repo (/tmp/field-test-repo initialized with git init and a seed commit) over the project itself so state changes are bounded and easy to clean up.
Steps
1. Start the server
Write the helper to /tmp/mcp-field-test.sh once, then source it in every subsequent Bash call. Helper keeps PID / URL / session id in /tmp/mcp-field-test.env so state survives across tool invocations.
cat > /tmp/mcp-field-test.sh <<'HELPER_EOF'
#!/bin/bash
# Field-test helper: manage an MCP HTTP server + JSON-RPC session across shell calls.
STATE_FILE="/tmp/mcp-field-test.env"
[ -f "$STATE_FILE" ] && . "$STATE_FILE"
mcp_start() {
local dir="${1:-$PWD}"
echo "building $dir ..."
(cd "$dir" && bun run rebuild) >/tmp/mcp-build.log 2>&1 \
|| { echo "BUILD FAILED — see /tmp/mcp-build.log"; return 1; }
echo "starting server ..."
(cd "$dir" && bun run start:http) >/tmp/mcp-server.log 2>&1 &
local pid=$!
local line=""
for _ in $(seq 1 40); do
line=$(grep -Eo 'listening at http://[^" ]+/mcp' /tmp/mcp-server.log | head -1)
[ -n "$line" ] && break
sleep 0.25
done
if [ -z "$line" ]; then
echo "server failed to start — see /tmp/mcp-server.log"
kill "$pid" 2>/dev/null
return 1
fi
local url="${line#listening at }"
local port; port=$(echo "$url" | sed -E 's|.*:([0-9]+)/.*|\1|')
cat > "$STATE_FILE" <<EOF
export MCP_PID=$pid
export MCP_URL=$url
export MCP_PORT=$port
EOF
. "$STATE_FILE"
echo "ready pid=$pid url=$url"
}
mcp_init() {
[ -z "$MCP_URL" ] && { echo "run mcp_start first"; return 1; }
local hdr="/tmp/mcp-init-headers.txt"
curl -sS -D "$hdr" -X POST "$MCP_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"field-test","version":"1.0"}}}' >/dev/null
local sid; sid=$(grep -i '^mcp-session-id:' "$hdr" | awk '{print $2}' | tr -d '\r\n')
[ -z "$sid" ] && { echo "no session id returned"; return 1; }
cat > "$STATE_FILE" <<EOF
export MCP_PID=$MCP_PID
export MCP_URL=$MCP_URL
export MCP_PORT=$MCP_PORT
export MCP_SID=$sid
EOF
. "$STATE_FILE"
curl -sS -X POST "$MCP_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Mcp-Session-Id: $sid" \
-d '{"jsonrpc":"2.0","method":"notifications/initialized"}' >/dev/null
echo "session=$sid"
}
# Usage: mcp_call METHOD [JSON_PARAMS]
# Prints the JSON-RPC response (SSE framing stripped). Pipe to `jq`.
mcp_call() {
[ -z "$MCP_SID" ] && { echo "run mcp_init first"; return 1; }
local method="$1"; local params="${2:-}"
local body
if [ -z "$params" ]; then
body=$(printf '{"jsonrpc":"2.0","id":%d,"method":"%s"}' "$RANDOM" "$method")
else
body=$(printf '{"jsonrpc":"2.0","id":%d,"method":"%s","params":%s}' "$RANDOM" "$method" "$params")
fi
curl -sS -X POST "$MCP_URL" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-H "Mcp-Session-Id: $MCP_SID" \
-d "$body" | sed -n 's/^data: //p'
}
mcp_stop() {
[ -n "$MCP_PID" ] && kill "$MCP_PID" 2>/dev/null
rm -f "$STATE_FILE"
echo "stopped"
}
HELPER_EOF
. /tmp/mcp-field-test.sh
mcp_start /Users/casey/Developer/github/git-mcp-server
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 278 lines · 77 tokens per session scan C 40b9d61f7f66
field-test is a skill published in the GitHub repository cyanheads/git-mcp-server (239 stars, last pushed 10d ago), licensed Apache-2.0. It adds 77 tokens to every session and 3,276 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
blazemeter-private-locations
Comprehensive guide for BlazeMeter Private Locations, including Radar Agent, installation (Docker, Kubernetes, Helm), configuration, management, and troubleshooting. Use when working with Private Locations for (1) Installing agents (Docker, Kubernetes, Helm Chart), (2) Configuring Radar Agent for API Monitoring, (3)…
blazemeter-functional-testing
Comprehensive guide for BlazeMeter Functional Testing, including GUI Functional Tests, API Tests (deprecated), Action Library, and debugging. Use when working with Functional Testing for (1) Creating GUI Functional Tests (YAML, Java IDE, Python IDE), (2) Managing Functional Tests (duplicate, delete, move, rename), (3)…
blazemeter-recorders
Comprehensive guide for BlazeMeter Recorders, including Chrome Extension and Proxy Recorder. Use when working with recorders for (1) Recording tests with Chrome Extension, (2) Creating and using Proxy Recorder, (3) Configuring browsers and devices for proxy recording, (4) Setting port ranges for proxy recorder, or any…
verify-wire-claim
Verify a claim about WhatsApp behaviour before writing it down. Use whenever about to state that a feature works, a flag is enforced, a message was view-once, a poll cap applies, or any assertion about what WhatsApp does. Also use when documenting a finding in docs/protocol-vs-app.md.
mcp-chess-e2e
Run and extend end-to-end tests for the Chess MCP server through real stdio MCP clients and separate server processes. Use when testing MCP handshakes, chess game flows, AI turns, Human UI resources, or multi-session behavior.
desktop-sniff-test
Run the MCP server sniff test against Claude Desktop. Swaps the Claude Desktop config to the local dev server, gives the user a test prompt, evaluates returned results, and restores the production config. Use when the user says "sniff test", "test in desktop", "desktop test", "test prompts in Claude Desktop", or wants…