field-test

field-test is a skill for Claude Code, Codex from cyanheads/mcp-ts-core. It costs 76 tokens per session (7,330 once invoked), scanned B, a copy of field-test, Apache-2.0.

A live test workflow for an MCP server over HTTP using JSON-RPC, the message format used between the client and server. It starts the server, checks its catalogue, and sends normal and deliberately difficult requests.

In plain words
What is it for?
Use it after changing tools, resources, or prompts to test the real HTTP interface and produce findings with numbered follow-up choices.
Why use it?
It reveals problems that mocked unit tests may miss, such as confusing inputs, poor errors, missing output, or differences between returned data formats.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: positional $N argument.

Good fit Use it after changing tools, resources, or prompts to test the real HTTP interface and produce findings with numbered follow-up choices.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cyanheads/mcp-ts-core/field-test
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cyanheads/mcp-ts-core --skill field-test
Clone the repo
git clone --depth 1 https://github.com/cyanheads/mcp-ts-core

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for field-test

README.md
[![agentmods](https://agentmods.dev/badge/skills/cyanheads/mcp-ts-core/field-test/github.svg)](https://agentmods.dev/skills/cyanheads/mcp-ts-core/field-test)
Your own site
<a href="https://agentmods.dev/skills/cyanheads/mcp-ts-core/field-test"><img src="https://agentmods.dev/badge/skills/cyanheads/mcp-ts-core/field-test/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for field-test

Your own site · 80×15
<a href="https://agentmods.dev/skills/cyanheads/mcp-ts-core/field-test"><img src="https://agentmods.dev/badge/skills/cyanheads/mcp-ts-core/field-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 76 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 7,330 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00076 $0.07330
Opus 5 $0.00038 $0.03665
Sonnet 5 $0.00015 $0.01466
Haiku 4.5 $0.00008 $0.00733

Measured today against content hash 9767dff7516b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade B, and why

field-test scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

code=$(curl -sS -o "$resp_file" -w '%{http_code}' -X POST "$url" "${headers[@]}" -d "$body")

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Exercise tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, and produces a tight report with concrete findings
Origin

This is a copy

100% identical to field-test — 100 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

skills/field-test/SKILL.md · 433 lines

How it starts

The opening of the file, as written. The whole thing — 433 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Context

Unit tests (add-test skill) verify handler logic with mocked context. Field testing exercises the real HTTP transport with real JSON-RPC: starts the server, calls initialize, surfaces the catalog, runs inputs, and checks what a client actually sees. It catches what unit tests miss — awkward input shapes, unhelpful errors, missing format output, drift between structuredContent and content[], edge-case surprises.

Actively call the tools. Don't read code and guess.

Transport coverage

This skill drives an HTTP server because curl + JSON-RPC is the most reliable harness for shell-based agents. The same handlers run on both transports — only the framing differs — so HTTP exercises the full functional surface. Both HTTP session modes are covered: a durable Mcp-Session-Id session, and the sessionless initialization a MCP_SESSION_MODE=stateless server performs.

Stdio coverage is a boot check only — run this before Step 1. Run bun run rebuild && bun run start:stdio, confirm the startup logs look clean (banner, expected tool/resource counts, no errors/warnings, no missing-config gripes), then kill it. Pino logs go to stderr in stdio mode (stdout is reserved for JSON-RPC), so they print straight to the terminal when you run interactively. No need to call tools over stdio — the HTTP pass already covered handler behavior.


Steps

1. Start the server

Generate a 10-character alphanumeric ID (e.g. 9DJ73-K103L) and write the helper to /tmp/<project-name>-field-test-<ID>.sh. Use that exact path in every subsequent Bash call. Two agents in the same project tree must pick different IDs — that's what keeps their helper files, server logs, and call scratch from colliding.

The helper itself is stateless — every function takes the IDs it needs (server pid, url, port, MCP sid, server log path) as positional args. mcp_start prints them; the agent threads them through every later call. No env vars, no shared state files.

Read the full file on GitHub · 433 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +40 lines scan A → B 9767dff7516b
  2. 9d ago First seen · 393 lines · 76 tokens per session scan A 5e0878fedc2a

Subscribe to this mod's changes

field-test is a skill published in the GitHub repository cyanheads/mcp-ts-core (151 stars, last pushed today), licensed Apache-2.0. It adds 76 tokens to every session and 7,330 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). It is 100% identical to field-test, differing in 100 lines, and is treated as a copy.

Related

Other skills, from other repositories

blazemeter-private-locations

Comprehensive guide for BlazeMeter Private Locations, including Radar Agent, installation (Docker, Kubernetes, Helm), configuration, management, and troubleshooting. Use when working with Private Locations for (1) Installing agents (Docker, Kubernetes, Helm Chart), (2) Configuring Radar Agent for API Monitoring, (3)…

Blazemeter/bzm-mcp · 103 tokens

blazemeter-functional-testing

Comprehensive guide for BlazeMeter Functional Testing, including GUI Functional Tests, API Tests (deprecated), Action Library, and debugging. Use when working with Functional Testing for (1) Creating GUI Functional Tests (YAML, Java IDE, Python IDE), (2) Managing Functional Tests (duplicate, delete, move, rename), (3)…

Blazemeter/bzm-mcp · 124 tokens

blazemeter-recorders

Comprehensive guide for BlazeMeter Recorders, including Chrome Extension and Proxy Recorder. Use when working with recorders for (1) Recording tests with Chrome Extension, (2) Creating and using Proxy Recorder, (3) Configuring browsers and devices for proxy recording, (4) Setting port ranges for proxy recorder, or any…

Blazemeter/bzm-mcp · 76 tokens

lastest

Lastest is a visual regression testing platform. It records browser tests, runs them via Playwright, diffs screenshots, and uses AI to classify changes. Available as an MCP server for AI agent integration.

las-team/lastest · 0 tokens

field-test

Exercise tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, and produces a tight report with concrete findings and numbered follow-up options. Use after adding or modifying definitions, or when the user asks to…

cyanheads/pubmed-mcp-server · 76 tokens

resolume-mcp-tester

Test and operate the Resolume MCP server (resolume-mcp-server) end-to-end against a live Resolume Arena. Use when verifying tool behavior, running smoke tests, doing safe live VJ demos, or validating new tools added to the project. Includes white-out prevention rules, state restoration patterns, and agent invocation…

mackatwentytsuru/resolume-mcp-server · 75 tokens