Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyanheads/obsidian-mcp-server --skill polish-docs-metagit clone --depth 1 https://github.com/cyanheads/obsidian-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyanheads/obsidian-mcp-server/polish-docs-meta)<a href="https://agentmods.dev/skills/cyanheads/obsidian-mcp-server/polish-docs-meta"><img src="https://agentmods.dev/badge/skills/cyanheads/obsidian-mcp-server/polish-docs-meta/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cyanheads/obsidian-mcp-server/polish-docs-meta"><img src="https://agentmods.dev/badge/skills/cyanheads/obsidian-mcp-server/polish-docs-meta.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 234 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.06043 |
| Opus 5.5 | $0.00022 | $0.02417 |
| Sonnet 5.5 | $0.00011 | $0.01209 |
| Haiku 4.5 | $0.00005 | $0.00604 |
Grade A, and why
polish-docs-meta scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
8 near-identical copies found in the catalogue:
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
- polish-docs-meta — 100% identical, 21 lines differ
How it starts
The opening of the file, as written. The whole thing — 296 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to Use
- Server implementation is functionally complete (tools, resources, prompts, services all working)
bun run devcheckpasses, tests pass- You're preparing for first commit, first release, or making the repo public
- User says "polish", "polish docs", "finalize", "make it ship-ready", "clean up docs", or similar
- Re-running after adding/removing tools, resources, or other surface area changes
Prefer running after implementation is complete, but safe to re-run at any point — steps are idempotent.
Companion: pair with security-pass for a full pre-ship review — this skill polishes docs and metadata; security-pass audits handlers for MCP-specific security gaps.
Prerequisites
- All tools/resources/prompts implemented and registered
-
bun run devcheckpasses - Tests pass (
bun run test)
If these aren't met, address them first.
Steps
1. Audit the Surface Area
Read all tool, resource, and prompt definitions. Build a mental model of what the server actually does — names, descriptions, input/output shapes, auth scopes. This inventory drives every document below.
Read:
src/index.ts(what's registered increateApp())- All files in
src/mcp-server/tools/definitions/ - All files in
src/mcp-server/resources/definitions/ - All files in
src/mcp-server/prompts/definitions/ - All files in
src/services/(if any) src/config/server-config.ts(if any)
Capture: tool count, resource count, prompt count, service count, required env vars.
2. README.md
Read the gold standard first: the pubmed-mcp-server README — https://github.com/cyanheads/pubmed-mcp-server/blob/main/README.md (or ../pubmed-mcp-server/README.md when that repo is checked out beside this one). Mirror its structure, section order, heading forms, and density. Reuse its non-server-specific content as-is — the framework line under Features, and the Getting started / Configuration / Running the server / Development guide / Contributing boilerplate — and tune only what is server-specific: the header, the Overview description, the primitives and their Capability reference entries, the domain-specific and agent-friendly bullets, env vars, project structure. Then read references/readme.md for the conventions spelled out; where it and the pubmed README disagree, the README wins — note the discrepancy in your report rather than editing the reference.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +9 lines e0e66399f5f0
- 3d ago Changed 0c4dd74c4641
- 22d ago Changed · +1 lines 4a671f3c402d
- 1mo ago Changed · +1 lines a35cfa92eff5
- 1mo ago Changed · +8 lines 6f6752c37b1a
- 1mo ago First seen · 277 lines · 54 tokens per session scan A 50926cd53e50
polish-docs-meta is a skill published in the GitHub repository cyanheads/obsidian-mcp-server (701 stars, last pushed yesterday), licensed Apache-2.0. It adds 54 tokens to every session and 6,043 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pkm-write
Use when writing to the vault — creating new notes (vaultwrite), editing existing notes (vaultedit, vaultappend, vaultupdatefrontmatter). Handles duplicate checking, link discovery, annotations, and index updates for new notes. Provides guidelines for modifications.
pkm-session-end
Use when wrapping up a work session — creates devlog entry, captures undocumented decisions/research/debugging, audits link health of session work, and updates project index. Primarily used via the pkm-capture agent.
pkm-explore
Use when researching what the vault knows about a topic — performs graph + semantic exploration with gap analysis to map existing knowledge and find missing connections. Primarily used via the vault-explorer agent. Not for routine session-start context loading (hooks handle that).
triage-tasks
Use when you want to review and batch-update open vault task statuses for the current project or across all projects.
tackle-task
Use when starting work on a specific vault task, when a task title or path is mentioned, or when coming from triage output.
add-task
Use when you want to quickly capture a new task in the vault from a title, with optional priority and due date.