api-errors

api-errors is a skill for Claude Code from cyanheads/pentest-mcp-server. It costs 54 tokens per session (15,494 once invoked), scanned A, a copy of api-errors, Apache-2.0.

An error-handling reference for @cyanheads/mcp-ts-core, covering MCP errors, JSON-RPC error codes, and structured error handling in services.

In plain words
What is it for?
Use it when defining tool or resource failure modes, choosing error codes, using McpError, or applying ErrorHandler.tryCatch in services.
Why use it?
It clarifies which layer should throw, catch, normalize, log, or wrap errors, reducing inconsistent failure responses.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: mentions Claude Code.

Part of the pentest-mcp-server plugin — 33 skills, 1 MCP server shipped together

Good fit Use it when defining tool or resource failure modes, choosing error codes, using McpError, or applying ErrorHandler.tryCatch in services.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cyanheads/pentest-mcp-server/api-errors
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cyanheads/pentest-mcp-server --skill api-errors
Clone the repo
git clone --depth 1 https://github.com/cyanheads/pentest-mcp-server

Made for: Claude Code.

Or install pentest-mcp-server, the plugin that ships this one along with the rest of its 33 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api-errors

README.md
[![agentmods](https://agentmods.dev/badge/skills/cyanheads/pentest-mcp-server/api-errors/github.svg)](https://agentmods.dev/skills/cyanheads/pentest-mcp-server/api-errors)
Your own site
<a href="https://agentmods.dev/skills/cyanheads/pentest-mcp-server/api-errors"><img src="https://agentmods.dev/badge/skills/cyanheads/pentest-mcp-server/api-errors/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for api-errors

Your own site · 80×15
<a href="https://agentmods.dev/skills/cyanheads/pentest-mcp-server/api-errors"><img src="https://agentmods.dev/badge/skills/cyanheads/pentest-mcp-server/api-errors.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 54 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 15,494 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00054 $0.15494
Opus 5.5 $0.00022 $0.06198
Sonnet 5.5 $0.00011 $0.03099
Haiku 4.5 $0.00005 $0.01549

Measured 8d ago against content hash cbdcefc1481b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

api-errors scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

const articles = await ncbi.fetch(input.pmids);
Origin

This is a copy

100% identical to api-errors — 47 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

framework-skills/api-errors/SKILL.md · 596 lines

How it starts

The opening of the file, as written. The whole thing — 596 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Overview

Error handling in @cyanheads/mcp-ts-core follows a strict layered pattern: tool and resource handlers throw McpError freely (no try/catch), the handler factory catches and normalizes all errors, and services use ErrorHandler.tryCatch for structured logging and wrapping.

Imports:

import { notFound, validationError, McpError, JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';
import { ErrorHandler } from '@cyanheads/mcp-ts-core/utils';

The recommended path for new tools and resources. Declare failure modes as a const tuple under errors; the reason union flows into the handler's ctx.fail and TypeScript enforces that you can only fail with a declared reason:

import { tool, z } from '@cyanheads/mcp-ts-core';
import { JsonRpcErrorCode } from '@cyanheads/mcp-ts-core/errors';

export const fetchTool = tool('fetch_articles', {
  description: 'Fetch articles by PMID',
  input: z.object({ pmids: z.array(z.string()).describe('PMIDs') }),
  output: z.object({ articles: z.array(z.unknown()).describe('Articles') }),

  errors: [
    { reason: 'no_match', code: JsonRpcErrorCode.NotFound,
      when: 'No requested PMID returned data',
      recovery: 'Try pubmed_search_articles to discover valid PMIDs first.' },
    { reason: 'queue_full', code: JsonRpcErrorCode.RateLimited,
      when: 'Local request queue is at capacity', retryable: true,
      recovery: 'Wait 30 seconds and retry, or reduce batch size.' },
    { reason: 'ncbi_down', code: JsonRpcErrorCode.ServiceUnavailable,
      when: 'NCBI E-utilities unreachable after retries', retryable: true,
      recovery: 'NCBI is degraded; retry in a few minutes.' },
  ],

  async handler(input, ctx) {
    const articles = await ncbi.fetch(input.pmids);
    if (articles.length === 0) {
      throw ctx.fail('no_match', `None of ${input.pmids.length} PMIDs returned data`);
    }
    // ctx.fail('typo')   ← TypeScript error: 'typo' isn't in the contract
    return { articles };
  },
});

Read the full file on GitHub · 596 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago Changed · +1 lines cbdcefc1481b
  2. 14d ago Changed · +8 lines da0df17a7aaf
  3. 1mo ago Changed · +58 lines 5fd057c0d5b3
  4. 1mo ago First seen · 529 lines · 54 tokens per session scan A 140957b2714f

Subscribe to this mod's changes

api-errors is a skill published in the GitHub repository cyanheads/pentest-mcp-server (1 stars, last pushed 6d ago), licensed Apache-2.0. It adds 54 tokens to every session and 15,494 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). It is 100% identical to api-errors, differing in 47 lines, and is treated as a copy.

Related

Other skills, from other repositories

analyzing-network-traffic-with-wireshark

Captures and analyzes network packet data using Wireshark and tshark to identify malicious traffic patterns, diagnose protocol issues, extract artifacts, and support incident response investigations on authorized network segments.

mukul975/Anthropic-Cybersecurity-Skills · 49 tokens

redteam-reverse-detail-pack

Domain routing and boundary guidance for authorized reverse engineering analysis, including decompilation, debugging, protocol reversing, firmware extraction, and deobfuscation. Use when a task belongs to the reverse engineering domain and needs scope, evidence, pivot, or exit criteria.

Netw0rkNoob/VulnClaw · 59 tokens

analyzing-memory-dumps-with-volatility

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis…

mukul975/Anthropic-Cybersecurity-Skills · 80 tokens

opencrow-reversing-toolbox

Use the best available portable Python runtime and installed reverse-engineering tooling for binary analysis, symbolic execution, disassembly, emulation, and binary patching. Prefer a detected ctf environment. Use when an agent needs angr, claripy, capstone, unicorn, ghidra-headless, radare2, objdump, strace, ltrace…

02loveslollipop/OpenCROW · 102 tokens

opencrow-pwn-toolbox

Use the best available portable Python runtime and installed exploit tooling for binary exploitation and runtime-debugging tasks. Prefer a detected ctf environment. Use when an agent needs pwntools, pwndbg, gdb, checksec, patchelf, qemu-user, pwninit, or other pwn-focused helpers.

02loveslollipop/OpenCROW · 82 tokens

reverse-shell-async

Manage one authorized inbound reverse-shell TCP session asynchronously without generating a callback payload. Use for CTF challenges, isolated labs, or systems you own when an agent must listen safely, exchange text or exact bytes, inspect captured output, and stop the named listener without blocking its main workflow.

02loveslollipop/OpenCROW · 61 tokens