Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyanheads/pixoo-mcp-server --skill field-testgit clone --depth 1 https://github.com/cyanheads/pixoo-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyanheads/pixoo-mcp-server/field-test)<a href="https://agentmods.dev/skills/cyanheads/pixoo-mcp-server/field-test"><img src="https://agentmods.dev/badge/skills/cyanheads/pixoo-mcp-server/field-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cyanheads/pixoo-mcp-server/field-test"><img src="https://agentmods.dev/badge/skills/cyanheads/pixoo-mcp-server/field-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.09780 |
| Opus 5.5 | $0.00037 | $0.03912 |
| Sonnet 5.5 | $0.00019 | $0.01956 |
| Haiku 4.5 | $0.00009 | $0.00978 |
Grade B, and why
field-test scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
stats=$(curl -sS -o "$resp_file" -w '%{http_code} %{time_total}' -X POST "$url" "${headers[@]}" -d "$body") Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Exercise tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, measures every call (bytes, token estimate, wall-cl This is a copy
100% identical to field-test — 61 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 519 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context
Unit tests (add-test skill) verify handler logic with mocked context. Field testing exercises the real HTTP transport with real JSON-RPC: starts the server, calls initialize, surfaces the catalog, runs inputs, and checks what a client actually sees. It catches what unit tests miss — awkward input shapes, unhelpful errors, missing format output, drift between structuredContent and content[], edge-case surprises.
Actively call the tools. Don't read code and guess.
Transport coverage
This skill drives an HTTP server because curl + JSON-RPC is the most reliable harness for shell-based agents. The same handlers run on both transports — only the framing differs — so HTTP exercises the full functional surface. Both HTTP session modes are covered: a durable Mcp-Session-Id session, and the sessionless initialization a MCP_SESSION_MODE=stateless server performs.
Stdio coverage is a boot check only — run this before Step 1. Run bun run rebuild && bun run start:stdio < /dev/null, and confirm the startup logs look clean: the Core services constructed — N tool(s) … record lists every registered tool, resource, and prompt in its tools / resources / prompts fields — the message text shows only counts — and a definition missing from them was never passed to createApp(). No errors/warnings, no missing-config gripes. The emoji startup banner prints only to a terminal, so its absence from an agent's shell is not a finding. Redirecting stdin is what ends the run: the server treats EOF as a shutdown signal, boots fully, then exits on its own, so the log also shows the graceful-shutdown path. Do not background it and reach for pkill — a pattern like pkill -f dist/index.js matches every other stdio MCP server on the machine, including the ones the calling agent's own session is connected to. Pino logs go to stderr in stdio mode (stdout is reserved for JSON-RPC), so they print straight to the terminal when you run interactively. No need to call tools over stdio — the HTTP pass already covered handler behavior.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed 054082714121
- 27d ago Changed 748821c300f9
- 1mo ago Changed · +2 lines 62fbc6e452c2
- 1mo ago Changed · +124 lines · +17 tokens per session scan A → B 88d22478cafc
- 1mo ago First seen · 393 lines · 76 tokens per session scan A 5e0878fedc2a
field-test is a skill published in the GitHub repository cyanheads/pixoo-mcp-server (10 stars, last pushed 27d ago), licensed Apache-2.0. It adds 93 tokens to every session and 9,780 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). It is 100% identical to field-test, differing in 61 lines, and is treated as a copy.
Other skills, from other repositories
resolume-mcp-tester
Test and operate the Resolume MCP server (resolume-mcp-server) end-to-end against a live Resolume Arena. Use when verifying tool behavior, running smoke tests, doing safe live VJ demos, or validating new tools added to the project. Includes white-out prevention rules, state restoration patterns, and agent invocation…
blazemeter-private-locations
Comprehensive guide for BlazeMeter Private Locations, including Radar Agent, installation (Docker, Kubernetes, Helm), configuration, management, and troubleshooting. Use when working with Private Locations for (1) Installing agents (Docker, Kubernetes, Helm Chart), (2) Configuring Radar Agent for API Monitoring, (3)…
blazemeter-functional-testing
Comprehensive guide for BlazeMeter Functional Testing, including GUI Functional Tests, API Tests (deprecated), Action Library, and debugging. Use when working with Functional Testing for (1) Creating GUI Functional Tests (YAML, Java IDE, Python IDE), (2) Managing Functional Tests (duplicate, delete, move, rename), (3)…
blazemeter-recorders
Comprehensive guide for BlazeMeter Recorders, including Chrome Extension and Proxy Recorder. Use when working with recorders for (1) Recording tests with Chrome Extension, (2) Creating and using Proxy Recorder, (3) Configuring browsers and devices for proxy recording, (4) Setting port ranges for proxy recorder, or any…
verify-msp-skills
Drive one msp-skills connector (skills/ , any of the 84) the way a user does and prove it with evidence: install.sh, the -cli CLI, and the -mcp server over stdio and over HTTP, in an isolated HOME against a local fake vendor. Use to check a connector's user path before or after a reprint, to compare press versions…
lastest
Lastest is a visual regression testing platform. It records browser tests, runs them via Playwright, diffs screenshots, and uses AI to classify changes. Available as an MCP server for AI agent integration.