Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/datit309/supergraph/serenanpx skills add datit309/supergraph --skill serenagit clone --depth 1 https://github.com/datit309/supergraphWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.01482 |
| Opus 5 | $0.00020 | $0.00741 |
| Sonnet 5 | $0.00008 | $0.00296 |
| Haiku 4.5 | $0.00004 | $0.00148 |
Grade A, and why
serena scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/supergraph:serena
Activate Serena MCP for LSP-powered code intelligence: symbol navigation, type diagnostics, and safe code surgery.
CRITICAL: Call initial_instructions first when starting any Serena work — it loads the Serena Instructions Manual with project-specific context.
When to Use
- Before complex refactors: rename across codebase, API signature changes
- When blast radius is unclear and graph tools lack symbol-level depth
- Before review: verify all call sites of changed symbols are updated
- During fix: triage type errors before running test suite
- After architectural changes: verify no orphaned references remain
- Large-scale refactors: safe_delete_symbol, rename_symbol across entire project
Setup
1. Load instructions (MANDATORY first step)
mcp__plugin_serena_serena__initial_instructions()
# or
mcp__serena__initial_instructions()
2. Activate project
mcp__plugin_serena_serena__activate_project()
3. Get project overview
mcp__plugin_serena_serena__get_symbols_overview()
Returns top-level symbols, classes, functions — fast structural map of the codebase.
Tool Reference
Navigation
| Tool | Use case |
|---|---|
find_symbol |
Locate a symbol by name across codebase |
find_declaration |
Jump to where a symbol is declared |
find_implementations |
Find all implementations of an interface / abstract class |
find_referencing_symbols |
Find all callers and usages of a symbol |
Setup / Lifecycle
| Tool | Use case |
|---|---|
activate_project |
Register project with Serena — requires mcp__plugin_serena_serena__ namespace |
get_current_config |
Read Serena's current project configuration |
open_dashboard |
Open the Serena dashboard UI |
execute_shell_command |
Run shell commands (use with caution — confirm before destructive ops) |
Diagnostics
| Tool | Use case |
|---|---|
get_diagnostics_for_file |
IDE-level type errors, lint warnings for a specific file |
get_symbols_overview |
Project structure overview — top-level symbols map |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 164 lines · 40 tokens per session scan A a01c86a69b1d
serena is a skill published in the GitHub repository datit309/supergraph (21 stars, last pushed 5d ago), licensed MIT. It adds 40 tokens to every session and 1,482 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
playwright-cli
Automates browser interactions for testing and validating your own web applications using playwright-cli. Use when you need terminal-first browser control for navigation, form filling, screenshots, tracing, bound browser sessions, debugging, or generating Playwright test code. Only use against applications you own or…
migrate
Inventory an existing spec-driven project and apply bounded migrations to jig defaults: report, adopt-layout, rename-decisions, split-slices, slice-to-spec, seed-decisions, and copy-machinery. Use when the user says migrate this project to jig, adopt jig here, this repo already has specs — set up jig, scaffold-init…
adr-workflow
Scaffold, accept, index, and link Architectural Decision Records (ADRs). Use when the user says "write an ADR", "record this decision", "resolve [deferred item] with an ADR", "supersede ADR-NNNN", or otherwise wants to capture a hard-to-reverse decision in docs/decisions/. Also use when a refinement-todo entry needs…
bug-fix
Drive the teeth-gated lifecycle for reported defects: diagnose root cause, prove it, and prevent regression through REPORTED → DIAGNOSING → ROOTCAUSED → FIXING → REVIEWED → DONE, with VERIFIED, ESCALATED, and RESOLVEDONMAIN paths where needed. Auto-fires on fix this bug, debug this, root-cause this, this regressed…
vision-elicitation
Lightweight baseline elicitation pass that fills in docs/product-vision.md and the five docs/architecture.md elicitation slots after scaffold-init. Auto-triggers when you say set up project vision, elicit architecture, define what we're building, run the vision wizard, refresh the project pitch, or capture product…
analyze
Cross-artifact consistency report for jig specs — a non-destructive six-category audit at CRITICAL/HIGH/MEDIUM/LOW severity, covering duplication, ambiguity, underspecification, principle violations, coverage gaps, and terminology drift. Auto-triggers when you say analyze this spec, check for inconsistencies, audit…