Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dearlordylord/huly-mcp --skill huly-cligit clone --depth 1 https://github.com/dearlordylord/huly-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dearlordylord/huly-mcp/huly-cli)<a href="https://agentmods.dev/skills/dearlordylord/huly-mcp/huly-cli"><img src="https://agentmods.dev/badge/skills/dearlordylord/huly-mcp/huly-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dearlordylord/huly-mcp/huly-cli"><img src="https://agentmods.dev/badge/skills/dearlordylord/huly-mcp/huly-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00861 |
| Opus 5.5 | $0.00022 | $0.00344 |
| Sonnet 5.5 | $0.00011 | $0.00172 |
| Haiku 4.5 | $0.00006 | $0.00086 |
Grade A, and why
huly-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Huly CLI
Use the CLI's own help and JSON contracts as the authority. Do not memorize or reproduce its complete command catalog.
Set up authentication
Install the package with pnpm add --global @firfi/huly-cli, then run:
huly auth login
huly auth status --json
Use huly profile create|list|select|update for named URL, workspace, and default-project contexts. CLI selection uses --profile, then HULY_PROFILE, then the active profile. Stdio requires explicit HULY_PROFILE and never follows the active CLI selection. Saved tokens are bound to their exact URL/workspace: destination edits require login again. Complete environment destination and credentials may override them without being persisted; partial overrides fail. Never print, copy into chat, or persist a password; login stores only the returned token in the operating system's user config directory.
Key local command surfaces:
huly resident status [--state-directory <path>] [--json]
huly resident stop --generation <uuid> [--state-directory <path>] [--json]
huly auth import-token [--storage file|os] [--profile <name>] [--stdin] [--json]
huly auth check [--profile <name>] [--json]
huly auth login [--storage file|os] [--profile <name>] [--json]
huly auth status [--profile <name>] [--json]
huly auth logout [--profile <name>] [--json]
huly profile create <name> --url <url> --workspace <workspace> [--default-project <project>] [--json]
huly profile list [--json]
huly profile select <name> [--json]
huly profile update <name> [--url <url>] [--workspace <workspace>] [--default-project <project> | --clear-default-project] [--json]
Use huly resident status --json to inspect protected local ownership records.
Add --state-directory <path> to inspect an explicit namespace. This command
does not start a backend, acquire an adapter or change records. Authenticated
generation observations report MCP readiness, admission, adapter/request counts
and drain state. Unavailable observations leave recovery unverified. Neither
live observations nor filesystem snapshots prove retirement; never infer
permission to kill a PID, delete state or replay an operation from this output.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +16 lines 3258d2bfd80e
- 9d ago Changed · +2 lines 3f41f5557bf1
- 23d ago Changed 58c3dfbfce7b
- 1mo ago First seen · 58 lines · 56 tokens per session scan A 9d7af84984e7
huly-cli is a skill published in the GitHub repository dearlordylord/huly-mcp (59 stars, last pushed yesterday), licensed MIT. It adds 56 tokens to every session and 861 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
typed-events
Type-safe validated wrappers for browser CustomEvent, BroadcastChannel, and window.postMessage APIs using any standard-schema-compatible validator (zod, valibot, arktype). Use when implementing createEvent, createEventMap, createBroadcastChannel, createBroadcastEvent, or createMessage. For React hooks (useListener…
eslint-config
Composable ESLint flat config for TypeScript projects. Use config() with presets.base spread to activate baseline, javascript, typescript, imports, jsdoc, unicorn, perfectionist, prettier, regexp, command, packagejson, pnpm, gitignore, node, e18e configs. autoEnable detects installed packages (astro, svelte, lit…
typed-env
Validate and type process.env environment variables at runtime using createEnvironment with a standard-schema-compatible validator. Supports zod, valibot, and arktype only. Use when setting up environment validation, auto-loading .env files via dotenvx, or generating .env.example placeholder files from a schema shape.
project-setup-info-local
Comprehensive setup steps to help the user create complete project structures in a VS Code workspace; this tool is designed for full project initialization and scaffolding, not for creating individual files. When to use this tool: user wants to create a new complete project from scratch; setting up entire project…
record-gotchas
Capture surprises, workarounds, and rough edges hit while consuming the public surface of Prisma 8, Prisma Compute, or Prisma Postgres — anything a real user of these products would experience. Fires whenever an operator (or agent) writes a workaround, hits a surprising failure mode, or finds undocumented behaviour…
opendia-harness
Install, configure, and troubleshoot OpenDia for Grok Build (and other MCP harnesses). Use when setting up the plugin, config.toml MCP entry, ports, extension disconnects, tool timeouts, or tunnel mode.