Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dtkmn/mcp-zap-server --skill setup-local-scannergit clone --depth 1 https://github.com/dtkmn/mcp-zap-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dtkmn/mcp-zap-server/setup-local-scanner)<a href="https://agentmods.dev/skills/dtkmn/mcp-zap-server/setup-local-scanner"><img src="https://agentmods.dev/badge/skills/dtkmn/mcp-zap-server/setup-local-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dtkmn/mcp-zap-server/setup-local-scanner"><img src="https://agentmods.dev/badge/skills/dtkmn/mcp-zap-server/setup-local-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02884 |
| Opus 5.5 | $0.00023 | $0.01154 |
| Sonnet 5.5 | $0.00011 | $0.00577 |
| Haiku 4.5 | $0.00006 | $0.00288 |
Grade B, and why
setup-local-scanner scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **Codex:** use its existing user configuration (`~/.codex/config.toml`, or How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set up the local scanner
Help the user reach an authenticated local MCP connection using the existing Docker Compose setup. This skills-only plugin supplies instructions; installing it does not install Docker, start containers or register MCP tools. Explicit user instructions take precedence.
Configure only the client the user requested. A Cursor setup must leave Codex settings unchanged, and a Codex setup must leave Cursor settings unchanged. For a pure status-only request through an existing connection, go directly to that client's passive-status call; setup prerequisites must not block it.
Check prerequisites and reuse the project
- Commands must execute on the user's machine, where the requested client can reach the scanner's loopback endpoint. A remote or web-only execution host does not establish access to the user's local scanner.
- For setup or restart, identify the host OS and architecture. Check Bash,
Docker with a reachable engine, and Compose supporting
--waitand--wait-timeout. Check Git when cloning is needed, OpenSSL when creating new settings, and the bootstrap/doctor utilities documented in the project. Java and ZAP run inside containers; no host Java installation is required. - If a prerequisite check fails, follow the recovery steps below before continuing. Preserve existing installations and the selected Docker context.
Resolve missing prerequisites
- Distinguish missing software from a missing PATH entry, a stopped engine or an access error. Locate an installed executable or Docker Desktop first; use its full path or a session-only PATH adjustment before proposing another installation. Do not change shell startup files or Docker contexts as a shortcut.
- Explain the missing tool and propose the specific download, installation or update, including any administrator access or Docker restart it requires. Obtain approval before downloading or installing prerequisites, updating software or restarting an existing engine. Reuse explicit approval already given for those steps; a scanner setup request alone does not authorize software installation. If approval is declined, leave setup incomplete and provide the manual next step.
- On macOS, follow the official Docker Desktop installation guide, matching the host's chip and supported OS. Docker Desktop includes Compose; do not install a competing engine to repair its CLI or Compose. For missing Git, use the official macOS installation options, such as Apple's Command Line Tools or an existing package manager. Do not install another package manager just to complete setup. For other systems, use the vendor's platform-specific Docker/Compose and Git instructions; state that this project's verified onboarding is on Apple Silicon macOS.
- Carry out only approved steps within the host's permissions. Leave license acceptance, account sign-in, password entry and OS security prompts to the user. If a step requires their interaction or an app restart, explain it and wait for completion. Preserve macOS quarantine and security checks. A download or installer exit is not proof that the tool is usable.
- If Docker is installed but stopped, start the existing application as part of the requested setup and wait a bounded time for its engine. For an access error, diagnose the selected endpoint and permissions before proposing a repair; do not run setup as root or change permissions automatically.
- After approved changes or the user's manual step, rediscover executable
paths and recheck Bash, required utilities, Git when needed,
docker info,docker compose version, and both flags indocker compose up --help. Continue the original setup below only when the needed checks pass. If they still fail, explain the remaining blocker; retry after an identified fix, rather than repeatedly installing software or changing client settings. - A loaded Desktop skill does not require a separate Codex CLI installation for scanner setup. The direct GitHub plugin installation commands need the CLI before this skill is available. For that prerequisite, follow Check The Codex CLI: check the desktop app's bundled CLI first, then guide an approved installation only if needed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +49 lines · +5 tokens per session 7a328d2fc429
- 3d ago Changed · +61 lines · +2 tokens per session scan A → B 005318b1a79e
- 5d ago Changed · +39 lines · +5 tokens per session 36bc7d6dd46e
- 6d ago First seen · 77 lines · 45 tokens per session scan A d6edfeae868f
setup-local-scanner is a skill published in the GitHub repository dtkmn/mcp-zap-server (67 stars, last pushed today), licensed Apache-2.0. It adds 57 tokens to every session and 2,884 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-10.
Other skills, from other repositories
java-spring-ai
Use when the user asks to add AI features, integrate Spring AI or LangChain4J, build a chatbot, implement RAG (retrieval-augmented generation), use vector stores, stream LLM responses, or call AI tools/functions in a Spring Boot project.
spring-boot-expert
Expert-level Spring Boot, Spring Framework, REST APIs, and microservices development. Use when the user mentions Java, Spring framework, REST APIs, or microservices, or when the task involves Spring Boot Fundamentals.
scraperapi-java-sdk
Best-practices reference for the ScraperAPI Java SDK (com.scraperapi:sdk Maven artifact). Consult whenever the user is writing, debugging, or reviewing Java code that calls ScraperAPI. Use when user asks: "scrape a website with Java and ScraperAPI", "ScraperAPI Java example", "how do I add ScraperAPI to my Maven…
ax-java-gen
Use when writing Java code with dev.axllm:ax for AxGen programs, forward calls, indexed multi-sampling, result pickers, streaming, tools, assertions, traces, usage, and output parsing.
strategy-agent
Market strategy analyst performing SWOT, competitive positioning, market-timing assessment, and go-to-market recommendations from research findings. Use after the research-agent has produced market data.
mcp-analyze-topic
Expert analyst persona used by the MCP analyze-topic tool to produce structured topic analyses. Use when invoked through the Atmosphere MCP server's analyze-topic tool.