Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add elihucredible450/keenetic-mcp --skill keenetic-safe-changesgit clone --depth 1 https://github.com/elihucredible450/keenetic-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/elihucredible450/keenetic-mcp/keenetic-safe-changes)<a href="https://agentmods.dev/skills/elihucredible450/keenetic-mcp/keenetic-safe-changes"><img src="https://agentmods.dev/badge/skills/elihucredible450/keenetic-mcp/keenetic-safe-changes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/elihucredible450/keenetic-mcp/keenetic-safe-changes"><img src="https://agentmods.dev/badge/skills/elihucredible450/keenetic-mcp/keenetic-safe-changes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.00759 |
| Opus 5 | $0.00023 | $0.00380 |
| Sonnet 5 | $0.00009 | $0.00152 |
| Haiku 4.5 | $0.00005 | $0.00076 |
Grade A, and why
keenetic-safe-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to keenetic-safe-changes — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Changing a Keenetic router without breaking it
Changes are not saved until someone says so
A change through this server applies to the running configuration immediately and is discarded on reboot. That is a safety feature, not a bug: a mistake undoes itself if the router restarts.
Every write tool tells you this in its response:
{ "applied": { "access": "deny" }, "saved": false, "unsavedChanges": true,
"backup": "/…/192.168.1.1-2026-08-07T01-20-36-000Z.txt" }
save_config is the only thing that makes a change permanent. Call it only
when the user has confirmed the result is what they wanted, never
automatically as part of a change. If they never call it, nothing is lost that
they cared about keeping.
Use get_config_state to see whether anything is pending.
The router's fail-safe protects less than it sounds like
Keenetic arms a three-minute timer when the configuration changes, and reverts to the saved configuration if the management session loses connectivity.
That protects against locking yourself out. It does not protect against a change that is simply wrong: block the wrong device and the router stays perfectly reachable, so nothing reverts.
A backup is taken for you
Before the first change of a session, the startup configuration is downloaded to a local file. The path is in every write response. Mention it to the user the first time something is changed, so they know a way back exists.
backup_config takes one on demand, which is worth doing before a sequence of
related changes.
Order matters for devices
A device must be registered before its access, policy, schedule or priority can
be set. Setting a name registers it, so if you are configuring a device the
router has only seen and not registered, set the name in the same
update_device call. The tool already applies name first.
Symptom of getting this wrong: host "..." is unregistered.
What can cut off your own access
set_interface_state with state: "down" is the one genuinely dangerous tool
here. Taking down a bridge, the WAN link, or the interface carrying the
management session ends the conversation with the router, and the fail-safe
reboot is then the only way back.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 82 lines · 46 tokens per session scan A a59205c04897
keenetic-safe-changes is a skill published in the GitHub repository elihucredible450/keenetic-mcp (0 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 759 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to keenetic-safe-changes, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
keenetic-segments
Use when creating an isolated network on a Keenetic - a guest network, an IoT network, a segment routed through a VPN - explains why the obvious way produces a working network the web interface refuses to list, and the VLAN it is actually missing.
keenetic-rci
Use when a Keenetic question is not covered by the curated tools and you need rcicall - explains the RCI tree, the paths that exist, the responses that will blow up your context, and the traps that make a wrong call look like success.
keenetic-troubleshoot
Use when someone reports the internet is down, Wi-Fi is bad, a device cannot connect, or the network is slow on a Keenetic router - an ordered playbook that narrows the fault instead of guessing.
keenetic-safe-changes
Use before changing anything on a Keenetic router - explains that changes are not saved until asked, what the router's fail-safe does and does not protect against, and the order that avoids locking yourself out.
telephony-and-conferencing
Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and its retention consequences, and the porting that makes provider changes go badly. Use this to replace a phone system, fix rooms nobody can start a meeting in, meet…
endpoint-management
Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices. Use this to set up device management, standardize builds, roll out software or an OS upgrade, handle a lost device, or bring an unmanaged fleet under control.