Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/extra-org/extra/mcp-toolsnpx skills add extra-org/extra --skill mcp-toolsgit clone --depth 1 https://github.com/extra-org/extraWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.00440 |
| Opus 5 | $0.00018 | $0.00220 |
| Sonnet 5 | $0.00007 | $0.00088 |
| Haiku 4.5 | $0.00004 | $0.00044 |
Grade A, and why
mcp-tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: MCP & Tools
When to use this skill
Use this when working on Python plugin tools, MCP server connections, tool
invocation, or tool tracing. Primary task:
tasks/0007-mcp-tools-and-permissions.md.
Files to read first
AGENTS.mddocs/MCP_AND_TOOLS.mddocs/RUNTIME_LIFECYCLE.md
Architecture rules
- Resolver plugins run before a node; tool plugins are exposed to the LLM during execution.
- MCP clients are created once and shared; never per request.
- Per-request data flows via
ExecutionContext/ctx. - Prompt text is not a security boundary.
- Secrets never live in YAML; they are redacted in traces.
Implementation rules
- Implement tool registry and MCP integration in
src/agentplatform/tools. - Load plugin classes once where possible.
- Invoke configured class/method references with
ctx. - Validate tool and MCP ids during validation/compilation; runtime should use resolved bindings.
- Hold MCP clients on the long-lived runtime.
Validation checklist
- Tool plugin references load and invoke through the registry.
- MCP connections are created once and reused.
- Per-request context does not leak through shared state.
- Tool/MCP calls are traced with redaction.
- Tests cover success and failure with fakes.
-
make checkpasses.
Common mistakes to avoid
- Recreating MCP connections per request.
- Treating resolvers as tools or tools as resolvers.
- Skipping trace redaction.
- Relying on prompt wording for enforcement.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 61 lines · 36 tokens per session scan A f672165c6def
mcp-tools is a skill published in the GitHub repository extra-org/extra (108 stars, last pushed 4d ago), licensed MIT. It adds 36 tokens to every session and 440 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-doc-delivery
Convert markdown to DOCX, PPTX, XLSX, PDF office documents — use when you need exportable deliverables.
skill-copilot-provider
GitHub Copilot CLI as optional zero-cost provider via copilot -p programmatic mode.
skill-intent-contract
Use when starting a complex or ambiguous task that risks scope drift.
skill-security-framing
URL validation and content sanitization for untrusted sources — use when handling external input safely.
argent-tv-interact
Control and inspect TV apps via argent — Apple TV (tvOS), Android TV (leanback), and Amazon Fire TV (Vega). Boot the target, read focus, navigate with the D-pad remote, type, screenshot, and on Vega debug the JS runtime (evaluate, console logs, network inspector). Use when a task targets a TV (runtimeKind "tv", or…
bernstein-approve
Review and approve/reject pending tasks or plans in Bernstein. Use when the user asks about approvals, wants to review agent work, or needs to approve/reject a plan before execution begins.