Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add finom/vovk --skill toolsgit clone --depth 1 https://github.com/finom/vovkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/finom/vovk/tools)<a href="https://agentmods.dev/skills/finom/vovk/tools"><img src="https://agentmods.dev/badge/skills/finom/vovk/tools/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/finom/vovk/tools"><img src="https://agentmods.dev/badge/skills/finom/vovk/tools.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 445 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00259 | $0.06064 |
| Opus 5.5 | $0.00104 | $0.02426 |
| Sonnet 5.5 | $0.00052 | $0.01213 |
| Haiku 4.5 | $0.00026 | $0.00606 |
Grade A, and why
tools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 486 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vovk.ts LLM tools
deriveTools({ modules }) turns existing procedures (controllers, RPC modules, OpenAPI mixins) into tools automatically. It returns an array of tools, each satisfying StandardToolV0 — { name, title?, description, inputSchema?, outputSchema?, execute }.
Standalone tools (no procedure backing — SDK wrappers, calculators, file ops) are plain objects of the same shape; the standard-tool package's standardTool() helper adds input/output validation. Both mix freely in one array and feed to OpenAI / Anthropic / Vercel AI SDK / MCP servers.
v4 removed
createTool,VovkTool,parameters,typeandinputSchemas. Tools are the standard-tool shape now: one mergedinputSchemainstead ofparameters+inputSchemas, andderiveToolsreturns the array directly instead of{ tools, toolsByName }.
Out of scope: procedure authoring (procedure), @operation for OpenAPI docs (openapi), third-party OpenAPI mixin setup (mixins). MCP server transport / hosting outside Vovk; for Next.js, recommended runtime is mcp-handler npm package — example below.
Import path note. Code samples import from
'@/client': the composed client generated intosrc/client(orclient/when the app isn't insrc/app). CustomcomposedClient.outDirchanges the path. With segmented client, import from@/client/<segment>. Call shape identical. Seerpcskill.
deriveTools — core shape
import { deriveTools } from 'vovk';
import { TaskRPC, PetstoreAPI } from '@/client';
import UserController from '@/modules/user/user-controller';
const tools = deriveTools({
modules: { UserController, TaskRPC, PetstoreAPI },
});
modules accepts record of:
- Controllers — execute via
.fn()in-process, no HTTP. - RPC modules (from
@/client, or@/client/<segment>for segmented layout) — execute via HTTP using standard fetcher. - OpenAPI mixins (same client surface) — execute via HTTP against third-party API. See
mixinsskill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines · +1 tokens per session 1a43f6cc9b70
- 6d ago Changed · +2 lines 03823f9f1587
- 10d ago Changed · -6 lines 98b882b81964
- 11d ago Changed · +1 lines 31f80cba3076
- 12d ago Changed b9de91d0feca
- 17d ago Changed · -2 lines · -3 tokens per session c35443a83a33
- 1mo ago First seen · 490 lines · 261 tokens per session scan A 45d4e4c60634
tools is a skill published in the GitHub repository finom/vovk (53 stars, last pushed 2d ago), licensed MIT. It adds 259 tokens to every session and 6,064 once invoked, about $0.0010 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ocli-api
Turn any OpenAPI, Swagger, or OpenRPC API into CLI commands and call them. Search endpoints with BM25, check parameters, execute — no MCP server needed.
webmcp
Build agent-friendly web apps with the W3C Web Model Context API (WebMCP). Use when exposing frontend features as structured tools for in-browser AI agents, adding document.modelContext tools to React/Next.js apps, designing tool schemas for dashboards or admin UIs, or making existing UI automatable without DOM…
composition-patterns
Design reusable React component APIs that scale — compound components, lifted state, generic context, explicit variants. Use when a component is growing boolean props (isThread, isEditing…), when building a component library, or when reviewing component architecture. Includes React 19 API changes.
domain-driven-design
Model software around the business domain — bounded contexts, aggregates, entities vs value objects, domain events, and ubiquitous language. Use when writing an SRS/SDD, deciding how to split features into RonyKit service modules, designing internal/domain types, placing invariants, integrating with another service or…
add-resource
Add a complete REST resource (controller, validation, errors, and tests) to a Chassis project the idiomatic way. Use when the user asks to add an endpoint, resource, CRUD, model, or route to a Chassis / decorator-driven Express + TypeScript backend.
expressjs-development
Comprehensive Express.js development skill covering routing, middleware, request/response handling, error handling, and building production-ready REST APIs.