Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/firelock-ai/kin/kin-setupnpx skills add firelock-ai/kin --skill kin-setupgit clone --depth 1 https://github.com/firelock-ai/kinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/firelock-ai/kin/kin-setup)<a href="https://agentmods.dev/skills/firelock-ai/kin/kin-setup"><img src="https://agentmods.dev/badge/skills/firelock-ai/kin/kin-setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.01003 |
| Opus 5 | $0.00028 | $0.00502 |
| Sonnet 5 | $0.00011 | $0.00201 |
| Haiku 4.5 | $0.00006 | $0.00100 |
Grade C, and why
kin-setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`curl -fsSL https://get.kinlab.dev/install | sh` on macOS or Linux, Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -fsSL https://get.kinlab.dev/install | sh` on macOS or Linux, How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Getting Kin answering for this repository
The plugin bundles the Kin MCP server and starts it automatically when the plugin is enabled. Nothing needs to be added to a settings file. What the server still needs is a repository that has been admitted into Kin, because it answers from a graph rather than from the files on disk.
Work through the steps in order and stop at the first one that already passes.
1. Check what is already there
Call kin_graph_status. A response with entity and relation counts means the server is
connected and this repository is admitted, and there is nothing to set up. Note the
embedding coverage it reports, because semantic_locate depends on it.
If the tools are not available at all, the server did not start. It runs
npx -y @kinlab/kin-mcp, so it needs Node 20 or newer on PATH, and on its first run it
needs network access to download the matching Kin release. That first run fetches the
release archive for this platform, verifies the SHA-256 published beside it, and extracts
the kin and kin-daemon binaries into a per-user cache. Later runs use the cache.
2. Admit the repository
If the server reports no repository, this directory has no .kin/ yet. The wrapper says so
plainly: it refuses to start against a directory with no .kin/ unless it is allowed to
create one.
Ask the user which they want, and say what each does:
- Run
kin init .in the repository. In a Git repository this admits the complete reachable history, refs, raw objects, the exact workspace tree, and the derived semantic entity and relation layer. Uncommitted work is not lost: init admits the committed state and reports what it did not admit. - Or set
KIN_MCP_AUTO_INIT=1in the server's environment, which lets the wrapper runkin init .itself when.kin/is missing. Convenient, and worth naming out loud before turning on, because it means an agent session can admit a repository without being asked.
Admission is a one-time cost that scales with history depth rather than checkout size.
Seconds on a small repository, minutes on one with thousands of commits, and the store it
writes under .kin/ can be considerably larger than the Git object store it came from.
kin init prints its phase ladder while it runs, so the terminal is never silent.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 79 lines · 57 tokens per session scan C 3df90799b6f3
kin-setup is a skill published in the GitHub repository firelock-ai/kin (47 stars, last pushed today), licensed Apache-2.0. It adds 57 tokens to every session and 1,003 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rust-cargo-fast-iteration-profile
Speed up Rust development iteration when cargo build --release takes 10+ minutes even for one-line edits. Use when: (1) every release rebuild takes minutes despite tiny edits, (2) Cargo.toml has lto = "fat" and/or codegen-units = 1 in [profile.release], (3) you want a production- shaped build for testing without…
rust-embed-rebuild-invalidation
Force rust-embed to re-embed assets from $GRAFEMAUIDIST (or any env-driven path) when cargo's incremental compilation skips the macro re-expansion. Use when: (1) you rebuilt the GUI bundle but the rust-server binary still serves the OLD bundle, (2) cargo build --release finishes in seconds (incremental hit) and…
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
agent-session-monitor
Real-time agent conversation monitoring - monitors Higress access logs, aggregates conversations by session, tracks token usage. Supports web interface for viewing complete conversation history and costs. Use when users ask about current session token consumption, conversation history, or cost statistics.
greptimedb-release
Runbook for publishing a new GreptimeDB version (tag + GitHub release + docs release-note PR) on the upstream GreptimeTeam/greptimedb repo. Use when asked to "release" / "publish" a GreptimeDB version (e.g. v1.1.0, v1.0.3).
stack-merge
Bulk-merge a Graphite stack into main via admin-bypass fast-forward push. Replaces the Graphite merge queue for rivet-dev/rivet. Invoke when the user says "merge the stack at ", "ship everything through ", "bulk-merge up to ", "fast-forward main to ", or any request to land multiple stacked PRs at once in one shot.…