gerrit-mcp-server: Skill for Claude Code

.claude/skills/writing-extensions/SKILL.md

writing-extensions is a skill for Claude Code from GerritCodeReview/gerrit-mcp-server. It costs 57 tokens per session (3,488 once invoked), scanned A, original, Apache-2.0.

A guide for adding a new tool to gerrit-mcp-server, a server that lets software communicate with Gerrit, the code-review system built around Git. It explains the package structure and the function that registers the new tool.

In plain words
What is it for?
Use it when creating a Gerrit extension package, connecting it to the server’s ExtensionContext, or moving a standalone plugin into the server’s extension framework.
Why use it?
It helps developers extend the server without duplicating its authentication, configuration, or network code. It also avoids common packaging and workspace setup errors.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

This is GerritCodeReview/gerrit-mcp-server's own configuration. It tells Claude Code how to work on gerrit-mcp-server itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gerrit-mcp-server configures →

Part of the gerrit plugin — 5 skills, 1 hook, 1 MCP server shipped together

Reuse

Borrowing it

Nothing to install: this file belongs to GerritCodeReview/gerrit-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/GerritCodeReview/gerrit-mcp-server/master/.claude/skills/writing-extensions/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/GerritCodeReview/gerrit-mcp-server

Made for: Claude Code.

Or install gerrit, the plugin that ships this one along with the rest of its 5 skills, 1 hook, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for writing-extensions

README.md
[![agentmods](https://agentmods.dev/badge/skills/gerritcodereview/gerrit-mcp-server/writing-extensions.svg)](https://agentmods.dev/skills/gerritcodereview/gerrit-mcp-server/writing-extensions)
Your own site
<a href="https://agentmods.dev/skills/gerritcodereview/gerrit-mcp-server/writing-extensions"><img src="https://agentmods.dev/badge/skills/gerritcodereview/gerrit-mcp-server/writing-extensions.svg" alt="Measured on agentmods" height="20"></a>
Per session 57 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,488 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00057 $0.03488
Opus 5 $0.00028 $0.01744
Sonnet 5 $0.00011 $0.00698
Haiku 4.5 $0.00006 $0.00349

Measured 7d ago against content hash 37492a246ea5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

writing-extensions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/writing-extensions/SKILL.md · 370 lines

How it starts

The opening of the file, as written. The whole thing — 370 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Writing a gerrit-mcp-server Extension

Extensions register new MCP tools inside the running gerrit-mcp-server process via the gerrit_mcp_server.extensions entry-point group. They share the server's auth, config, and HTTP machinery through the stable ExtensionContext API.

1. Package layout

Each extension is a standalone Python package:

myext/
├── __init__.py          # empty
├── extension.py         # defines register(ctx)
└── pyproject.toml       # declares the entry point

This is a flat layout (package files alongside pyproject.toml rather than in a src/myext/ subdirectory). It requires an explicit package-dir in pyproject.toml — see section 8. Without it, setuptools looks for a ./myext/ subdirectory and the build fails with package directory 'myext' does not exist.

If the extension is a workspace member of a uv workspace, it lives at the repo root alongside other workspace members.

2. The register(ctx) contract

extension.py must export a top-level register(ctx: ExtensionContext) -> None. The server calls it once at startup.

from gerrit_mcp_server.extensions import ExtensionContext

def register(ctx: ExtensionContext) -> None:
    """Register all tools for this extension."""

    @ctx.mcp.tool()
    async def my_tool(change_id: str, gerrit_base_url: str = None) -> str:
        """One-line description shown in the MCP tool list."""
        base_url = ctx.get_base_url(gerrit_base_url)
        result = await ctx.run_curl([f"{base_url}/changes/{change_id}"], base_url)
        return result

All tools must be async def. ctx.mcp.tool() is a FastMCP decorator — register as many tools as needed.

3. Structured return types

All tools should declare a TypedDict return type rather than manually building [{"type": "text", "text": ...}] content blocks. The MCP SDK auto-generates a JSON output_schema from the annotation and produces both structured content (for clients that support it) and a text fallback (for those that don't).

Read the full file on GitHub · 370 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 370 lines · 57 tokens per session scan A 37492a246ea5

Subscribe to this mod's changes

writing-extensions is a skill published in the GitHub repository GerritCodeReview/gerrit-mcp-server (20 stars, last pushed 3d ago), licensed Apache-2.0. It adds 57 tokens to every session and 3,488 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.