Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add getpapi/papi --skill check-mcpgit clone --depth 1 https://github.com/getpapi/papiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/getpapi/papi/check-mcp)<a href="https://agentmods.dev/skills/getpapi/papi/check-mcp"><img src="https://agentmods.dev/badge/skills/getpapi/papi/check-mcp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/getpapi/papi/check-mcp"><img src="https://agentmods.dev/badge/skills/getpapi/papi/check-mcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.00930 |
| Opus 5.5 | $0.00023 | $0.00372 |
| Sonnet 5.5 | $0.00012 | $0.00186 |
| Haiku 4.5 | $0.00006 | $0.00093 |
Grade B, and why
check-mcp scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
clients only read MCP config at startup. How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Is PAPI connected?
PAPI runs as a hosted MCP server at https://mcp.getpapi.ai/mcp. Nothing runs on the
user's machine, so a failure is one of three things: the server is not registered, the
user is not signed in, or the account has no project bound.
Work through the steps in order and stop at the first one that fails. The checks are the same in every client; only the commands differ, so use the ones for the tool you are running in.
Step 1: Are the tools there?
Look at the available tools list for PAPI tools such as orient, board_view and plan.
Tool names vary by how PAPI was installed. Installed as a plugin in Claude Code they are
namespaced mcp__plugin_papi_papi__orient; added directly they are mcp__papi__orient;
other clients use their own prefixes. All of them mean the same server.
If PAPI tools are present, skip to Step 3. If none are, go to Step 2.
Step 2: Is the server registered?
Check the client's MCP configuration.
- Claude Code: run
claude mcp list. To install, run/plugin marketplace add getpapi/papithen/plugin install papi@papi, orclaude mcp add --transport http papi https://mcp.getpapi.ai/mcp. - Cursor: open Settings, then MCP, and look for
papi. Config lives in~/.cursor/mcp.jsonor.cursor/mcp.jsonin the project. - VS Code, Windsurf, Codex and others: check that client's MCP config for a
papientry pointing athttps://mcp.getpapi.ai/mcp. Per-client instructions are at https://getpapi.ai/docs/install.
If papi is absent, PAPI is not installed. Add it, then restart the client, since most
clients only read MCP config at startup.
If papi is listed but shows an error or "needs authentication", go to Step 3.
Step 3: Is the user signed in?
The hosted server requires a PAPI account. Registering the server does not sign anyone in, and this is the most common cause of "PAPI is installed but nothing works".
Sign-in is interactive and cannot be done on the user's behalf.
- Claude Code: run
/mcp, choose papi, pick Authenticate. A browser tab opens. - Other clients: the client prompts for OAuth on first use. If it never does, the client may not support OAuth discovery. Fall back to an API key from the dashboard's Connect panel, set as a bearer token in the MCP config. See https://getpapi.ai/docs/install.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 78 lines · 58 tokens per session scan B 1a2df038f3e2
check-mcp is a skill published in the GitHub repository getpapi/papi (11 stars, last pushed yesterday), licensed MIT. It adds 58 tokens to every session and 930 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
memorix-troubleshooting
Use when Memorix MCP, setup, project binding, HTTP control plane, hooks, skills, or agent integration is missing, stale, or failing.
systematic-debugging
A step-by-step method for finding the underlying cause of technical problems before changing code. It covers reading errors, reproducing failures, checking recent changes, and tracing data across system components.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
issue-root-resolution
Trigger: root audit, atacar la raíz, issue roots, backlog roots, mechanism map, deletion-driven fix, resolver issues de raíz, close outdated issues. Audit and resolve issue clusters by verified root cause.
opik-diagnose
Surface the Opik traces worth a developer's attention, ranked by signal — Diagnostics issues first, then errors, failed tool calls, latency, regressions, and low online-eval scores. With the Opik MCP connected it lists the project's agentinsightsissue entities, offers to turn Diagnostics on when the project has it…
opik-explain
Root-cause a specific Opik trace, or a pattern across traces, and return a grounded explanation. Uses the hosted Opik MCP when it is connected, and falls back to SDK scripting otherwise. Returns the root cause, the evidence spans as clickable Opik UI links, and one suggested next step. Use for "why did this trace…