Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/getpapi/papi/check-mcpnpx skills add getpapi/papi --skill check-mcpgit clone --depth 1 https://github.com/getpapi/papiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00058 | $0.00930 |
| Opus 5 | $0.00029 | $0.00465 |
| Sonnet 5 | $0.00012 | $0.00186 |
| Haiku 4.5 | $0.00006 | $0.00093 |
Grade B, and why
check-mcp scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
clients only read MCP config at startup. How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Is PAPI connected?
PAPI runs as a hosted MCP server at https://mcp.getpapi.ai/mcp. Nothing runs on the
user's machine, so a failure is one of three things: the server is not registered, the
user is not signed in, or the account has no project bound.
Work through the steps in order and stop at the first one that fails. The checks are the same in every client; only the commands differ, so use the ones for the tool you are running in.
Step 1: Are the tools there?
Look at the available tools list for PAPI tools such as orient, board_view and plan.
Tool names vary by how PAPI was installed. Installed as a plugin in Claude Code they are
namespaced mcp__plugin_papi_papi__orient; added directly they are mcp__papi__orient;
other clients use their own prefixes. All of them mean the same server.
If PAPI tools are present, skip to Step 3. If none are, go to Step 2.
Step 2: Is the server registered?
Check the client's MCP configuration.
- Claude Code: run
claude mcp list. To install, run/plugin marketplace add getpapi/papithen/plugin install papi@papi, orclaude mcp add --transport http papi https://mcp.getpapi.ai/mcp. - Cursor: open Settings, then MCP, and look for
papi. Config lives in~/.cursor/mcp.jsonor.cursor/mcp.jsonin the project. - VS Code, Windsurf, Codex and others: check that client's MCP config for a
papientry pointing athttps://mcp.getpapi.ai/mcp. Per-client instructions are at https://getpapi.ai/docs/install.
If papi is absent, PAPI is not installed. Add it, then restart the client, since most
clients only read MCP config at startup.
If papi is listed but shows an error or "needs authentication", go to Step 3.
Step 3: Is the user signed in?
The hosted server requires a PAPI account. Registering the server does not sign anyone in, and this is the most common cause of "PAPI is installed but nothing works".
Sign-in is interactive and cannot be done on the user's behalf.
- Claude Code: run
/mcp, choose papi, pick Authenticate. A browser tab opens. - Other clients: the client prompts for OAuth on first use. If it never does, the client may not support OAuth discovery. Fall back to an API key from the dashboard's Connect panel, set as a bearer token in the MCP config. See https://getpapi.ai/docs/install.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 78 lines · 58 tokens per session scan B 1a2df038f3e2
check-mcp is a skill published in the GitHub repository getpapi/papi (7 stars, last pushed 11d ago), licensed MIT. It adds 58 tokens to every session and 930 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sprint-plan
MUST use when user describes a multi-step feature to build, says 'let's build', 'new project', 'let's implement', or when a task clearly requires more than 3 steps and no plan exists yet. Do NOT trigger for simple additions like adding a comment, renaming a variable, or single-file changes. Produces: task breakdown…
breaking-down-work
Decomposes a goal, feature, epic, or deliverable into a structured task tree (tasks, subtasks, checklists) with dependencies in Astravue. Use when the user wants to break down, decompose, or plan out work, turn an epic or feature into tasks, "split this into tasks", scope a deliverable, or build a work breakdown…
capturing-meeting-actions
Extracts action items from meeting notes, transcripts, or a brain dump and creates them as owned, dated tasks in Astravue. Use when the user pastes meeting notes or a transcript, asks to turn notes or standup discussion into tasks, capture action items, or "make tasks out of this".
mapping-dependencies
Maps task dependencies in an Astravue project, finds the critical path and blocked work, and detects circular dependencies before any rescheduling. Use when the user asks about dependencies, blockers, what's blocking what, the critical path, or wants to understand or fix the sequencing of a project.
triaging-overdue-work
Reviews overdue and at-risk tasks in Astravue, assesses why each is slipping, and proposes reschedule, reassign, deprioritize, or close actions before applying them. Use when the user asks what's overdue, behind schedule, slipping, or at risk, wants to catch up on a project, or clean up late work.
generating-status-report
Generates executive project status reports from Astravue data including task progress, budget consumption, and project health. Use when asked for a status update, project summary, executive report, or "how is the project going?".