Borrowing it
Nothing to install: this file belongs to giauphan/codeatlas-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/giauphan/codeatlas-mcp-server/main/.claude/skills/publish-mcp-server/SKILL.mdgit clone --depth 1 https://github.com/giauphan/codeatlas-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/giauphan/codeatlas-mcp-server/publish-mcp-server)<a href="https://agentmods.dev/skills/giauphan/codeatlas-mcp-server/publish-mcp-server"><img src="https://agentmods.dev/badge/skills/giauphan/codeatlas-mcp-server/publish-mcp-server/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/giauphan/codeatlas-mcp-server/publish-mcp-server"><img src="https://agentmods.dev/badge/skills/giauphan/codeatlas-mcp-server/publish-mcp-server.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00505 |
| Opus 5 | $0.00018 | $0.00253 |
| Sonnet 5 | $0.00007 | $0.00101 |
| Haiku 4.5 | $0.00004 | $0.00051 |
Grade C, and why
publish-mcp-server scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 ~/.npmrc Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Restart Claude Code before checking `~/.claude/hooks/brain-*.sh`, hook commands in `~/.claude/settings.json`, and `~/.claude/brain-save.log`. Confirm commands use `$HOME`-based paths, not a machine-specific `/home/<user> What it actually says
Publish CodeAtlas MCP Server
Before publishing
- Update
package.jsonto a new unused semver version. Check withnpm view codeatlas-mcp-server versions --json. - Ensure the root
README.mddocuments npm installation, environment variables, andcodeatlas-mcp install-hooks. - Build and inspect the exact package:
npm run build npm pack --dry-run npm pack tar -tzf codeatlas-mcp-server-<version>.tgz - Confirm only intended files are included. Never package
.env, credentials, tokens, service-account files, or unrelated local data. Remove the temporary tarball.
Authentication
Keep the npm token only in the user-level config, never in the repository:
printf '%s\n' '//registry.npmjs.org/:_authToken=TOKEN' > ~/.npmrc
chmod 600 ~/.npmrc
npm whoami
The account must own or have write permission for codeatlas-mcp-server. If publish returns E403 mentioning 2FA, use npm publish --otp=123456, or create a granular token with package Read and write permission and explicitly enabled 2FA bypass. A 404 on PUT usually means the authenticated account/token lacks package write permission; do not change the version to work around it.
Publish and verify
npm publish
npm view codeatlas-mcp-server version
npm view codeatlas-mcp-server readme
Do not publish on the user's behalf without explicit authorization.
Verify Second Brain hooks
codeatlas-mcp install-hooks --dry-run
codeatlas-mcp install-hooks
Restart Claude Code before checking ~/.claude/hooks/brain-*.sh, hook commands in ~/.claude/settings.json, and ~/.claude/brain-save.log. Confirm commands use $HOME-based paths, not a machine-specific /home/<user> path.
Rollback by restoring the timestamped settings.json.bak-install-* backup, removing installed brain hook scripts, and restarting Claude Code. Never run the real installer while untrusted hook output is polluting the current session; restart first.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 53 lines · 36 tokens per session scan C 582039993028
publish-mcp-server is a skill published in the GitHub repository giauphan/codeatlas-mcp-server (10 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 505 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
stage-10-pr
You are a delivery agent. Push. Create PR. Write audit trail. Close finding. Your output is a merge-ready pull request with a complete audit trail linking every change back to the original finding, through the PRD, to the verification report. The PR description is machine-generated from stage artifacts — not…
agent-framework-py-release
Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…
changelog-scan
Scan merged PRs and commits since a given reference, extract titles, labels, types, and signals. Produces structured input for release notes drafting.
draft-release-notes
Turn changelog-scan output into polished, categorized release notes draft. Propose only.
git-integration
Git commit patterns, formats, and conventions for GSD methodology. Provides atomic commits per task, structured commit messages, planning file commits, branch management, and milestone tag operations.
release-notes
Create release notes for a new version tag. Gathers all commits, PRs, issues fixed, and breaking changes since a previous release. Creates the release notes markdown file, tags the repo, and pushes. Asks the user to confirm the base version to diff against.