Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gosuda/portal-tunnel --skill portal-exposegit clone --depth 1 https://github.com/gosuda/portal-tunnelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gosuda/portal-tunnel/portal-expose)<a href="https://agentmods.dev/skills/gosuda/portal-tunnel/portal-expose"><img src="https://agentmods.dev/badge/skills/gosuda/portal-tunnel/portal-expose/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gosuda/portal-tunnel/portal-expose"><img src="https://agentmods.dev/badge/skills/gosuda/portal-tunnel/portal-expose.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.02825 |
| Opus 5 | $0.00052 | $0.01412 |
| Sonnet 5 | $0.00021 | $0.00565 |
| Haiku 4.5 | $0.00010 | $0.00282 |
Grade A, and why
portal-expose scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Verify the emitted `public_url` itself with one bounded request. `*.localhost` often resolves to `::1` first, so use `curl -sk --ipv4 --connect-timeout 5 --max-time 15 -o /dev/null -w '%{http_code}' <public-url>` and a How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Expose an App with Portal
Portal publishes a service that is already running on the user's machine. It does not build the app or move it to a cloud host. Treat a successful tunnel as dependent on both the local app and the Portal process or agent remaining available.
Run the workflow in order. Open a reference only when that branch is taken: references/x402.md for a paid route, references/safety-and-verification.md for an authenticated, sensitive/high-risk, or non-HTTP service, references/game-hosting.md for a game server, references/portal-cli.md when choosing persistent-agent configuration. Use the installed portal CLI for flags.
Choose the Mode
Use the smallest mode that satisfies the request:
- Temporary web preview:
portal expose <target>. - Trusted static directory or HTML entry:
portal expose --serve <path>. - Multiple local HTTP services under one URL: repeat
--http-route. - Paid HTTP path: routed HTTP with an explicit x402 payment contract; never enable payment implicitly.
- Durable tunnel that should survive terminal or login restarts: an explicit
portal agentconfig and managed service. - Session-owned durable tunnel without an OS service:
portal agent run --foreground. - Game server (Minecraft, Terraria, Palworld, or any dedicated game server): always start from
references/game-hosting.md— raw TCP/UDP transport has different prerequisites and verification than HTTP.
Default to a temporary preview when the user says only "share", "preview", or "deploy locally". Do not install an OS service unless the user asks for a persistent, managed, or restart-surviving tunnel and accepts that portal agent run without --foreground installs a per-user launchd or systemd unit.
Workflow
1. Inspect the Project
- Read the applicable repository instructions before running or changing anything.
- Determine the app directory, start command, expected protocol, loopback target, and a meaningful health path.
- Prefer declared scripts and documented ports over guessing from process lists.
- Do not expose a port merely because it is listening. Tie it to the requested app.
- If the project is already running, preserve its process. If it is not running and deployment was requested, start it with the project's normal command and retain the terminal/session handle.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 997c5b4c48a2
- 12d ago First seen · 123 lines · 104 tokens per session scan A 525d08371ab4
portal-expose is a skill published in the GitHub repository gosuda/portal-tunnel (267 stars, last pushed yesterday), licensed MIT. It adds 104 tokens to every session and 2,825 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cloudflare-skill
Work with Cloudflare via the official cf CLI — check auth identity, list zones, list/create/delete DNS records, query the GraphQL Analytics API (zone traffic, Web Analytics/RUM), and run any other cf command. Output is parsed JSON.
gcloud-skill
Work with Google Cloud via the official gcloud CLI — check auth/config, list and switch projects, manage Compute Engine instances, deploy and inspect Cloud Run services, work with Cloud Storage, and run any other gcloud command. Output is parsed JSON.
vercel-skill
Deploy sites and apps to Vercel, inspect deployments, stream logs, and manage projects/env/domains via the Vercel CLI. Deploy a directory and get back the live deployment URL; everything else the CLI supports is available through the custom command passthrough.
nvcf-self-managed-prerequisite
Install the prerequisites the NVCA operator / compute plane needs before nvcf-nvca-install can succeed: the operator tool nvcf-cli (required by the compute-plane stack's register-cluster step), KAI Scheduler (for the KAIScheduler feature gate), and the SMB CSI driver (for the sharedStorage Samba sidecar PVCs). The two…
cloud-migration
Cloud migration strategy and execution: assessment frameworks, migration patterns, database migration, network cutover, and multi-cloud planning.
terraform-ops
Infrastructure-as-Code operations: plan, apply, import, state management, module development, and drift detection using Terraform CLI.