Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add growilabs/growi-mcp-server --skill growi-mcp-setupgit clone --depth 1 https://github.com/growilabs/growi-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/growilabs/growi-mcp-server/growi-mcp-setup)<a href="https://agentmods.dev/skills/growilabs/growi-mcp-server/growi-mcp-setup"><img src="https://agentmods.dev/badge/skills/growilabs/growi-mcp-server/growi-mcp-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/growilabs/growi-mcp-server/growi-mcp-setup"><img src="https://agentmods.dev/badge/skills/growilabs/growi-mcp-server/growi-mcp-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.05035 |
| Opus 5 | $0.00053 | $0.02518 |
| Sonnet 5 | $0.00021 | $0.01007 |
| Haiku 4.5 | $0.00011 | $0.00504 |
Grade C, and why
growi-mcp-setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
# /absolute/path/to/growi.env (chmod 600; never commit) Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- `project` (shared via VCS) — stored in `.mcp.json` at the project root. **Do not use it for this setup**: the `env` block contains the API token and `.mcp.json` is committed. How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GROWI MCP Setup: Connection Bootstrap Workflow
Guide the user from "the skill is installed" to "GROWI tools actually work" — setting up UTCP Code-Mode from scratch, wiring in the GROWI MCP server, and verifying the connection. This is the shortest supported path: the user should not need to configure UTCP by hand beforehand; this skill walks them through it.
Scope
This skill takes over once it is loaded (i.e. the GROWI plugin/skill is already installed) and drives everything up to "GROWI tools work" — including UTCP Code-Mode setup, which earlier docs assumed was done in advance.
What this skill does not cover: installing the plugin/skill itself (adding the marketplace, installing, restarting the agent). That step cannot be automated — the agent cannot act until the skill is recognized — so it lives in the GROWI documentation, not here. See the install instructions in the GROWI docs "AI ツール(スキル)を使う" / "AI Tools (Skills)" page (/guide/features/ai-tools). Assume the user has finished that when this skill runs.
Why UTCP Code-Mode
The GROWI MCP server exposes more than 30 tools (35 as of this writing). Loading every tool schema into the client context is heavy on tokens. UTCP Code-Mode sits between the client and the GROWI MCP server and lets the agent call tools through a single code-execution interface, which keeps context small.
UTCP Code-Mode is the default path this skill sets up — do not assume it is already present; the workflow below installs and wires it. A direct MCP connection also works (all tools function) and is offered only as a fallback or for light use — see the last section.
How UTCP resolves ${VAR} — read before Steps 3–4
UTCP itself substitutes ${VAR} references found in .utcp_config.json when the code-mode server starts. The shell does not do it, and the MCP client does not do it. Three rules drive everything in Steps 3–4:
- Lookups are namespaced by manual name. Inside a manual named
growi,${GROWI_BASE_URL_1}is looked up asgrowi_GROWI_BASE_URL_1. If the manual has noname, UTCP assigns a random UUID as its name, the lookup becomes<uuid>_GROWI_BASE_URL_1, and it can never match anything — registration always fails. - Lookup order: the config's
variablesmap →load_variables_fromloaders → the environment of the code-mode process (which is theenvblock of the client-config entry from Step 3). Entries in thevariablesmap are themselves substituted without a namespace, which is what makes the bridge pattern in Step 4 work. - Failures are silent. If a variable cannot be resolved (or a server entry is invalid), that manual's registration fails but the code-mode server still starts normally — the client shows the code-mode tools, just zero GROWI tools. Always verify per Step 5.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 260 lines · 107 tokens per session scan C 8cb7e116cd8d
growi-mcp-setup is a skill published in the GitHub repository growilabs/growi-mcp-server (19 stars, last pushed 1mo ago), licensed MIT. It adds 107 tokens to every session and 5,035 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…