Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/inflowpayai/inflow-cli/agentic-enrollmentnpx skills add inflowpayai/inflow-cli --skill agentic-enrollmentgit clone --depth 1 https://github.com/inflowpayai/inflow-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/inflowpayai/inflow-cli/agentic-enrollment)<a href="https://agentmods.dev/skills/inflowpayai/inflow-cli/agentic-enrollment"><img src="https://agentmods.dev/badge/skills/inflowpayai/inflow-cli/agentic-enrollment.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.01972 |
| Opus 5 | $0.00030 | $0.00986 |
| Sonnet 5 | $0.00012 | $0.00394 |
| Haiku 4.5 | $0.00006 | $0.00197 |
Grade C, and why
agentic-enrollment scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
| macOS/Linux hosted installer | `curl -fsSL https://inflowcli.ai/install.sh \| bash` | Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: ['Bash(inflow:*)', 'Bash(brew:*)', 'Bash(curl:*)'] How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agentic Enrollment
Discover Agent Enrollment Protocol Services, enroll an Agent, manage Service credentials, and retrieve protected resources. Let the CLI own protocol discovery, signing, approvals, credential storage, expiration, and authenticated replay. Do not construct AEP assertions or authentication headers yourself.
Setup
Install the signed native CLI through one of these channels:
| Channel | Command |
|---|---|
| macOS Homebrew | brew tap inflowpayai/tap && brew install --cask inflow |
| macOS/Linux hosted installer | curl -fsSL https://inflowcli.ai/install.sh | bash |
| Windows PowerShell installer | irm https://inflowcli.ai/install.ps1 | iex |
| Cross-platform shell compatibility | curl -fsSL https://inflowcli.ai/cli | bash |
Current install instructions live at https://inflowcli.ai/.
InFlow runs as a standalone CLI or an MCP server. MCP exposes each CLI command as a tool with underscores replacing
spaces, such as aep_fetch. Call tools/list for the authoritative inventory.
Use structured output when acting programmatically:
inflow aep <command> ... --format json
Credential-bearing commands require the encrypted local vault. If the CLI reports that the vault is uninitialized or
locked, tell the user to run inflow vault unlock themselves in a terminal, then retry. Never ask for or accept the
vault PIN or passphrase through chat, an MCP tool, a command-line flag, or an environment variable.
Use inflow aep <command> --schema for exact arguments and flags. Use inflow --llms-full for the complete command
reference.
Choose the command
| Goal | Command |
|---|---|
| Detect AEP alongside MPP and x402 for an exact resource | inflow inspect <resource-url> |
| Inspect one AEP Service or resource | inflow aep inspect <service-or-resource> |
| Retrieve a resource anonymously or with AEP authentication | inflow aep fetch <resource-url> |
| Establish Service enrollment | inflow aep enroll <service-or-resource> |
| Check enrollment and non-secret local credentials | inflow aep status <service-or-resource> |
| Request and store a Service credential explicitly | inflow aep grant <service-or-resource> |
| Revoke Service credentials | inflow aep revoke <service-or-resource> |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 193 lines · 61 tokens per session scan C a87df11236b7
agentic-enrollment is a skill published in the GitHub repository inflowpayai/inflow-cli (9 stars, last pushed 3d ago), licensed MIT. It adds 61 tokens to every session and 1,972 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
verify-before-checkout
Pre-checkout verification for shopping agents. Before transacting with any storefront the user didn't explicitly type, fetch Ed25519-signed merchant facts (domain age, TLS age, brand-lookalike score, price deviation) from the Onyx oracle over x402, verify the signature, and surface the facts to the buyer. Use whenever…
write-contract
Write production-quality GenLayer intelligent contracts. Always pins concrete GenVM runner version hashes and never uses local-only test/latest runner aliases. Covers equivalence principles, storage rules, LLM resilience, and cross-contract interaction.
intelligent-oracle
Design, deploy, and monitor a GenLayer Intelligent Oracle prediction market from any coding agent. Use when a user wants to create a settled-by-web-evidence prediction market without opening the web UI.
jupiter-lend
Interact with Jupiter Lend Protocol. Read-only SDK (@jup-ag/lend-read) for querying liquidity pools, lending markets (jlTokens), and vaults. Write SDK (@jup-ag/lend) for lending (deposit/withdraw) and vault operations (deposit collateral, borrow, repay, manage positions).
near-api-js
Guide for developing with near-api-js v7 - the JavaScript/TypeScript library for NEAR blockchain interaction. Use when: (1) building apps that interact with NEAR blockchain, (2) creating/signing transactions, (3) calling smart contracts, (4) managing accounts and keys, (5) working with NEAR RPC API, (6) handling…
x402-erc7710
Design and implement demos combining x402 HTTP payments with ERC-7710 smart contract delegations and ERC-7715 wallet permission requests for subscriptions, bounded agent budgets, recurring spend, pay-per-use APIs, and agentic commerce.