Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kastalien-Research/thoughtbox --skill hub-collabgit clone --depth 1 https://github.com/Kastalien-Research/thoughtboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kastalien-research/thoughtbox/hub-collab)<a href="https://agentmods.dev/skills/kastalien-research/thoughtbox/hub-collab"><img src="https://agentmods.dev/badge/skills/kastalien-research/thoughtbox/hub-collab.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.02081 |
| Opus 5 | $0.00023 | $0.01040 |
| Sonnet 5 | $0.00009 | $0.00416 |
| Haiku 4.5 | $0.00005 | $0.00208 |
Grade A, and why
hub-collab scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s http://localhost:1731/mcp | head -c 100 How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hub Collaboration Demo
Orchestrate a multi-agent demo showing 3 agents (MANAGER, ARCHITECT, DEBUGGER) collaborating on the Thoughtbox Hub.
Hub Surface
The hub is exposed as tb.hub.* inside the thoughtbox_execute MCP tool (the only registered Thoughtbox MCP tools are thoughtbox_search, thoughtbox_execute, and thoughtbox_peer_notebook). Submit at most ONE state-mutating hub call per thoughtbox_execute invocation; read-only calls (tb.hub.whoami, tb.hub.listWorkspaces, tb.hub.readChannel, tb.hub.workspaceStatus) may be freely chained.
Prerequisites
Before running, verify:
- Docker is running and the Thoughtbox server is accessible at
http://localhost:1731/mcp - The
thoughtboxMCP server is configured in.mcp.json
Check with:
curl -s http://localhost:1731/mcp | head -c 100
MCP Session Behavior (Empirically Verified 2026-02-07; tb.hub semantics per PR #374)
Sub-agents spawned via the Task tool share the parent's MCP HTTP connection but each tb.hub.register call creates a separate agentId. The hub keeps a per-MCP-session identity registry: the first registration becomes the session's implicit default agentId, and an explicit agentId override is only accepted if that agentId was registered in the SAME session. Key findings:
- Session isolation works: Each sub-agent gets a unique agentId on the hub
- Cross-workspace visibility works: Sub-agents see workspaces created by other agents
- Cross-agent review works: A Debugger sub-agent can review an Architect's proposal
- Coordinator role caveat: Re-registering creates a new identity, losing coordinator role. The orchestrator must create workspace + problems BEFORE spawning sub-agents, and not re-register afterward if merge is needed —
tb.hub.mergeProposalmust run from the coordinator's own session. - Explicit agentId required in sub-agents: Because all sub-agents share the parent's MCP session, the FIRST registration (normally the Orchestrator's) is the implicit default identity. Any
tb.hub.*mutation that omitsagentIdis attributed to that default — silently breaking cross-agent attribution and review. Each sub-agent must capture theagentIdreturned by its owntb.hub.register/tb.hub.quickJoinand pass it as an explicit top-levelagentIdfield in every subsequent hub call (e.g.tb.hub.claimProblem({ agentId, workspaceId, problemId })). ExplicitagentIdis accepted only for identities registered in the same session. - Sequential spawning recommended: Run sub-agents sequentially (not in parallel). Each agent should complete registration → join → claim → propose before the next starts, which keeps the demo's ordering deterministic (e.g. the Architect's proposal exists before the Debugger reviews it).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 129 lines · 46 tokens per session scan A 173f93889c7e
hub-collab is a skill published in the GitHub repository Kastalien-Research/thoughtbox (64 stars, last pushed 1mo ago), licensed MIT. It adds 46 tokens to every session and 2,081 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
data-charts-tako
Search and visualize the world's data - get charts, insights, and embeddable knowledge cards for finance, economics, demographics, sports, and more.
unity-addressables
Manage Addressables groups, entries, profiles and content builds (com.unity.addressables, reflection-based).
unity-yaml-editing
Last-resort guidance for safely hand-editing Unity YAML.
Threat Hunting & IOC Analysis
IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation.
render-3d-product-showcase
Assemble a premium 3D product-showcase ad from a config — four beat clips (an orbiting hero rotation, a macro push-in, a physics reveal, a typographic close) normalized to the brand-color canvas, hard-concatenated in order, closed on a deterministic Playwright brand end card, and mixed under one instrumental bed at…
render-airdrop-carousel
Assemble a viral iOS "AirDrop" notification-carousel video ad (≈6–8s, 9:16) from a brand line plus 6–16 real product photos — a native AirDrop share-sheet card ("Brand would like to share a · Decline / Accept") springs up and its preview window CYCLES through the products, landing on a range/lineup payoff with an…