Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kevinpbuckley/VibeUE --skill vibeuegit clone --depth 1 https://github.com/kevinpbuckley/VibeUEWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevinpbuckley/vibeue/vibeue)<a href="https://agentmods.dev/skills/kevinpbuckley/vibeue/vibeue"><img src="https://agentmods.dev/badge/skills/kevinpbuckley/vibeue/vibeue/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevinpbuckley/vibeue/vibeue"><img src="https://agentmods.dev/badge/skills/kevinpbuckley/vibeue/vibeue.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 33 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.02943 |
| Opus 5 | $0.00041 | $0.01471 |
| Sonnet 5 | $0.00016 | $0.00589 |
| Haiku 4.5 | $0.00008 | $0.00294 |
Grade A, and why
vibeue scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VibeUE is an extension on Unreal Engine's native MCP endpoint (http://localhost:8000/mcp).
There is no separate VibeUE server, no API key, and no in-editor chat — VibeUE simply registers
extra Python services (unreal.<Service>) and skill packs on top of the engine's own toolsets.
Wait for VibeUE readiness after launch
BuildAndLaunchGame.ps1 / .sh print Editor-PID=<pid> — treat that as the process identity. Check
once, then watch the filesystem for <ProjectDir>/Saved/VibeUE/Signals/editor-<pid>-true.json before
using MCP. Wait at most 180 seconds, do not poll MCP while waiting, and fail if that Editor process
exits or the timeout expires. Ignore signal files for other or dead PIDs. The signal only means
RegisterToolsets() reached its end; Python, World, and level readiness remain separate checks.
The file is JSON, written atomically, so it is complete the moment it appears:
{"signal":"toolsets-registered","pid":21044,"createdUtc":"2026-08-03T17:04:11.921Z",
"sessionStartUtc":"2026-08-03T17:03:22.108Z","pluginVersion":"3.0",
"currentMap":"/Game/Maps/Level1_FullBody"}
Process IDs get recycled. The launch scripts clear a matching stale signal right after starting the
Editor, but if you launch it some other way, verify sessionStartUtc is later than the moment you
started the process before trusting the signal.
currentMap is the loaded map's package name and the signal is re-published on every map open
(issue #554) — gate world-edit scripts on it. A relaunch opens the project default map unless
you pass -Map /Game/Maps/YourMap (--map on the .sh) to the launch script; editing "the current
world" after a relaunch without checking has silently modified the wrong level before.
Health heartbeat — dead or wedged editor detection
Signals/editor-<pid>-health.json is rewritten every ~5s by a background thread (issue #555):
{"signal":"health","pid":21044,"updatedUtc":"2026-08-03T17:09:00.000Z",
"sessionStartUtc":"2026-08-03T17:03:22.108Z","gameThreadStallSeconds":0.03}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 160 lines · 82 tokens per session scan A 936748a3767d
vibeue is a skill published in the GitHub repository kevinpbuckley/VibeUE (674 stars, last pushed 7d ago), licensed MIT. It adds 82 tokens to every session and 2,943 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ue-mcp-native-cpp
Use when writing or modifying native C++ UCLASSes in an Unreal project via ue-mcp. Covers createcppclass → writecppfile → livecodingcompile loop, when to use build vs Live Coding, and the addmoduledependency workflow. Pulls in any time the user asks to write a new native class, add a UPROPERTY, or implement a…
ue-mcp-blueprint
Use when authoring or modifying Unreal Blueprint assets through ue-mcp. Covers the read-then-write discipline, node/pin wiring, component (SCS) hierarchy, variables, interfaces, compilation, and the difference between pin defaults and linked inputs. Pulls in any time the user asks to create, edit, or inspect a…
ue-mcp-animation
Use when creating, modifying, retargeting, rigging, constraining, or validating skeletal animation through UE-MCP. Covers native UE 5.8 IK Rig and Retargeter authoring, the Control Rig begin/read/apply/bake loop, generic contact locks, per-rig anatomical and mirrored-axis discovery, quaternion keying, deterministic…
ue-mcp-niagara
Use when authoring Niagara VFX systems via ue-mcp - creating systems and emitters, adding renderers, setting module inputs and static switches, building HLSL modules, and batching operations. Pulls in any time the user asks for a particle system, VFX, Niagara emitter, or motion matching cost visualization.
ue-mcp-workflow
Use when driving Unreal Engine editor via the ue-mcp MCP server. Covers the required order of operations (status check first), editor lifecycle, project scoping, and what to do when the bridge says "still initializing". Pulls in automatically any time the user asks to use an Unreal project or references ue-mcp tools.
ue-mcp-epic-routing
Use when deciding between ue-mcp's native category actions and Epic's wrapped ToolsetRegistry tools (the epic actions, incl. the Blueprint graph DSL) for a task in Unreal. Pulls in when authoring Blueprint graph bodies, or any time both a native action and an epic action could do the job and you need to pick.