Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kornia/bubbaloop/using-bubbaloopnpx skills add kornia/bubbaloop --skill using-bubbaloopgit clone --depth 1 https://github.com/kornia/bubbaloopWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.01148 |
| Opus 5 | $0.00026 | $0.00574 |
| Sonnet 5 | $0.00011 | $0.00230 |
| Haiku 4.5 | $0.00005 | $0.00115 |
Grade B, and why
using-bubbaloop scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
The plugin's `.mcp.json` reads it from the `BUBBALOOP_MCP_TOKEN` environment variable. Set it once: This is a copy
86% identical to senior-strategy-architect — 152 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Using bubbaloop
Bubbaloop exposes 47 MCP tools across three RBAC tiers (Viewer / Operator / Admin) for managing sensor nodes on a Zenoh-based pub/sub mesh. Three of those (toolset_list, toolset_enable, toolset_get_tools) are dynamic-disclosure meta-tools — always visible regardless of which toolsets are enabled, used to narrow or broaden the live tool surface for context-window-limited models.
The two-plane model — the rule that matters most
- MCP is the control plane: low-rate request/response (rate limit: 100 burst, 1 req/sec sustained). Use it for status, lifecycle, config, scheduling.
- Zenoh is the data plane: high-rate streaming (1000s msg/sec). Use
node_stream_infoto obtain the topic, then subscribe externally with a Zenoh client (zenoh-pythonor thezenohRust crate).
Polling sensor data through repeated MCP calls is the most common mistake. Don't do it. If you find yourself looping node_command_send or zenoh_query to read values, stop and call node_stream_info.
Discovery sequence
For any new node interaction, follow this order:
node_list → node_health → node_manifest → node_commands
Then act with node_command_send or lifecycle tools. This sequence is cheap, side-effect-free, and prevents acting on stale or hallucinated names.
RBAC tiers
| Tier | Use for | Examples |
|---|---|---|
| Viewer (22) | Read-only inspection | node_list, node_health, node_stream_info, dataflow_graph, job_list, toolset_list |
| Operator (15) | Day-to-day control | node_start, node_stop, node_restart, node_command_send, node_logs (now accepts lines param) |
| Admin (12) | System modification | node_install, node_remove, node_build, zenoh_query, memory_episodic_clear |
In single-user localhost mode all authenticated callers receive Admin tier, but you should still treat Admin actions as requiring explicit user confirmation.
Dynamic toolsets
Tools are grouped into 11 toolsets by domain (node, mission, belief, system, telemetry, …). All toolsets are enabled by default. To narrow the surface for a small model, set BUBBALOOP_MCP_TOOLSETS=node,mission,system before launching the daemon — only those toolsets' tools will be visible on tools/list. At runtime, an agent can call toolset_list to see what's available, then toolset_enable("<name>") to activate one for the session and re-fetch tools/list.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 83 lines · 53 tokens per session scan B 0afed1616cf7
using-bubbaloop is a skill published in the GitHub repository kornia/bubbaloop (28 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 53 tokens to every session and 1,148 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). It is 86% identical to senior-strategy-architect, differing in 152 lines, and is treated as a copy.
Other skills, from other repositories
habitat-gs-train
Train and evaluate a navigation policy in the habitat-gs simulator. Covers the full generate-episodes → train → evaluate flow for PointNav / ImageNav / ObjectNav (Habitat-Lab + DDPPO reinforcement learning) and for Vision-and-Language Navigation (StreamVLN, Uni-NaVid). Use when the user wants to train, fine-tune…
habitat-gs-control
Interactively pilot a robot in habitat-gs 3D Gaussian Splatting indoor scenes via MCP tools — load a scene, move, observe with RGB/depth, run autonomous nav loops, and export video. Use for hands-on control of a live sim session, NOT for training or evaluating a navigation policy (use the habitat-gs-train skill for…
vss-deploy-detection-tracking-2d
Use this skill when the user wants to deploy, run, debug, tear down, or call the REST API of the RTVI-CV 2D detection / tracking microservice. Trigger when the user says things like 'deploy rtvi-cv', 'start warehouse 2d', 'add a stream', 'check rtvi-cv health', or 'stop the perception container'. Not for VLM…
vss-generate-video-calibration
Use to run AutoMagicCalib on local MP4s, RTSP, or the bundled sample dataset, and to deploy vss-auto-calibration when needed. Do not use for non-AMC calibration or runtime analytics.
vss-ask-video
Use this skill to ask the VSS agent's videounderstanding tool a fresh visual question about a recorded clip. Not for prior tool output, search hits, or metadata-answerable questions.
bdd-container-update
Update the BDD test container image when its dependencies or runtime change. Determines version bump (major vs minor vs patch), rebuilds the Docker image, pushes to GitLab registry, and updates the image tag in starttest.sh. Test source (tests/, features/, scripts/, data/, conftest.py) is bind-mounted from the host…