Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add krzysztofsurdy/code-virtuoso --skill mcp-server-developmentgit clone --depth 1 https://github.com/krzysztofsurdy/code-virtuosoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/mcp-server-development)<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/mcp-server-development"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/mcp-server-development/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/krzysztofsurdy/code-virtuoso/mcp-server-development"><img src="https://agentmods.dev/badge/skills/krzysztofsurdy/code-virtuoso/mcp-server-development.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.02890 |
| Opus 5.5 | $0.00020 | $0.01156 |
| Sonnet 5.5 | $0.00010 | $0.00578 |
| Haiku 4.5 | $0.00005 | $0.00289 |
Grade A, and why
mcp-server-development scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| Thin wrapper around a REST API that the agent could call with `curl` and a key | CLI or skill first | Protocol layers can lose fidelity, and the loss compounds on complex APIs | How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP server development
An MCP server is a contract between your system and a model that reads your tool descriptions the way a new hire reads an API doc. Two things decide whether it works: how well the tools match what an agent is trying to do, and whether the server holds up as a network service (auth, statelessness, limits). Protocol details moved a lot in the 2026-07-28 revision, so fetch exact wire formats through docs-lookup instead of recalling them.
Core principles
| Principle | Meaning |
|---|---|
| Build only if MCP earns it | A CLI or a skill often does the job with less machinery. Use MCP for typed contracts, OAuth identity, and multi-client or multi-tenant access |
| Tools are prompts | Names, descriptions, and parameter docs are read by a model. Write them with the same care as a system prompt |
| Few tools, whole workflows | One tool per user goal, not one per API endpoint |
| Errors teach | A failed call should say what to change. The model can then fix its own call |
| Stateless by default | No session on the wire. State lives behind explicit, authorized handles |
| Least privilege | Narrow scopes, tokens issued for your server only, authorization checked inside every tool |
| Measure with evals | Tool quality is an empirical question. Run realistic tasks and read the transcripts |
MCP, CLI, or skill
| Situation | Use | Why |
|---|---|---|
The agent has a shell, one user, a local tool with clear --help, JSON output, and predictable errors |
CLI | Less overhead, and the agent already knows how to run commands |
| You are teaching a workflow, conventions, or domain judgment and adding no new capability | Skill | Instructions load on demand and cost no running process |
| Several different clients (IDE, chat apps, agents) need the same capability | MCP server | One contract, any client |
| The caller's identity matters: per-user OAuth, audit trail, revocation | MCP server | The authorization spec gives you a standard flow |
| Multi-tenant or governed access to a SaaS or internal system | MCP server | Central place for scopes, rate limits, logging |
| Structured, typed inputs and outputs with schema validation | MCP server | inputSchema and outputSchema are part of the protocol |
Thin wrapper around a REST API that the agent could call with curl and a key |
CLI or skill first | Protocol layers can lose fidelity, and the loss compounds on complex APIs |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 150 lines · 49 tokens per session scan A ae6536b3c632
mcp-server-development is a skill published in the GitHub repository krzysztofsurdy/code-virtuoso (36 stars, last pushed today), licensed MIT. It adds 49 tokens to every session and 2,890 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-22.
Other skills, from other repositories
hermes-diagnostic-review
Use when running a read-only diagnostic review of recent Hermes sessions to find recurring mistakes, failed tool calls, and repeated fixes, then propose suggestion-only improvements and reusable skills. Human-gated; never auto-applies.
instruction-eval
Change one condition an agent runs under (instruction text, the reference material instructions point at, MCP tools and permissions, hooks, skill files), then run the same prompts before and after, several times each, to see what actually changes. Produces an HTML report showing both arms' answers side by side. Use…
worth-building
Decide how elaborate to build something (simple vs. robust) and return a concrete, PoC-shaped proposal at that level — not over- or under-engineered, but right-sized. Use whenever someone is building something and the investment level is unclear: "quick or proper?", "MVP vs. real product", "is this over-engineering?"…
django-ticket-triage
Analyze a Django Trac ticket and produce a triage recommendation report — duplicate search, related PRs, forum threads, and the affected source code. Use when the user gives a Django ticket number, or asks whether a ticket is valid, a duplicate, or ready for a triage stage.
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…
healthcheck
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).