Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/luiseiman/dotforge/mcp-addnpx skills add luiseiman/dotforge --skill mcp-addgit clone --depth 1 https://github.com/luiseiman/dotforgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/luiseiman/dotforge/mcp-add)<a href="https://agentmods.dev/skills/luiseiman/dotforge/mcp-add"><img src="https://agentmods.dev/badge/skills/luiseiman/dotforge/mcp-add.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.01353 |
| Opus 5 | $0.00013 | $0.00677 |
| Sonnet 5 | $0.00005 | $0.00271 |
| Haiku 4.5 | $0.00003 | $0.00135 |
Grade B, and why
mcp-add scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Detect `--global` flag: if present, target `~/.claude/settings.json`; otherwise target `.claude/settings.json` How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Add
Install a dotforge MCP server template into the current project's or global Claude Code configuration.
Input parsing
From $ARGUMENTS (format: mcp add <server> [--global]):
- Extract
<server>: the word aftermcp add— one ofgithub,postgres,supabase,redis,slack - Detect
--globalflag: if present, target~/.claude/settings.json; otherwise target.claude/settings.json
Step 0: Validate
-
Verify the server template exists:
$DOTFORGE_DIR/mcp/<server>/- If directory not found:
Stop.✗ Unknown server '{{server}}'. Available: github, postgres, supabase, redis, slack Usage: /forge mcp add <server> [--global]
- If directory not found:
-
Determine target settings path:
--global→~/.claude/settings.json- default →
.claude/settings.json - If target doesn't exist and not
--global: warn "No settings.json found. Run/forge bootstrapfirst, or use--globalto install globally." Stop. - If target doesn't exist and
--global: create~/.claude/settings.jsonwith{"permissions": {"allow": [], "deny": []}, "mcpServers": {}}.
Step 1: Load template files
Read all three template files:
$DOTFORGE_DIR/mcp/<server>/config.json$DOTFORGE_DIR/mcp/<server>/permissions.json$DOTFORGE_DIR/mcp/<server>/rules.md
From config.json:
- Server key: the non-metadata top-level key (e.g.,
"github","postgres") - Server config block: the value of that key (the object with
type,command,args,env) - Install note: the
_installstring — contains required env vars and instructions - Ignore all keys starting with
_(metadata)
From permissions.json:
- allow: the
allowarray value (or[]if absent) - deny: the
denyarray value (or[]if absent) - Ignore all keys starting with
_
Step 2: Check for existing configuration
Read the target settings.json.
Check if the server is already configured:
- Present if
mcpServers.<server>key exists in settings, OR - Present if any of the server's allow entries appear in
permissions.allow
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 160 lines · 25 tokens per session scan B 094621444390
mcp-add is a skill published in the GitHub repository luiseiman/dotforge (8 stars, last pushed 2mo ago), licensed MIT. It adds 25 tokens to every session and 1,353 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
scaffold
Set up or align a non-code ops/PM repo with the ops folder structure, CLAUDE.md, and INDEX.md hierarchy.
find-opps
Find new directions for an ops project — adjacent opportunities, strategic gaps, preparatory research. Use when known work is well-mined and you need to look outward.
prioritize
Pick 2–3 independent ops tasks from active plans and backlog for autonomous execution, weighing impact, feasibility, and project goals.
factory-db-migration
The operational discipline for running a destructive change against a production database — schema migrations, data backfills, one-shot RPCs, historical seed imports. Adjacent to factory-data-layer.md (schema design) and factory-deployment.md (where migrations execute in CI) — this skill is about the runbook around…
factory-api
API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router composition, pagination shape, multi-field search via Drizzle ilike + or(), mutation lifecycle hooks, conditional query enabling, stale-time defaults, error response shape and…
factory-auth
Auth and authorization conventions distilled across builds with three different auth stacks (Better Auth + orgs, Supabase Auth + RLS, Clerk). Covers the provider decision matrix, the unified wrapper interface (requireAuth / requireRole / withOrgContext), procedure tier stacking, session handling, OAuth callback…