Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LuuOW/meridian-mcp --skill curl-recipesgit clone --depth 1 https://github.com/LuuOW/meridian-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/luuow/meridian-mcp/curl-recipes)<a href="https://agentmods.dev/skills/luuow/meridian-mcp/curl-recipes"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/curl-recipes/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/luuow/meridian-mcp/curl-recipes"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/curl-recipes.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.01130 |
| Opus 5 | $0.00015 | $0.00565 |
| Sonnet 5 | $0.00006 | $0.00226 |
| Haiku 4.5 | $0.00003 | $0.00113 |
Grade A, and why
curl-recipes scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
name: curl-recipes How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
curl-recipes
Targeted curl patterns for debugging HTTP services, testing API endpoints, inspecting TLS, and measuring request timing. Micro-skill — composable with network, ssl-tls, api, and webhook debugging workflows.
1) Response Inspection
# Headers only
curl -I https://example.com
# Verbose — full request + response headers
curl -v https://example.com
# Silent body, show HTTP status code only
curl -s -o /dev/null -w "%{http_code}" https://example.com/health
# Follow redirects + show final URL
curl -L -s -o /dev/null -w "%{url_effective}\n" https://example.com
# Show response headers + body
curl -D - https://example.com
2) Auth Patterns
# Bearer token
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/me
# Basic auth
curl -u username:password https://api.example.com/endpoint
curl -H "Authorization: Basic $(echo -n user:pass | base64)" https://api.example.com
# API key in header
curl -H "X-Api-Key: $API_KEY" https://api.example.com/data
# Cookie
curl -b "session=abc123" https://app.example.com/dashboard
# Client certificate (mTLS)
curl --cert client.crt --key client.key --cacert ca.crt https://internal.api/
3) POST / JSON Bodies
# JSON POST
curl -s -X POST https://api.example.com/items \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $TOKEN" \
-d '{"name": "test", "value": 42}'
# From file
curl -X POST https://api.example.com/ingest \
-H "Content-Type: application/json" \
-d @payload.json
# Form data
curl -X POST https://api.example.com/login \
-F "username=admin" \
-F "password=secret"
# URL-encoded form
curl -X POST https://api.example.com/token \
-d "grant_type=client_credentials&client_id=xxx&client_secret=yyy"
4) File Upload
# Multipart file upload
curl -X POST https://api.example.com/upload \
-H "Authorization: Bearer $TOKEN" \
-F "file=@/path/to/file.pdf" \
-F "name=my-document"
# PUT binary
curl -X PUT https://storage.example.com/object-key \
-H "Content-Type: application/octet-stream" \
--data-binary @/path/to/file.bin
# S3 presigned URL upload
curl -X PUT "$PRESIGNED_URL" \
-H "Content-Type: image/jpeg" \
--upload-file photo.jpg
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 143 lines · 31 tokens per session scan A c4fb7cb659be
curl-recipes is a skill published in the GitHub repository LuuOW/meridian-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 31 tokens to every session and 1,130 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
geoserver-rest-api
Use when automating GeoServer management — programmatic workspace, datastore, and layer creation, style upload, service configuration via REST API. GeoServer REST API: manage GeoServer without GUI using curl, Python, or any HTTP client.
ask-curl
AI-assisted cURL requests. Describe what you want in natural language and get a well-formed cURL command. Supports secret injection via 1Password (op://), request history, response parsing, and chained requests.
webhook-subscriptions
Design, implement, and debug webhook integrations with security and reliability.
http-client
An HTTP client for sending requests to web services. It supports common request methods, custom headers, authentication, and formatted responses.
har-api-reverse-engineering
Use this skill when an agent needs to call a website's hidden or undocumented API: capture real browser requests into a HAR file, derive the exact request shape, build a clean replayable client, verify it outside the browser, and reuse the verified client. Activates when a backend has no documented API, or when you…
api-testing
Comprehensive API testing, validation, and test suite generation.