Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LuuOW/meridian-mcp --skill dnsgit clone --depth 1 https://github.com/LuuOW/meridian-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/luuow/meridian-mcp/dns)<a href="https://agentmods.dev/skills/luuow/meridian-mcp/dns"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/dns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/luuow/meridian-mcp/dns"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/dns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01765 |
| Opus 5.5 | $0.00012 | $0.00706 |
| Sonnet 5.5 | $0.00006 | $0.00353 |
| Haiku 4.5 | $0.00003 | $0.00177 |
Grade B, and why
dns scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 /etc/letsencrypt/cloudflare.ini Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records" \ How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dns
DNS patterns for production domains managed through Cloudflare or direct registrar control. Covers record types, automation via API, debugging resolution chains, and DNS-01 challenges for wildcard TLS certificates.
1) Record Types Reference
| Type | Purpose | Example value |
|---|---|---|
A |
IPv4 address | 203.0.113.10 |
AAAA |
IPv6 address | 2001:db8::1 |
CNAME |
Alias to another hostname | myapp.example.com |
MX |
Mail exchange (with priority) | 10 mail.example.com |
TXT |
Arbitrary text (SPF, DKIM, ownership) | v=spf1 include:sendgrid.net ~all |
NS |
Authoritative nameservers | ns1.cloudflare.com |
SRV |
Service location | _http._tcp 10 5 80 web.example.com |
CAA |
Certificate authority restriction | 0 issue "letsencrypt.org" |
PTR |
Reverse DNS (IP → name) | Set at hosting provider |
2) TTL Strategy
Production records: 300s (5min) — fast propagation for active changes
Stable records: 3600s (1hr) — normal operating cost
Root / NS records: 86400s (24hr) — only change during migrations
Pre-migration TTL: 300s — lower 24h before any DNS change
Lower TTL before a planned migration. Restore after stabilization.
3) Cloudflare API Automation
export CF_TOKEN="your-api-token" # Zone:DNS:Edit permission
export CF_ZONE_ID="your-zone-id" # Get from Cloudflare dashboard → zone overview
# List all records
curl -s "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records" \
-H "Authorization: Bearer $CF_TOKEN" | jq '.result[] | {name, type, content, ttl}'
# Create an A record
curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records" \
-H "Authorization: Bearer $CF_TOKEN" \
-H "Content-Type: application/json" \
--data '{"type":"A","name":"api","content":"203.0.113.10","ttl":300,"proxied":false}'
# Update a record (get ID first from list)
curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records/$RECORD_ID" \
-H "Authorization: Bearer $CF_TOKEN" \
-H "Content-Type: application/json" \
--data '{"type":"A","name":"api","content":"203.0.113.20","ttl":300,"proxied":false}'
# Delete a record
curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/dns_records/$RECORD_ID" \
-H "Authorization: Bearer $CF_TOKEN"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 177 lines · 30 tokens per session scan B c5aae9cec0c2
dns is a skill published in the GitHub repository LuuOW/meridian-mcp (0 stars, last pushed 14d ago), licensed MIT. It adds 30 tokens to every session and 1,765 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cloudflare-dns
Manage Cloudflare DNS with correct proxy (orange/grey) mode, TTL cutovers, zone backups, and scoped API tokens—avoid mail/ACME breakage and mixed proxied-record traps.
cloudflare-router
Use when manage Cloudflare DNS, CDN, and security rules via API. Use when configuring domains, SSL, WAF, or edge caching.
cloudflare-management
Manage Cloudflare Workers, KV, R2, DNS, and cache via MCP. Use when the user asks to list zones, edit DNS records, purge cache, inspect Workers, read/write KV, or list R2 buckets on Cloudflare.
cfops-landing-guard
Stash, log, and one-click-restore live Cloudflare Pages landings so a stray/wrong-project deploy never permanently swipes a site. Use when a landing regressed, when protecting landings from overwrites, or to roll a Pages site back to its last-good version in 1 second.
cfops-pages-deploy
Deploy a static site or app to Cloudflare Pages across the operator's two accounts without hitting the account wall, the wrong-branch preview trap, or a false-green deploy. Use for any Cloudflare Pages deploy, custom-domain attach, or "the deploy said success but the site didn't change" debugging.
cfops-live-verify
Verify a deployed website or Worker end to end with status, redirects, expected content, navigation, protected routes, mobile UI, and regression evidence. Use after releases, DNS or route edits, reported 404s, UI changes, or when a user asks whether a feature is truly live.