Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LuuOW/meridian-mcp --skill vpn-access-controlgit clone --depth 1 https://github.com/LuuOW/meridian-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/luuow/meridian-mcp/vpn-access-control)<a href="https://agentmods.dev/skills/luuow/meridian-mcp/vpn-access-control"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/vpn-access-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/luuow/meridian-mcp/vpn-access-control"><img src="https://agentmods.dev/badge/skills/luuow/meridian-mcp/vpn-access-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02482 |
| Opus 5 | $0.00027 | $0.01241 |
| Sonnet 5 | $0.00011 | $0.00496 |
| Haiku 4.5 | $0.00005 | $0.00248 |
Grade A, and why
vpn-access-control scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -m 3 http://45.9.190.170:6333 # should time out / connection refused How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vpn-access-control
Access control pattern for VPS deployments where internal services must be reachable only from a WireGuard tunnel while the public site stays open. Three layers must be coordinated: UFW (for PM2/host processes), DOCKER-USER iptables chain (for Docker-exposed ports), and nginx snippets (for domain-level restrictions).
Why UFW Alone Is Not Enough
Docker bypasses UFW by writing directly to iptables nat PREROUTING rules. A port bound 0.0.0.0:6333 in a Docker compose file is reachable from the internet even if UFW has no rule for 6333. You must also lock the DOCKER-USER chain.
UFW rules → protect host-process ports (PM2, systemd services)
DOCKER-USER → protect Docker-exposed ports (all docker compose `ports:`)
nginx snippet → protect domains at the HTTP layer (optional, defence-in-depth)
DOCKER-USER Lock
# Block all external non-VPN traffic reaching Docker containers
iptables -I DOCKER-USER -i eth0 '!' -s 10.0.0.0/24 -j DROP
# Verify
iptables -L DOCKER-USER -n --line-numbers
# Expected:
# 1 DROP 0 -- !10.0.0.0/24 0.0.0.0/0
# 2 ACCEPT 0 -- 172.16.0.0/12 0.0.0.0/0 (Docker internal — must be present)
# 3 ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
# Remove the lock
iptables -D DOCKER-USER -i eth0 '!' -s 10.0.0.0/24 -j DROP
Note: The -i eth0 flag scopes the rule to the external interface. Without it, you also block Docker-internal traffic. Use ip link to verify your interface name (eth0, ens3, enp3s0 — it varies by VPS provider).
UFW — VPN-Only Port Rules
# Enable UFW safely — allow SSH first or you lock yourself out
ufw allow 22/tcp comment "SSH"
ufw allow 443 comment "WireGuard"
ufw allow 80/tcp comment "HTTP"
ufw allow 8082/tcp comment "nginx public site"
ufw --force enable
# Restrict a port to VPN subnet only
ufw allow from 10.0.0.0/24 to any port 4401 proto tcp comment "VPN-only :4401"
# Restore a port to public
ufw delete allow from 10.0.0.0/24 to any port 4401 proto tcp
ufw allow 4401/tcp
# Check result
ufw status verbose
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 233 lines · 54 tokens per session scan A 85521307fe46
vpn-access-control is a skill published in the GitHub repository LuuOW/meridian-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 2,482 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
coolify
Use when self-hosting apps and databases with Coolify on a VPS you own — install, first-admin lockdown, Git-to-deploy (Nixpacks/Dockerfile/compose), managed Postgres/Redis, scheduled S3 backups, domains + auto-SSL. NOT a PaaS someone else runs (that is railway), NOT sizing/hardening the box (that is hetzner), NOT…
ecspresso
ECS deployment tool - deploy, manage, and troubleshoot ECS services.
docker-devops
Create optimized Docker configurations, docker-compose setups, Kubernetes manifests, and CI/CD pipelines. Use when containerizing applications, setting up deployment infrastructure, or automating builds. Triggers on: Docker, Dockerfile, container, docker-compose, Kubernetes, k8s, CI/CD, GitHub Actions, deployment.
Docker Patterns
Use this skill when containerizing an app or debugging container behavior (build failures, missing deps, runtime env differences).
docker-essentials
Create and optimize Dockerfiles, docker-compose configurations, and container workflows. Use when containerizing applications, setting up development environments, or optimizing Docker builds.
DevOps Pipeline Builder
Design and implement CI/CD pipelines, Docker configurations, deployment strategies, and infrastructure automation with production-ready patterns.