Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/maximhq/bifrost/api-validatornpx skills add maximhq/bifrost --skill api-validatorgit clone --depth 1 https://github.com/maximhq/bifrostWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00078 | $0.07021 |
| Opus 5 | $0.00039 | $0.03511 |
| Sonnet 5 | $0.00016 | $0.01404 |
| Haiku 4.5 | $0.00008 | $0.00702 |
Grade A, and why
api-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 677 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Validator
Audit Bifrost's HTTP API surface by scanning controller/handler route registrations, deriving the actual authentication behavior from middleware wiring, and comparing the result with docs/openapi/openapi.yaml and referenced OpenAPI path files.
Use this skill when the user asks for any of the following:
- "missing APIs"
- "incorrect APIs"
- "validate APIs"
- "check OpenAPI docs against controllers"
- "include auth information"
- "fix API docs"
- "audit route coverage"
Default behavior is audit only. Do not edit files unless the user explicitly asks for fixes or approves a proposed fix plan.
Usage
/api-validator # Full audit: all handlers + OpenAPI
/api-validator management # Audit only /api/*, /health, /ws, /metrics
/api-validator inference # Audit /v1/* and provider integration APIs
/api-validator auth # Focus on effective OpenAPI security vs middleware auth
/api-validator <path-prefix> # Audit one prefix, e.g. /api/governance or /openai
/api-validator --fix # Audit, present plan, then fix after approval
If scope is unclear, ask:
Should I audit all APIs, only management APIs (/api/*), only inference/integration APIs (/v1/* and provider prefixes), or a specific path prefix?
Source of truth
Code route sources
Scan these files/directories as the controller source of truth:
| Area | Source | Notes |
|---|---|---|
| Server route wiring | transports/bifrost-http/server/server.go |
RegisterAPIRoutes, RegisterInferenceRoutes, RegisterUIRoutes, direct /metrics, middleware lists |
| HTTP handlers/controllers | transports/bifrost-http/handlers/*.go |
RegisterRoutes methods contain direct route registrations |
| SDK/provider integrations | transports/bifrost-http/integrations/*.go |
RouteConfig factories and GenericRouter.RegisterRoutes register OpenAI/Anthropic/GenAI/Bedrock/Cohere/LiteLLM/LangChain/PydanticAI/Cursor/Passthrough routes |
| Auth middleware | transports/bifrost-http/handlers/middlewares.go |
APIMiddleware, InferenceMiddleware, whitelists, realtime auth skips |
| Context auth extraction | transports/bifrost-http/lib/ctx.go |
Virtual key and API key header extraction |
| Governance VK parser | plugins/governance/utils.go |
Accepted virtual key headers for VK self-service endpoints |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 677 lines · 78 tokens per session scan A d4287deaa8bf
api-validator is a skill published in the GitHub repository maximhq/bifrost (7,738 stars, last pushed today), licensed Apache-2.0. It adds 78 tokens to every session and 7,021 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
release-alignment
Use this skill for MCPMate pre-release or post-release documentation alignment, including GitHub Release Notes, website changelog entries, README release-facing copy, roadmap positioning, localized website docs, and release-description/changelog consistency checks.
uat-acceptance
Use this skill for MCPMate UI/UX review, UAT planning, Playwright acceptance, Admin Console acceptance, Board acceptance, Extension delivery acceptance, or any request to judge whether a page, flow, component, PR, or deliverable conforms to MCPMate product taste and acceptance standards. Use it even when the user does…
project-flow
Use this skill whenever work needs to be aligned with the MCPMate GitHub Project, including roadmap slicing, draft-item planning, PR scoping, worktree setup, or task-status updates. Trigger on requests about planning, roadmap, project board, task center, worktree discipline, or how to split work into reviewable slices.
review-flow
Use this skill whenever MCPMate work needs code review, PR readiness checks, severity calibration, or final findings ordering. Trigger on review requests, merge-readiness checks, PR cleanup, risk discussion, or any request to assess whether a change is ready to land.
validation
Use this skill whenever MCPMate work needs test, lint, build, Inspector, or release-slice verification. Trigger on implementation, review, bug fixes, PR preparation, regression checks, or any request to validate backend, frontend, desktop, or MCP behavior before reporting completion.
quality
Evaluates whether a GitHub issue is spam, empty, needs more information, or is OK to proceed.