Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mdcms-ai/mdcms --skill mdcms-self-host-setupgit clone --depth 1 https://github.com/mdcms-ai/mdcmsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mdcms-ai/mdcms/mdcms-self-host-setup)<a href="https://agentmods.dev/skills/mdcms-ai/mdcms/mdcms-self-host-setup"><img src="https://agentmods.dev/badge/skills/mdcms-ai/mdcms/mdcms-self-host-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mdcms-ai/mdcms/mdcms-self-host-setup"><img src="https://agentmods.dev/badge/skills/mdcms-ai/mdcms/mdcms-self-host-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 35 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01249 |
| Opus 5.5 | $0.00048 | $0.00500 |
| Sonnet 5.5 | $0.00024 | $0.00250 |
| Haiku 4.5 | $0.00012 | $0.00125 |
Grade A, and why
mdcms-self-host-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sf http://localhost:4000/healthz How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MDCMS Self-Host Setup
Stand up an MDCMS backend the user can point the CLI, Studio, and SDK at. The official self-hosting story is Docker Compose from the MDCMS source repo.
When to use this skill
The user has decided to run MDCMS themselves (local development, staging, or production), and there is no existing server URL they can use. If they already have a hosted MDCMS endpoint, skip this skill.
Prerequisites
- Docker 24+ and Docker Compose v2+ on the target machine (Docker Desktop covers both on macOS/Windows).
- Git, to clone the MDCMS source.
- Outbound network access to
github.com,ghcr.io(or Docker Hub), and any package registries the images pull from. - A free TCP port for the server (default
4000) and dependencies (5432,6379,9000,9001,1025,8025).
Steps
1. Clone the MDCMS source
git clone https://github.com/mdcms-ai/mdcms.git
cd mdcms
The project lives in a monorepo but Docker Compose handles everything — the host does not need Bun or Node.js to run the server.
2. Create the env file
cp .env.example .env
The example defaults are suitable for local evaluation. For staging or production, change:
- Database credentials (
POSTGRES_PASSWORD,DATABASE_URL). - S3/MinIO credentials (
S3_ENDPOINT,S3_ACCESS_KEY,S3_SECRET_KEY,S3_BUCKET) if switching to a real S3 bucket. - Auth provider settings if using OIDC/SAML/email.
MDCMS_STUDIO_ALLOWED_ORIGINS— the list of origins Studio is allowed to embed from. Add the URL(s) of the host apps that will embed<Studio />.
Keep the file out of version control.
3. Bring up the stack
docker compose up -d --build
This starts:
| Service | Port | Purpose |
|---|---|---|
| MDCMS Server | 4000 |
API backend |
| PostgreSQL 16 | 5432 |
primary database |
| Redis 7 | 6379 |
sessions + cache |
| MinIO | 9000 / 9001 |
S3-compatible object storage |
| Mailhog | 1025 / 8025 |
dev email capture |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 105 lines · 120 tokens per session scan A f11c80079d80
mdcms-self-host-setup is a skill published in the GitHub repository mdcms-ai/mdcms (22 stars, last pushed 3d ago), licensed MIT. It adds 120 tokens to every session and 1,249 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review
Review one pull request for real bugs, regressions, and convention violations. Enumerate candidate issues across the whole diff, verify each against the code, then return structured line-anchored findings and a verdict. Read-only on GitHub; the orchestrator posts the review.
creating-plugins
Create EmDash CMS plugins with sandboxed hooks, routes, storage, content and media APIs, MCP tools, and declarative admin UI, or native React and Astro extensions. Use when scaffolding or implementing an EmDash plugin.
emdash-cli
Use the EmDash CLI to inspect and manage an EmDash instance from the command line, including content, schema, media, taxonomies, menus, search, authentication, seeds, migrations, generated types, and whole-site export and import.
writing-emdash-docs
Write, revise, and review EmDash documentation for technical accuracy, useful structure, house style, and natural prose. Use when working on user documentation, guides, API reference pages, migration or upgrade guides, READMEs, contributor documentation, technical specifications, or release notes in the EmDash…
building-emdash-site
Build the site-facing parts of an EmDash CMS project on Astro, including schema and seeds, content queries, Portable Text rendering, menus, taxonomies, widgets, and deployment configuration. Use for EmDash site and theme work; use creating-plugins instead when the task is plugin authoring alone.
agent-browser
Use the agent-browser CLI to exercise web interfaces, inspect rendered accessibility state, verify interactions, and capture screenshots. Use for browser-based UI testing and evidence collection. Do not use as a substitute for deterministic Playwright coverage when an automated regression test is the requested…