Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mendixlabs/mxcli/mock-rest-apisnpx skills add mendixlabs/mxcli --skill mock-rest-apisgit clone --depth 1 https://github.com/mendixlabs/mxcliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.02543 |
| Opus 5 | $0.00038 | $0.01272 |
| Sonnet 5 | $0.00015 | $0.00509 |
| Haiku 4.5 | $0.00008 | $0.00254 |
Grade A, and why
mock-rest-apis scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS -i http://127.0.0.1:4020/rates # 200 + the example payload? How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mock REST APIs Skill
Use this skill when a REST integration needs an endpoint you control instead of a live third-party API — while building it, while reproducing a bug, or while verifying the app in a browser or a test run.
Developing against the real API means network, rate limits, credentials, and a payload that can change under you. None of that is where Mendix integration defects live: those are in the mapping, the entity types, the error handler, and the BSON. A mock removes the variables that are not the bug.
When to Use This Skill
- Building a REST client or
REST CALLmicroflow before (or without) real credentials - Reproducing a payload-shaped bug deterministically — a shape small enough to read, that behaves the same on every run
- Exercising error paths: 404, 500, a timeout, a 401 from missing auth
- Verifying the app (
test-app) or running a suite (test-microflows) offline or in CI - Redirecting the outbound calls of an app whose model you must not edit
Two separate problems
Almost every wasted hour here comes from conflating them:
| Problem | Answer |
|---|---|
| Something must answer the request | A mock server: Prism (from a contract), WireMock, mitmproxy |
| The app must send the request there | A constant, a BaseUrl, or a forward proxy — see below |
A mock server is not an interceptor. Prism serves one contract at one port and answers only clients that address it. Asking it to "catch all calls the app already makes" is a category error — that is the forward-proxy job, further down.
1. Point the app at the mock
Three routes, cheapest first. Pick by how the URL is built.
The URL is built in the microflow — use a constant, change nothing per run
A REST CALL URL is an expression, so it can be assembled from a constant
(@Module.Constant is Mendix's constant reference — $Name is a variable):
create constant MyModule.ApiBaseUrl type String default 'https://api.example.com/v1';
create microflow MyModule.CallApi() returns string
begin
$response = rest call get @MyModule.ApiBaseUrl + '/rates'
header Accept = 'application/json'
returns string;
return $response;
end;
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 200 lines · 76 tokens per session scan A 0977dd0c400e
mock-rest-apis is a skill published in the GitHub repository mendixlabs/mxcli (115 stars, last pushed 3d ago), licensed Apache-2.0. It adds 76 tokens to every session and 2,543 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
batch
Execute batch operations on multiple files in parallel. Automatically discovers files, splits into chunks, and processes with parallel worker agents. Use /batch followed by operation and file pattern.
complete-partial-pr
Evaluate and complete an issue or PR where the submitted patch fixes only a narrow symptom of the reported pain point. Use when a contribution may miss adjacent integration surfaces, provider/spec semantics, roundtrip behavior, tests, docs, or historical maintainer decisions.
pr-feedback
Fetches PR review feedback and inline comments, categorizes them, and presents options to the user. Use when the user asks to get, read, address, or fix review comments on a pull request.
Swift Performance Optimization Skill
Use when investigating measured Swift or Apple-platform regressions in CPU, memory, launch, scrolling, animation hitches, image processing, energy, networking, or concurrency, or when designing performance tests and Instruments experiments. Do not use for speculative micro-optimization, ordinary refactoring, or a…
asc
Drive App Store Connect from the terminal with the asc CLI — TestFlight builds, groups, testers and What to Test notes; App Store versions, metadata, keywords, screenshots and release notes; submissions and review health; signing, provisioning and notarization; crash and beta-feedback triage; pricing, subscriptions…
doubt-driven-review
In-flight adversarial check on a non-trivial decision BEFORE it stands — distinct from post-hoc review of a finished diff. Use on "stress-test this decision", "are we sure about this", "verify before commit", "poke holes in this", when working in unfamiliar code, or before an irreversible step (migration, prod deploy…