Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metaspartan/cybara --skill fastmcpgit clone --depth 1 https://github.com/metaspartan/cybaraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metaspartan/cybara/fastmcp)<a href="https://agentmods.dev/skills/metaspartan/cybara/fastmcp"><img src="https://agentmods.dev/badge/skills/metaspartan/cybara/fastmcp.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 42 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
- medium MCP Rug Pull · line 43 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
- medium MCP Rug Pull · line 44 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
- medium MCP Rug Pull · line 45 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
- medium MCP Rug Pull · line 53 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00540 |
| Opus 5 | $0.00010 | $0.00270 |
| Sonnet 5 | $0.00004 | $0.00108 |
| Haiku 4.5 | $0.00002 | $0.00054 |
Grade A, and why
fastmcp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
FastMCP
Use this when the user wants to create or test a Python MCP server, wrap an API/database/CLI as MCP tools, expose resources/prompts, or prepare an HTTP MCP endpoint.
Server Shape
Start narrow:
- 1-3 concrete tools first.
- Read-only by default.
- Explicit typed parameters.
- JSON-safe return values.
- Clear docstrings; the docstring is the user-facing tool description.
Good tool names: get_customer, search_tickets, describe_table, summarize_file.
Weak names: run, process, do_thing.
Minimal Template
from fastmcp import FastMCP
mcp = FastMCP("Example")
@mcp.tool
def echo(text: str) -> dict:
"""Echo text back for smoke testing."""
return {"text": text}
Local Validation
Prefer isolated runs:
uvx fastmcp version
uvx fastmcp inspect server.py:mcp
uvx fastmcp list server.py --json
uvx fastmcp call server.py echo text=hello --json
If uv is unavailable, use a project virtualenv and install fastmcp there. Do not install global Python packages unless the user asks.
HTTP Transport Smoke
uvx fastmcp run server.py:mcp --transport http --host 127.0.0.1 --port 8000
uvx fastmcp list http://127.0.0.1:8000/mcp --json
uvx fastmcp call http://127.0.0.1:8000/mcp echo text=hello --json
Cybara Integration
Once the server contract is stable:
- Add it through Cybara MCP configuration or the MCP UI.
- Confirm
tools/listreturns the expected tool names. - Call at least one real tool through Cybara before declaring integration complete.
Safety
- Validate paths and URLs before using them.
- Keep database examples read-only until explicitly approved.
- Never expose raw shell execution as a general MCP tool.
- Do not pass secrets as plain parameters unless the MCP client/server contract requires it; prefer env/config.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 72 lines · 20 tokens per session scan A a5330d24c4ab
fastmcp is a skill published in the GitHub repository metaspartan/cybara (28 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 540 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ecc-api-patterns
Skill "ecc-api-patterns" from KornLabs/truss, covering fastapi patterns, project structure, app factory and lifespan, app/main.py and configuration with pydantic-settings.
adk-agent-builder
Builds ADK (Agent Development Kit) Python agents: LLM agents with tools, graph workflows of function and agent nodes, conditional routing, fan-out and join, schema-validated delegation between agents, human-in-the-loop pauses, and pytest coverage for all of it. Use when asked to create an agent or a workflow, add a…
adk-style
Python style and codebase conventions for ADK (Agent Development Kit): private-by-default file visibility, imports, type hints, Pydantic v2 models, formatting, docstrings, logging, async I/O, file and test layout, and unit test structure. Use when writing or editing ADK source or tests, deciding whether a new file or…
adk-verify-snippets
Checks that every Python code block in a Markdown file actually compiles and runs, by extracting each block to a temporary file, executing it in an isolated subprocess, and writing a pass/fail report with per-snippet coverage. Use when the user asks to verify, test, or validate the code samples in a README, a guide…
adk-setup
Sets up a local ADK Python development environment in a git clone of the open-source adk-python repository: a uv virtual environment, all dependency extras, pre-commit hooks, and a first unit-test run. Runs only when explicitly requested, never on its own. Use when asked to set up, bootstrap, or repair a development…
python-lib-analyzer
Analyze any Python library structure, explore modules, classes, and functions with signatures and documentation.