Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MilkyWay008/Hermes-OTG --skill mpp-agentgit clone --depth 1 https://github.com/MilkyWay008/Hermes-OTGWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/milkyway008/hermes-otg/mpp-agent)<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/mpp-agent"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/mpp-agent/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/milkyway008/hermes-otg/mpp-agent"><img src="https://agentmods.dev/badge/skills/milkyway008/hermes-otg/mpp-agent.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.01320 |
| Opus 5 | $0.00008 | $0.00660 |
| Sonnet 5 | $0.00003 | $0.00264 |
| Haiku 4.5 | $0.00002 | $0.00132 |
Grade C, and why
mpp-agent scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
- **Zero-amount challenges.** Some MPP endpoints charge `$0.00` and just want a proof credential. These work without a funded wallet. Don't refuse them as "broken." Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -i <url> This is a copy
100% identical to mpp-agent — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MPP Agent Skill
Wraps the Machine Payments Protocol (MPP, https://mpp.dev) clients so Hermes can pay for per-request API access against servers that respond with HTTP 402 Payment Required.
Three client options, all distributed via npm. Pick the lightest one that solves the user's need. Gated [linux, macos] while the broader payments tooling matures on Windows.
When to Use
- A merchant API returns
HTTP 402with awww-authenticateheader — and the user wants to actually pay it, not just log the response. - The user asks to "pay per request", "set up an agent wallet", "use Tempo / Privy / AgentCash", or wants to discover MPP-priced services.
- A Stripe Link spend has produced a Shared Payment Token (SPT) and the agent needs to attach it to the 402 challenge — in that flow, prefer
link-cli mpp pay(see thestripe-link-cliskill).
Choosing a client
| Tool | When | Setup |
|---|---|---|
link-cli |
User already has Stripe Link set up, or the 402 challenge advertises method="stripe" |
see the stripe-link-cli skill |
| Tempo Wallet | MPP services with spend controls, service discovery | tempo wallet login |
| Privy Agent CLI | Multi-chain wallets, browser-based funding | privy-agent-wallets login |
| AgentCash | 300+ pre-priced APIs via one USDC.e balance | npx agentcash onboard |
mppx |
Dev + debugging, smallest dep surface | npm install -g mppx then mppx account create |
Default: if the user already has Stripe Link configured or the 402 challenge specifies method="stripe", use link-cli mpp pay (the stripe-link-cli skill). Otherwise mppx for one-off paid calls and debugging, and Tempo Wallet when the user wants persistent spend controls.
Prerequisites
- Node.js 20+ on
PATH - A funded wallet (Tempo / Privy / AgentCash) OR an
mppxaccount - For Tempo / Privy / AgentCash: follow their respective onboarding skills:
https://tempo.xyz/SKILL.mdhttps://agents.privy.io/skill.mdhttps://agentcash.dev/skill.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 125 lines · 16 tokens per session scan C f44db1c9d2d0
mpp-agent is a skill published in the GitHub repository MilkyWay008/Hermes-OTG (15 stars, last pushed 26d ago), licensed MIT. It adds 16 tokens to every session and 1,320 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (tells the agent never to refuse, makes network calls). It is 100% identical to mpp-agent, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
hunt-subdomain
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps cloudapp.azure.com regional-pool re-issue (1-click OAuth ATO via wildcard replyto, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel…
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for…
meme-coin-audit
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP…
polymarket-copytrading
Mirror positions from top Polymarket traders. Polling mode (free) for portfolio-style copying, Reactor mode (Pro) for event-driven real-time mirroring via Simmer's on-chain signal infrastructure.
polymarket-weather-trader
Trade Polymarket weather markets using NOAA (US) and Open-Meteo (international) forecasts via Simmer API. Inspired by gopfan2's weather trading approach. Use when user wants to trade temperature markets, automate weather bets, check forecasts, or run weather-based strategies.
nansen-copytrader-overlay
Rank Polymarket copytrading leaders using Nansen as a data layer — pnl-by-market for the target market is the primary signal, address-summary/pnl-by-address is a secondary, credit-guarded refinement. Includes an experimental (dry-run only) live insider scan. Use when Simmer needs to re-rank or filter a leader list…