Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mindverse-ltd/macaron-artifacts/macaron-webui-kiminpx skills add mindverse-ltd/macaron-artifacts --skill macaron-webui-kimigit clone --depth 1 https://github.com/mindverse-ltd/macaron-artifactsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mindverse-ltd/macaron-artifacts/macaron-webui-kimi)<a href="https://agentmods.dev/skills/mindverse-ltd/macaron-artifacts/macaron-webui-kimi"><img src="https://agentmods.dev/badge/skills/mindverse-ltd/macaron-artifacts/macaron-webui-kimi.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00211 | $0.01406 |
| Opus 5 | $0.00105 | $0.00703 |
| Sonnet 5 | $0.00042 | $0.00281 |
| Haiku 4.5 | $0.00021 | $0.00141 |
Grade A, and why
macaron-webui-kimi scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to macaron-webui — 37 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Macaron WebUI (Kimi Code)
Use this skill when the user wants to open the Macaron WebUI — a local browser app that lists Kimi Code workspaces + sessions from ~/.kimi-code/sessions/, lets them continue any turn, and streams GenUI TSX previews.
"macaron web ui" is a proper noun, not a task. Phrases like "open macaron web ui" / "打开 macaron web ui" / "launch the macaron ui" always mean launch this WebUI. They do NOT mean "deploy the current project", "build the repo I'm in", or "start a dev server for the surrounding codebase" — regardless of what project the user currently has open. If you're tempted to deploy or serve the current directory in response to one of these phrases, that's the misread this skill exists to prevent: run the bootstrap below instead.
Resolving the plugin root
Resolve the plugin root from this SKILL.md file by going two directories up from skills/macaron-webui-kimi/. The launcher script is at <plugin root>/start.sh.
Bootstrap
Run this exactly once. Two env vars matter:
MACARON_ENGINE=kimi— flips the SPA served at/from the Claude-focused UI to the Kimi-focused one. Never omit this. Without it the user sees the Claude Code UI, not Kimi Code.MACARON_FOREGROUND=1— makesstart.shexec nodeinto the foreground instead of nohup-backgrounding. Backgrounded children get killed when the outer script returns inside your shell tool, so the server would disappear seconds after launch. Foreground keeps the process anchored to the tool session and the URL is printed asynchronously beforeexecblocks.
MACARON_ENGINE=kimi MACARON_FOREGROUND=1 MACARON_PORT=7980 bash "<plugin root>/start.sh"
Port 7980 is the Kimi-side default so it doesn't collide with the Claude Code plugin (which uses 7878) or the Codex plugin (7979). All three can run at once. If 7980 is busy, tell the user to override with MACARON_PORT=<n>.
The script:
- Mirrors itself out of the plugin cache on first launch.
~/.kimi-code/plugins/managed/…is not a stable working directory — the host can prune it on version sync, which erasesnode_modules+web/dist+server/distwhile any surviving server still listens on 7980 and returns 404s.start.shdetects the cache path and rsyncs source into~/.macaron/runtime/<version>/, then installs/builds/runs from there. Subsequent launches re-rsync (fast) and reuse the same stable runtime. - Uses
corepack pnpm(Node 22+ ships corepack) to install workspace deps + build on first launch (~60s). If frozen install fails, it retries without the lock. If build fails, it prints a[macaron] fix: <command>line — run the printed command and retry. - Skips the install/build on subsequent launches if
node_modulesis present and no source file is newer than the current build. - Frees the port if a stale
mkx/mcx/mccis bound (lsof→kill). - Prints
Macaron WebUI (engine=kimi): http://localhost:7980once/api/healthanswers, THEN blocks onexec node. - Stays in the foreground indefinitely. This is expected — do NOT kill it after launch. The shell tool can move on while this shell keeps the server alive.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 60 lines · 211 tokens per session scan A 4d2d1c84ca46
macaron-webui-kimi is a skill published in the GitHub repository mindverse-ltd/macaron-artifacts (10 stars, last pushed 14d ago), licensed Apache-2.0. It adds 211 tokens to every session and 1,406 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to macaron-webui, differing in 37 lines, and is treated as a copy.
Other skills, from other repositories
portaljs-add-chart
Add a chart (line, bar, area, pie, or scatter) to a dataset's showcase in a PortalJS portal. Installs recharts, writes a reusable Chart component, and renders it in the showcase Views section. Use when visualizing a dataset already registered in datasets.json.
mcp-visual-output
Interactive MCP visual output via @json-render/mcp: upgrade plain JSON tool responses to dashboards rendered in sandboxed iframes inside MCP clients like Claude, Cursor, and ChatGPT. Use when a tool result would read better as a stat grid, data table, or status badge than as text. For the server itself (transport…
panel
Best practices for developing tools, dashboards and interactive data apps with HoloViz Panel. Create reactive, component-based UIs with widgets, layouts, templates, and real-time updates. Use when developing interactive data exploration tools, dashboards, data apps, or any interactive Python web application. Supports…
panel-holoviews
Best practices for integrating HoloViews and hvPlot visualizations into Panel applications. Use when embedding HoloViews/hvPlot plots in Panel panes, preserving zoom/pan state across data refreshes with DynamicMap, composing DynamicMap overlays without type errors, using HoloViews streams (Selection1D, RangeXY, Tap…
hvplot
Best practices for doing quick exploratory data analysis with minimal code and a Pandas .plot like API using HoloViews hvPlot.
holoviz-mcp-cli
Command reference for the holoviz-mcp CLI tool. Use the CLI when you have Bash/shell access and want direct access to HoloViz documentation, component introspection, and visualization tools.