Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mismatched/tower/tower-clinpx skills add mismatched/tower --skill tower-cligit clone --depth 1 https://github.com/mismatched/towerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01226 |
| Opus 5 | $0.00000 | $0.00613 |
| Sonnet 5 | $0.00000 | $0.00245 |
| Haiku 4.5 | $0.00000 | $0.00123 |
Grade B, and why
tower-cli scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **Ping requires root** — `sudo tower ping ...` or `CAP_NET_RAW` on Linux How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tower CLI — Network Health Checks
Binary: tower — single binary, no runtime dependencies.
go install github.com/mismatched/tower@latest
Quick Reference
| Goal | Command |
|---|---|
| Ping a host | tower ping example.com --count 3 (requires root) |
| DNS resolve | tower dns example.com |
| DNS via specific server | tower dns example.com --from 8.8.8.8 |
| TCP port check | tower tcp example.com:443 --timeout 5s |
| TLS port check | tower tls example.com:443 --cert client.crt --key client.key |
| HTTP status check | tower http https://example.com --method HEAD |
| HTTP trace timing | tower trace https://example.com --method GET |
| TLS cert check | tower https example.com --warn 720h |
| TLS cert (insecure) | tower https example.com --insecure |
| WebSocket check | tower ws wss://example.com/ws --timeout 10s |
| Batch from config | tower check config.yml |
| MCP server | tower serve (stdio, hidden command) |
All Commands
tower ping <host> [--count N]
tower dns <addr> [--from server] [--timeout DUR]
tower tcp <host:port> [--timeout DUR]
tower tls <host:port> [--cert FILE] [--key FILE] [--timeout DUR]
tower http <url> [--method M] [--timeout DUR]
tower trace <url> [--method M]
tower https <host> [--port N] [--warn DUR] [--insecure] [--timeout DUR]
tower ws <url> [--timeout DUR]
tower check <config.yml>
tower serve (MCP stdio server)
JSON Output
Every command prints JSON to stdout. Structure matches libtower's Result:
{
"OK": true,
"Duration": 124304875,
"Data": {"IP": {"IP": "93.184.216.34", "Zone": ""}},
"Warning": null,
"Error": null
}
Datavaries by check:PingData,DNSData,CertData, ornullWarningis non-null on cert expiry warnings (HTTPS with--warn)tower checkoutputs a JSON array of results
Config File Format
checks:
- type: tcp
ip: "example.com"
port: 443
timeout: 5s
- type: https
host: "example.com"
warn_if_expiring: 720h
insecure_skip_verify: false
- type: dns
addr: "example.com"
- type: ping
host: "example.com"
count: 3
- type: http
url: "https://example.com"
method: GET
- type: ws
url: "wss://example.com/ws"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 146 lines · 0 tokens per session scan B 14ea7f947bda
tower-cli is a skill published in the GitHub repository mismatched/tower (24 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,226 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nightly-system-log-review
Review system and application logs for errors/warnings over the last 24 hours, filter known noise, and deliver a consolidated health report via email (AgentMail). Use when running a nightly or periodic system health check, log audit, or error review cron job.
agentic-devops
Production-grade agent DevOps toolkit — Docker, process management, log analysis, and health monitoring. Built by engineers who run production.
alert-rule-troubleshoot
This skill should be used when the user reports that an alert rule is "not firing", "no alert was sent", "the rule didn't trigger", "the rule isn't working", "it should have alerted but didn't", "why didn't I get an alert", "alert rule not firing", or wants to diagnose why a specific alert rule failed to produce an…
generate-message-template
Generate or modify Nightingale (n9e) alert notification message templates. Use when the user asks to write a notification template, change the message format, add hostname/recovery value/severity, or create DingTalk/Feishu/Lark/email/SMS/voice templates.
ops-troubleshooting
This skill should be used when the user asks to "troubleshoot", "diagnose", "debug alert", "investigate incident", "locate a fault", "investigate an alert", "diagnose a problem", "fix an issue", "check alerts", "analyze alerts", "root cause analysis", "check metrics", "check logs", or discusses…
doc-qa
This skill should be used when the user asks "how-to" or factual questions about Nightingale (n9e) — UI/where-to-click, business groups/subscription rules/mute rules/edge mode, Token usage, notification pipeline, self-healing trigger conditions; OR about categraf input plugin field meanings, metric names, defaults…