Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add monkilabs/opencastle --skill gitlab-platformgit clone --depth 1 https://github.com/monkilabs/opencastleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/monkilabs/opencastle/gitlab-platform)<a href="https://agentmods.dev/skills/monkilabs/opencastle/gitlab-platform"><img src="https://agentmods.dev/badge/skills/monkilabs/opencastle/gitlab-platform/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/monkilabs/opencastle/gitlab-platform"><img src="https://agentmods.dev/badge/skills/monkilabs/opencastle/gitlab-platform.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01812 |
| Opus 5.5 | $0.00022 | $0.00725 |
| Sonnet 5.5 | $0.00011 | $0.00362 |
| Haiku 4.5 | $0.00006 | $0.00181 |
Grade A, and why
gitlab-platform scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitLab Platform
Branch, commit and merge request conventions: the git-workflow skill, where a pull request is GitLab's merge request (MR). Docs: https://docs.gitlab.com/user/project/merge_requests/
The MCP server
GitLab's own server, https://gitlab.com/api/v4/mcp, or https://<your-host>/api/v4/mcp on a self-managed instance (18.6 or later). It signs in with OAuth: the assistant registers itself and opens a browser the first time. It answers only once MCP access is allowed, by an owner for the top-level group on GitLab.com or by an administrator on a self-managed instance. Tool names change between releases: read the tool list the server offers instead of assuming a name.
- Toolsets. On by default:
meta,core,merge_requests,work_items,repository,ci.wikisandcode_securityare opt-in, through theX-Gitlab-Enabled-Mcp-Server-Toolsetsheader. - Identifiers. A project is its full path (
group/subgroup/project) or its numeric ID. An MR is!42and an issue#42. Tools take that IID with the project, not the global ID the API also returns. - One call, many facets.
get_merge_requesttakesinclude(diffs,pipelines,discussions,approvals,conflicts), andget_pipelinetakesinclude: ["jobs"]. Issues, tasks and epics are all work items (save_work_item,get_work_item);create_issueandget_issuestill answer but are superseded. glabcovers the rest: raw API calls, CI linting and stacks, below. It signs in on its own (glab auth status).
Gotchas
- A line that starts with a quick action runs it.
/merge,/approve,/closeor/assignat the start of a line in a comment or description executes on save, through the API too. Wrap a command you are only quoting in backticks. - Why an MR cannot merge:
glab api projects/:id/merge_requests/42and readdetailed_merge_status:not_approved,discussions_not_resolved,ci_must_pass,need_rebase,conflictordraft_status. - A person merges, as git-workflow says. Stop at an approved MR with a green pipeline, though
accept_merge_requestexists. Draft:at the start of the title keeps an MR from merging while work remains.Closes #42in the description closes the issue only when the MR merges into the default branch.- An error on a field can be the tier.
weight,status_id,blockslinks and MR dependencies need Premium;health_statusand vulnerabilities need Ultimate. On Free, leave them out rather than retrying. - In a review comment, a
```suggestion:-0+0block replaces the commented line when the author applies it;-1+2widens it to one line above and two below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 73 lines · 55 tokens per session scan A d586591da11b
gitlab-platform is a skill published in the GitHub repository monkilabs/opencastle (80 stars, last pushed yesterday), licensed MIT. It adds 55 tokens to every session and 1,812 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-09.
Other skills, from other repositories
gentle-ai-work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
commit
A commit candidate is the exact patch that will enter the commit. A coherent change has one task or issue as its reason for existing.
github-pr-workflow
Prepare a GitHub pull request from a feature branch — branch hygiene, commit shape, title/body, verification notes, screenshots for UI work, and replies to review comments.
review-delta
Review only changes since last commit using impact analysis. Token-efficient delta review with automatic blast-radius detection.
git-pr-workflows-git-workflow
Guide changes through code checks, testing, commits, and pull request preparation. Use when coordinating a complete Git workflow and verifying readiness for collaboration.
hero-diff-highlight
A dark code editor reveals a red deletion then a green addition with a soft pulse. Function: PR / code-change explainer.