Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add moonlight-lupin/agent-skills --skill endpoint-probegit clone --depth 1 https://github.com/moonlight-lupin/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/moonlight-lupin/agent-skills/endpoint-probe)<a href="https://agentmods.dev/skills/moonlight-lupin/agent-skills/endpoint-probe"><img src="https://agentmods.dev/badge/skills/moonlight-lupin/agent-skills/endpoint-probe/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/moonlight-lupin/agent-skills/endpoint-probe"><img src="https://agentmods.dev/badge/skills/moonlight-lupin/agent-skills/endpoint-probe.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00159 | $0.04693 |
| Opus 5 | $0.00079 | $0.02346 |
| Sonnet 5 | $0.00032 | $0.00939 |
| Haiku 4.5 | $0.00016 | $0.00469 |
Grade C, and why
endpoint-probe scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
21. **SSRF protection.** The probe blocks private/internal IP ranges (RFC1918, loopback, link-local, CGNAT `100.64/10`, ULA `fc00::/7`, IPv4-mapped IPv6 like `::ffff:127.0.0.1`) and cloud metadata endpoints (`169.254.169 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
10. **Self-signed certs.** The script uses urllib which verifies certs by default. `PYTHONHTTPSVERIFY=0` does NOT affect urllib (it only affects `requests`/`httpx`). Self-signed targets are currently unsupported — use `- How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Endpoint Probe
Probe a base URL to discover its API surface: type, auth, endpoints, rate limits, CORS, and server fingerprint.
When to Use
- User gives you a base URL and asks "what API is available?" or "what endpoints does this have?"
- You need to understand an undocumented or partially-documented API before building an integration
- User asks "how does this API authenticate?" or "what auth does this endpoint need?"
- You're evaluating a third-party service and need to map its API surface
- User says "discover", "probe", "explore", or "recon" an API endpoint
- User wants to know what tools an MCP server provides before configuring it
- User asks "what does this MCP server offer?" or "what tools does MCP server X have?"
Don't use for:
- Scraping HTML page content (use
website-scraping) - QA testing of known functionality (use a QA/testing skill)
- Configuring MCP servers (use an MCP configuration skill) — this skill discovers MCP server surfaces, it doesn't configure them
- Monitoring an API over time (this is a one-shot discovery tool)
Workflow
1. Run the probe script
python scripts/probe_api.py <base_url> [options]
Options:
| Flag | Description | Default |
|---|---|---|
--auth TOKEN |
Auth token/credential | none |
--auth-type |
bearer, basic, or apikey |
bearer |
--header "Key: Value" |
Custom header (repeatable) | none |
--timeout N |
Request timeout in seconds | 10 |
--json |
Output raw JSON instead of formatted report | off |
--no-guess |
Skip REST resource guessing | off |
--api-version v1 |
API version prefix for resource probing | none |
--mcp |
Probe as MCP server over HTTP (StreamableHTTP) | off |
--mcp-stdio |
Probe as MCP server over stdio (launch subprocess) | off |
--mcp-env "KEY=value" |
Env var for stdio MCP server (repeatable) | none |
--allow-private |
Allow probing private/internal IP addresses | off |
Examples:
# Basic probe — no auth
python scripts/probe_api.py https://api.example.com
# With Bearer token
python scripts/probe_api.py https://api.example.com --auth "tok_abc123"
# With API key (sends X-API-Key header)
python scripts/probe_api.py https://api.example.com --auth "key_xyz" --auth-type apikey
# Skip resource guessing (faster, less noisy)
python scripts/probe_api.py https://api.example.com --no-guess
# JSON output for programmatic use
python scripts/probe_api.py https://api.example.com --json
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 234 lines · 159 tokens per session scan C 8bb7742d6b76
endpoint-probe is a skill published in the GitHub repository moonlight-lupin/agent-skills (60 stars, last pushed 3d ago), licensed MIT. It adds 159 tokens to every session and 4,693 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it C with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
n8n-docs-assistant
Answers n8n product, setup, credential, node, hosting, API, and usage questions from current n8n docs. Use when the user asks how to configure, set up, troubleshoot, or understand n8n behavior, especially credential setup questions opened from the credential modal.
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.
perf
Analyze Elixir/Phoenix performance — N+1 queries, assign bloat, ecto optimization, genserver bottlenecks. Use when slowness, timeouts, or high memory reported.
api-debugging
Systematic approach to debugging REST APIs, HTTP errors, authentication issues, and network problems. Use when the user has API errors, status code issues, timeout problems, or needs help troubleshooting HTTP requests.
schema-validation
JSON/data schema validation for construction data exchange: API payloads, file imports, BIM exports. Ensure data structure compliance before processing.
interoperability-analyzer
Analyze data interoperability issues in construction projects. Identify format incompatibilities and data loss points.