Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mrnaqa/sourceweave-web-search/sourceweave-publishingnpx skills add MRNAQA/sourceweave-web-search --skill sourceweave-publishinggit clone --depth 1 https://github.com/MRNAQA/sourceweave-web-searchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mrnaqa/sourceweave-web-search/sourceweave-publishing)<a href="https://agentmods.dev/skills/mrnaqa/sourceweave-web-search/sourceweave-publishing"><img src="https://agentmods.dev/badge/skills/mrnaqa/sourceweave-web-search/sourceweave-publishing.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.02826 |
| Opus 5 | $0.00060 | $0.01413 |
| Sonnet 5 | $0.00024 | $0.00565 |
| Haiku 4.5 | $0.00012 | $0.00283 |
Grade A, and why
sourceweave-publishing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 383 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SourceWeave Publishing
This skill is for publishing sourceweave-web-search autonomously and safely.
The repo already has a concrete release shape. Do not invent a new one unless the user explicitly asks. The core job is to make release metadata consistent, verify the release surface, publish the package/container artifacts, and only then publish MCP Registry metadata.
Apply KISS/YAGNI/DRY/SOLID when reviewing or editing release flow:
- do not add new knobs or alternate publish paths unless the repo already uses them
- do not duplicate release logic across docs, scripts, and skill text when one source of truth already exists
- prefer small repairs to the existing workflow over new helper scripts
- stop and ask only when a real release blocker exists, not for routine operational steps
Goal
Publish SourceWeave with least surprising flow:
- bump the version in
pyproject.toml - update
CHANGELOG.mdso released changes move out ofUnreleased - review public docs and refresh
README.mdif release changes user-facing behavior - sync derived release metadata
- verify package, artifact, tests, and container surface
- commit and push release-ready state to target branch
- run GitHub release workflow
- confirm PyPI and container artifacts are live
- publish
server.jsonto MCP Registry
Source Of Truth
Treat pyproject.toml as the release version source of truth.
Use this as the canonical release-metadata sync command:
uv run python scripts/sync_release_metadata.py
The packaged script entry point is an equivalent alternative when that is more convenient:
uv run sourceweave-sync-release-metadata
The sync/check path covers:
src/sourceweave_web_search/tool.pyheader versionserver.jsonversion and package versions- Dockerfile OCI version label
docker-compose.ymlpublishable image tag
Do not hand-edit those version fields unless the user explicitly asks for a one-off repair.
The sync script does not cover every literal version occurrence in repo.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 383 lines · 119 tokens per session scan A 2a7d96e43b7b
sourceweave-publishing is a skill published in the GitHub repository MRNAQA/sourceweave-web-search (2 stars, last pushed 4mo ago), licensed MIT. It adds 119 tokens to every session and 2,826 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release
Cut a FastMCP release end to end. Use when the maintainer says "cut a release", "prep a patch", "ship 4.x.y", or asks what a release would contain. Covers the notes preview, the title pun, the docs changelog PR that must land before the tag, the tag itself, the publish fan-out, and verifying gofastmcp.com actually…
xcodebuildmcp-docs-release-review
Use when reviewing XcodeBuildMCP documentation, CLI command references, website manifest generation, changelog, release notes, and release script changes.
git-wrapup
Land working-tree changes as logical commits — the work grouped by concern, topped by a release commit (version bump, changelog, regenerated artifacts) and an annotated tag. Verify, commit, tag. Stops at "committed and tagged locally" — no push, no publish. The release-and-publish skill picks up from here. Distilled…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, pushes commits and tags, then publishes to each applicable destination. Assumes git wrapup (version bumps, changelog, commit, annotated tag) is already…
release-rome-image
Release a new Rome runtime image by pushing a vX.Y.Z tag — pick the version, verify main is releasable, push the tag, and confirm the image published to Docker Hub. Covers the v runtime-image tag only, not the desktop app (desktop-v) and not npm packages (ui-v, app-runtime-v).
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.