agentmods.dev

lock-project-stack

lock-project-stack is a skill for Claude Code from n24q02m/wet-mcp. It costs 48 tokens per session (569 once invoked), scanned A, original, Apache-2.0.

A project setup tool that reads a dependency manifest such as package.json, pyproject.toml, go.mod, or Cargo.toml and records the exact library versions used by the project.

In plain words
What is it for?
Use it before asking documentation questions about a project with JavaScript, Python, Go, or Rust dependencies.
Why use it?
It keeps documentation searches tied to the versions your code actually uses instead of returning information for newer releases. It also shows how many detected libraries already have indexed documentation.

Skill for Claude Code

Written for Claude Code: argument-hint in frontmatter.

Part of the wet-mcp plugin — 5 skills, 1 MCP server shipped together

not rated 17repo yesterday A scan 48 tokens original Apache-2.0

Good fit Use it before asking documentation questions about a project with JavaScript, Python…

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/n24q02m/wet-mcp/lock-project-stack
View source ↗ n24q02m/wet-mcp mcp.n24q02m.com
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add n24q02m/wet-mcp --skill lock-project-stack
Clone the repo
git clone --depth 1 https://github.com/n24q02m/wet-mcp

Made for: Claude Code.

Or install wet-mcp, the plugin that ships this one along with the rest of its 5 skills, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for lock-project-stack

README.md
[![agentmods](https://agentmods.dev/badge/skills/n24q02m/wet-mcp/lock-project-stack.svg)](https://agentmods.dev/skills/n24q02m/wet-mcp/lock-project-stack)
Your own site
<a href="https://agentmods.dev/skills/n24q02m/wet-mcp/lock-project-stack"><img src="https://agentmods.dev/badge/skills/n24q02m/wet-mcp/lock-project-stack.svg" alt="Measured on agentmods" height="20"></a>
Per session 48 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 569 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00048 $0.00569
Opus 5 $0.00024 $0.00284
Sonnet 5 $0.00010 $0.00114
Haiku 4.5 $0.00005 $0.00057

Measured 7d ago against content hash 9c3a552b0e7c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

lock-project-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

skills/lock-project-stack/SKILL.md · 55 lines

How it starts

The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.

lock-project-stack

Bind a project to its declared dependency versions so every search(action="docs_query") call from inside that project surfaces docs for the exact versions you pinned, instead of "latest". Mirrors the Cabinets workflow from spec section 4.3.

Steps

  1. Resolve the project root:

    • If the user gave an absolute path, use it.
    • Otherwise infer the root from the current workspace context (e.g. git rev-parse --show-toplevel output).
    • Confirm at least one supported manifest exists: pyproject.toml, package.json, go.mod, or Cargo.toml.

  2. Lock the project:

    • Call search(action="docs_lock_project", project_path=<abs_path>).
    • The response includes total detected libraries + indexed count (how many already have docs in Tier 1 or Tier 2). Surface both numbers to the user so they know how much coverage they have today.

  3. Trigger Tier 2 ingestion for missing libraries (optional):

    • Iterate the locked_libraries list; for entries with indexed == false, call search(action="docs_query", library=<name>, project_path=<abs_path>, query="<library> overview") once. The first call kicks off background Tier 2 ingestion; subsequent calls return real chunks.

  4. Verify lock reuse:

    • Re-call search(action="docs_query", library=<name>, project_path=<abs_path>, query=...) WITHOUT specifying version. The response should include a non-null lock_pin field matching the version from the manifest, confirming Cabinets is honoring the pin.

  5. Surface the pin to the user:

    • Summarize "Locked N libraries against versions X.Y.Z (M already indexed, K queued for Tier 2 ingestion)."

Best practices

  • Re-run after every dependency bump so the lock stays in sync with what is actually installed.
  • For monorepos, lock each workspace project separately — wet-mcp keys on absolute path so apps/web and apps/api get distinct locks.
  • The lock is a hint, not a hard constraint — callers can always override the version by passing it explicitly to docs_query.

Read the full file on GitHub · 55 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 55 lines · 48 tokens per session scan A 9c3a552b0e7c

Subscribe to this mod's changes

lock-project-stack is a skill published in the GitHub repository n24q02m/wet-mcp (17 stars, last pushed yesterday), licensed Apache-2.0. It adds 48 tokens to every session and 569 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

LanguagesPythonWriting and docscrawl4aimcpmcp-servermodel-context-protocolopen-source
Related

Other skills, from other repositories

knowledge-audit

Review and clean up stored memories — find duplicates, contradictions, stale entries, and consolidate.

n24q02m/mnemo-mcp · 21 tokens

temporal-query

Answer time-travel questions over stored memory — what was believed at a past point in time, when a belief changed, and what replaced it. Use when the user says "as of", "back in", "at the time", "history of", "timeline", "what did I think then", or asks why a current memory contradicts an older one.

n24q02m/mnemo-mcp · 77 tokens

memory-commit

Use when the user explicitly says "remember this", "save this", "ghi nho", "luu lai", "save for next time", or otherwise asks to persist the immediately preceding context. Captures with the appropriate contexttype (decision, preference, fact, skill, task, conversation) so future sessions can retrieve it accurately.

n24q02m/mnemo-mcp · 72 tokens

recall-context

Use at session start, before significant decisions, or when a new task references a known project to recall mnemo memories matching the current working directory, recently edited files, or topic keywords. Helps maintain continuity across sessions and avoid redoing past research.

n24q02m/mnemo-mcp · 53 tokens

session-handoff

End-of-session knowledge capture — decisions, preferences, corrections, conventions, open questions.

n24q02m/mnemo-mcp · 20 tokens

passport-bootstrap

Use when the user installs mnemo-mcp on a fresh machine and wants to restore prior memory state from S3 or Google Drive (Phase 2 passport sync). Triggers on phrases like "set up mnemo on this machine", "restore my memory passport", "import passport", "bootstrap mnemo", or when the user says they got a new laptop / VM…

n24q02m/mnemo-mcp · 83 tokens