agentmods.dev

nacre: Skill for Claude Code

.claude/skills/api-endpoint/SKILL.md

api-endpoint is a skill for Claude Code from nacre-work/nacre. It costs 89 tokens per session (945 once invoked), scanned A, original, Apache-2.0.

A guide for adding or changing REST web API endpoints. REST is a common way for software to exchange data over HTTP, and OpenAPI is a machine-readable description of that API.

In plain words
What is it for?
Use it when changing endpoints, OpenAPI documentation, problem responses, cursor pagination, idempotency, rate limits, or 403 and 404 handling.
Why use it?
It keeps endpoint documentation, status codes, error responses, pagination, retries, and access-related behaviour consistent and safer.

Skill for Claude Code

Written for Claude Code: installed under .claude/.

This is nacre-work/nacre's own configuration. It tells Claude Code how to work on nacre itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything nacre configures →

not rated 2repo +1 changed 17d ago A scan 89 tokens original Apache-2.0
View source ↗ nacre-work/nacre nacre.work
Reuse

Borrowing it

Nothing to install: this file belongs to nacre-work/nacre. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/nacre-work/nacre/main/.claude/skills/api-endpoint/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/nacre-work/nacre

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api-endpoint

README.md
[![agentmods](https://agentmods.dev/badge/skills/nacre-work/nacre/api-endpoint/github.svg)](https://agentmods.dev/skills/nacre-work/nacre/api-endpoint)
Your own site
<a href="https://agentmods.dev/skills/nacre-work/nacre/api-endpoint"><img src="https://agentmods.dev/badge/skills/nacre-work/nacre/api-endpoint/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for api-endpoint

Your own site · 80×15
<a href="https://agentmods.dev/skills/nacre-work/nacre/api-endpoint"><img src="https://agentmods.dev/badge/skills/nacre-work/nacre/api-endpoint.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 89 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 945 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00089 $0.00945
Opus 5.5 $0.00036 $0.00378
Sonnet 5.5 $0.00018 $0.00189
Haiku 4.5 $0.00009 $0.00094

Measured 17d ago against content hash 7a177704c437, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

api-endpoint scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/api-endpoint/SKILL.md · 80 lines

How it starts

The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Adding or changing a REST endpoint

Contract: docs/api.md, machine-readable in docs/openapi.yaml. The OpenAPI document is linted in CI (pnpm lint:openapi) and runs ahead of the code on purpose — update it in the same PR, not afterwards.

Status codes

The 403/404 split is the whole point and the easiest thing to get wrong:

  • 403 only when the caller is authenticated and the object is already visible to them, and the operation is forbidden.
  • 404 when the object is absent or invisible. Same status, same body, same wording for both. Any difference lets someone enumerate identifiers to discover which documents exist — that is invariant 4.

The rest: 400 schema, 401 missing or expired token, 409 version conflict, 413 over NACRE_MAX_DOCUMENT_BYTES, 422 unparseable, 429 rate limited, 503 indexing unavailable or a password operation shed under load.

Error bodies — RFC 9457

application/problem+json, with type, title, status, detail, instance, request_id.

  • detail never reveals that an inaccessible object exists.
  • No stack traces, no internal service or host names.
  • request_id is always present and matches the audit log field. That correspondence is what makes an auditor's question answerable, so a code path that omits it is a real defect.

Pagination

Cursor-based. ?limit=50&cursor=… → { items, next_cursor }, limit capped at 200. Offset is forbidden — it breaks under concurrent inserts and invites enumeration. A PR adding ?offset= should be rejected on both grounds.

Idempotency

  • POST /v1/documents is idempotent on (layer, external_id) plus content_hash. A repeat with identical content returns 200 and the existing document_id without creating a version. A url source is the exception: re-sending one re-fetches.
  • Every other unsafe method accepts Idempotency-Key, cached 24 hours — except POST /v1/search, and except any response carrying a field in CREDENTIAL_FIELDS (idempotency.ts), which is never cached whatever route produced it. A new shown-once value goes under one of those names or into the set; idempotency-secrets.test.ts holds the contract against it.

Read the full file on GitHub · 80 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 17d ago Changed · +11 lines 7a177704c437
  2. 1mo ago First seen · 69 lines · 89 tokens per session scan A a9572adfacf6

Subscribe to this mod's changes

api-endpoint is a skill published in the GitHub repository nacre-work/nacre (2 stars, last pushed 18d ago), licensed Apache-2.0. It adds 89 tokens to every session and 945 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIsRAG and vectorsTypeScriptmcpself-hostedsemantic-searchvector-database
Related

Other skills, from other repositories

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

ihatesea69/HieuNghi-AI-Skills · 63 tokens

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

Orchestra-Research/AI-Research-SKILLs · 63 tokens

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

synthetic-sciences/openscience · 63 tokens

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

OpenLAIR/dr-claw · 63 tokens

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

Microck/ordinary-claude-skills · 63 tokens

chroma

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source…

liortesta/ClawdAgent · 63 tokens