Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nekuda-ai/webmcp-kit/verifynpx skills add nekuda-ai/webmcp-kit --skill verifygit clone --depth 1 https://github.com/nekuda-ai/webmcp-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nekuda-ai/webmcp-kit/verify)<a href="https://agentmods.dev/skills/nekuda-ai/webmcp-kit/verify"><img src="https://agentmods.dev/badge/skills/nekuda-ai/webmcp-kit/verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.01213 |
| Opus 5 | $0.00026 | $0.00607 |
| Sonnet 5 | $0.00011 | $0.00243 |
| Haiku 4.5 | $0.00005 | $0.00121 |
Grade A, and why
verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
WebMCP Kit — verify
Runtime check that a site's WebMCP tools register and work. Runs standalone, and is the ladder the implement skill uses in its Phase F.
Before you start
- The site must run locally. Use its own runbook (lifecycle commands, base URL, test identities) if it ships one; otherwise its own dev script. Never assume a harness exists.
- Use the browser driver shipped in this plugin. Do not ask for MCP configuration, a global
chrome-devtoolsinstall, Playwright, or manual browser driving.
Packaged browser driver
Resolve the plugin root once. Use CLAUDE_PLUGIN_ROOT or PLUGIN_ROOT when the host exports one. Otherwise, take the absolute base directory shown for this skill (the directory containing this SKILL.md) and go up two directories. Do not guess from the repository checkout.
Run one driver session for the whole ladder:
plugin_root="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}"
if [ -z "$plugin_root" ]; then
skill_dir="<absolute base directory for this skill>"
plugin_root="$(cd "$skill_dir/../.." && pwd -P)"
fi
webmcp="${plugin_root}/scripts/webmcp.sh"
"$webmcp" browser status
"$webmcp" browser start
"$webmcp" browser status
"$webmcp" browser new_page "<local URL>" --output-format=json
"$webmcp" browser list_webmcp_tools <pageId> --output-format=json
"$webmcp" browser execute_webmcp_tool <pageId> <toolName> --input '<JSON object>' --output-format=json
"$webmcp" browser take_snapshot <pageId> --output-format=json
"$webmcp" browser list_console_messages <pageId> --output-format=json
"$webmcp" browser list_network_requests <pageId> --output-format=json
"$webmcp" browser stop
On Windows, apply the same fallback in PowerShell and use the packaged command entry:
$pluginRoot = if ($env:CLAUDE_PLUGIN_ROOT) { $env:CLAUDE_PLUGIN_ROOT } elseif ($env:PLUGIN_ROOT) { $env:PLUGIN_ROOT } else { (Resolve-Path "<absolute base directory for this skill>\..\..").Path }
$webmcp = Join-Path $pluginRoot "scripts\webmcp.cmd"
& $webmcp browser status
& $webmcp browser start
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 68 lines · 53 tokens per session scan A b1c81521fa9e
verify is a skill published in the GitHub repository nekuda-ai/webmcp-kit (28 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 1,213 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
webmcpify
WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser. Use for "webmcpify", "add WebMCP", or "expose app actions to AI agents".
headless-browser
Connects to Oxylabs remote headless browsers via Chrome DevTools Protocol (CDP) using Playwright or Puppeteer. Provides anti-detection, CAPTCHA handling, residential proxies, and geo-targeting built in. Use when browser automation needs remote execution, stealth capabilities, rendered pages, screenshots, PDFs, or…
proxies
Oxylabs proxy networks: Residential, Mobile, shared Datacenter/ISP, and Dedicated Datacenter/ISP proxies with geo-targeting, IP rotation, session persistence, and port-based sticky IPs. Use when routing traffic through proxies, building scrapers with proxy auth, rotating or sticky sessions, whitelisting IPs, or…
web-scraper-api
Production-grade web scraping with automatic anti-bot bypass, structured JSON parsing for 40+ targets, and geo-targeting. Use when the user needs to scrape web pages, extract product data, get search results, or collect structured data from supported e-commerce and search platforms without worrying about getting…
web-unblocker
Bypasses anti-bot protections using Oxylabs Web Unblocker, an AI-powered proxy that handles fingerprinting, JavaScript rendering, and retries automatically. Use when the user needs to scrape protected websites, bypass CAPTCHAs, access blocked content, or when regular proxies fail due to anti-bot measures.
skill-douyin-upload
将视频/图文内容发布到抖音(creator.douyin.com)。基于 Playwright + 持久化登录态,headless 即可运行, 流程与选择器移植自开源实现 douyin-upload-mcp-skill(含高清发布入口、切 tab、上传等转码、AI 封面、 发布成功 toast 校验、二维码登录)。适用场景:发布抖音视频、发布图文、扫码登录、发布前预检。.