verify

verify is a skill for Claude Code, Codex from nekuda-ai/webmcp-kit. It costs 53 tokens per session (1,213 once invoked), scanned A, original, MIT.

A browser check for WebMCP tools, which let a website expose actions that an AI agent can call. It tests whether those tools appear on the expected pages and work while the site runs locally.

In plain words
What is it for?
Checking tool registration, page and login-state behavior, and tools built with the @nekuda/webmcp-sdk.
Why use it?
It catches missing, misplaced, or non-working tools before the site is released.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the webmcp-kit plugin — 3 skills, 1 command, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/nekuda-ai/webmcp-kit/verify
Any agent
npx skills add nekuda-ai/webmcp-kit --skill verify
Clone the repo
git clone --depth 1 https://github.com/nekuda-ai/webmcp-kit

Made for: Claude Code, Codex.

Or install webmcp-kit, the plugin that ships this one along with the rest of its 3 skills, 1 command, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for verify

README.md
[![agentmods](https://agentmods.dev/badge/skills/nekuda-ai/webmcp-kit/verify.svg)](https://agentmods.dev/skills/nekuda-ai/webmcp-kit/verify)
Your own site
<a href="https://agentmods.dev/skills/nekuda-ai/webmcp-kit/verify"><img src="https://agentmods.dev/badge/skills/nekuda-ai/webmcp-kit/verify.svg" alt="Measured on agentmods" height="20"></a>
Per session 53 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,213 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00053 $0.01213
Opus 5 $0.00026 $0.00607
Sonnet 5 $0.00011 $0.00243
Haiku 4.5 $0.00005 $0.00121

Measured 5d ago against content hash b1c81521fa9e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/skills/verify/SKILL.md · 68 lines

How it starts

The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.

WebMCP Kit — verify

Runtime check that a site's WebMCP tools register and work. Runs standalone, and is the ladder the implement skill uses in its Phase F.

Before you start

  • The site must run locally. Use its own runbook (lifecycle commands, base URL, test identities) if it ships one; otherwise its own dev script. Never assume a harness exists.
  • Use the browser driver shipped in this plugin. Do not ask for MCP configuration, a global chrome-devtools install, Playwright, or manual browser driving.

Packaged browser driver

Resolve the plugin root once. Use CLAUDE_PLUGIN_ROOT or PLUGIN_ROOT when the host exports one. Otherwise, take the absolute base directory shown for this skill (the directory containing this SKILL.md) and go up two directories. Do not guess from the repository checkout.

Run one driver session for the whole ladder:

plugin_root="${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}"
if [ -z "$plugin_root" ]; then
  skill_dir="<absolute base directory for this skill>"
  plugin_root="$(cd "$skill_dir/../.." && pwd -P)"
fi
webmcp="${plugin_root}/scripts/webmcp.sh"

"$webmcp" browser status
"$webmcp" browser start
"$webmcp" browser status
"$webmcp" browser new_page "<local URL>" --output-format=json
"$webmcp" browser list_webmcp_tools <pageId> --output-format=json
"$webmcp" browser execute_webmcp_tool <pageId> <toolName> --input '<JSON object>' --output-format=json
"$webmcp" browser take_snapshot <pageId> --output-format=json
"$webmcp" browser list_console_messages <pageId> --output-format=json
"$webmcp" browser list_network_requests <pageId> --output-format=json
"$webmcp" browser stop

On Windows, apply the same fallback in PowerShell and use the packaged command entry:

$pluginRoot = if ($env:CLAUDE_PLUGIN_ROOT) { $env:CLAUDE_PLUGIN_ROOT } elseif ($env:PLUGIN_ROOT) { $env:PLUGIN_ROOT } else { (Resolve-Path "<absolute base directory for this skill>\..\..").Path }
$webmcp = Join-Path $pluginRoot "scripts\webmcp.cmd"
& $webmcp browser status
& $webmcp browser start

Read the full file on GitHub · 68 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 68 lines · 53 tokens per session scan A b1c81521fa9e

Subscribe to this mod's changes

verify is a skill published in the GitHub repository nekuda-ai/webmcp-kit (28 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 1,213 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

webmcpify

WebMCP agent skill for curated core coverage or route-by-route parity — inventory an existing web app, integrate approved tools, then verify and heal them in a real browser. Use for "webmcpify", "add WebMCP", or "expose app actions to AI agents".

TueJon/webmcpify · 64 tokens

headless-browser

Connects to Oxylabs remote headless browsers via Chrome DevTools Protocol (CDP) using Playwright or Puppeteer. Provides anti-detection, CAPTCHA handling, residential proxies, and geo-targeting built in. Use when browser automation needs remote execution, stealth capabilities, rendered pages, screenshots, PDFs, or…

oxylabs/agent-skills · 72 tokens

proxies

Oxylabs proxy networks: Residential, Mobile, shared Datacenter/ISP, and Dedicated Datacenter/ISP proxies with geo-targeting, IP rotation, session persistence, and port-based sticky IPs. Use when routing traffic through proxies, building scrapers with proxy auth, rotating or sticky sessions, whitelisting IPs, or…

oxylabs/agent-skills · 76 tokens

web-scraper-api

Production-grade web scraping with automatic anti-bot bypass, structured JSON parsing for 40+ targets, and geo-targeting. Use when the user needs to scrape web pages, extract product data, get search results, or collect structured data from supported e-commerce and search platforms without worrying about getting…

oxylabs/agent-skills · 72 tokens

web-unblocker

Bypasses anti-bot protections using Oxylabs Web Unblocker, an AI-powered proxy that handles fingerprinting, JavaScript rendering, and retries automatically. Use when the user needs to scrape protected websites, bypass CAPTCHAs, access blocked content, or when regular proxies fail due to anti-bot measures.

oxylabs/agent-skills · 69 tokens

skill-douyin-upload

将视频/图文内容发布到抖音(creator.douyin.com)。基于 Playwright + 持久化登录态,headless 即可运行, 流程与选择器移植自开源实现 douyin-upload-mcp-skill(含高清发布入口、切 tab、上传等转码、AI 封面、 发布成功 toast 校验、二维码登录)。适用场景:发布抖音视频、发布图文、扫码登录、发布前预检。.

ZJU-REAL/Easel · 110 tokens