Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add neXenio/bifrost-plugin --skill bifrost-debuggit clone --depth 1 https://github.com/neXenio/bifrost-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nexenio/bifrost-plugin/bifrost-debug)<a href="https://agentmods.dev/skills/nexenio/bifrost-plugin/bifrost-debug"><img src="https://agentmods.dev/badge/skills/nexenio/bifrost-plugin/bifrost-debug/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nexenio/bifrost-plugin/bifrost-debug"><img src="https://agentmods.dev/badge/skills/nexenio/bifrost-plugin/bifrost-debug.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.03846 |
| Opus 5.5 | $0.00041 | $0.01538 |
| Sonnet 5.5 | $0.00021 | $0.00769 |
| Haiku 4.5 | $0.00010 | $0.00385 |
Grade A, and why
bifrost-debug scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find ~/.claude/plugins -maxdepth 4 -type d -name 'bifrost-plugin*' 2>/dev/null Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -o /dev/null -w "%{http_code}" \ How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bifrost Diagnostics
Work through this decision tree to isolate and fix the problem.
1. Check credentials are set (shell env, or plugin config)
On the CLI:
echo "URL set: ${BIFROST_URL:+yes}${BIFROST_URL:-NO — missing}"
echo "VK set: ${BIFROST_VK:+yes}${BIFROST_VK:-NO — missing}"
If missing: export BIFROST_URL=https://<your-gateway-host>/mcp and
export BIFROST_VK=vk_<your-key> (add both to ~/.zshrc or ~/.bashrc).
On Desktop and claude.ai there is no shell, so this check does not apply.
Credentials come from the plugin's install-time config values
(gateway_url, virtual_key, and the opt-in auto_login). Run /plugin configure to
view or change them.
Symptom if the key is wrong/missing: 401 or 403 from every bifrost tool call.
2. Check the bifrost MCP server is registered
claude mcp get bifrost 2>/dev/null || echo 'bifrost: MISSING at user scope'
The server can come from either the plugin's shipped .mcp.json (plugin
installed + enabled → shows up in /mcp) or a user-scope registration.
If neither: run /bifrost-mcp-setup for manual wiring instructions.
Then restart Claude Code for CC to pick up the change.
3. Check gateway reachability
curl -s -o /dev/null -w "%{http_code}" \
-H "x-bf-vk: ${BIFROST_VK}" \
"${BIFROST_URL}"
Expected: 200 or 405 (OPTIONS probe). 401 → bad VK. Timeout / connection refused → gateway down or BIFROST_URL wrong (contact the gateway operator).
4. Check the gateway's memory MCP tools (for agent-driven memory)
Run /mcp and look for a memory server under bifrost. If present, test it (<prefix> is mcp__plugin_bifrost-plugin_bifrost__ from the plugin, mcp__claude_ai_luca_Bifrost__ from the claude.ai connector, mcp__bifrost__ from a hand-added server):
<prefix><memory-server>-search("test connection")
If the tool is not found, the gateway exposes no memory server — memory calls will simply not be available. This does not affect skill discovery or gateway connectivity.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · -1 lines 9c3e5c06ca6d
- 1mo ago First seen · 294 lines · 103 tokens per session scan A 9e996045950d
bifrost-debug is a skill published in the GitHub repository neXenio/bifrost-plugin (4 stars, last pushed 2d ago), licensed MIT. It adds 103 tokens to every session and 3,846 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
rust-tracing
Add or change Rust diagnostic tracing in litellm-rust, including route spans, subscriber layers, and Python logger delivery.
lsp-guide
Recipes for the lsp tool — resolving where a symbol is defined, every place it is used, type signatures and docs, file outlines, and compiler/type errors through a real language server (Go, TypeScript/JavaScript, Python, Rust). Use when navigating or explaining code by symbol, finding callers or usages, checking what…
vigil-instrument
Instrument a service with OpenTelemetry — RED metrics, structured logs, distributed tracing, and health checks. Outputs actual code and config, not a plan. Use when asked to "add monitoring", "instrument this", "add logging", "set up tracing", or "observability".
apex-review
Cross-cutting review of recent work — catches gaps between specialists. Use when asked to "review what we built", "check the work", "pre-launch review", or after completing a significant chunk of work.
touch-audit
Mobile audit — app size, startup time, crash reporting, store compliance, accessibility, offline behavior. Use when asked for "mobile review", "app store readiness", "mobile performance", or "crash analysis".
prism-audit
Frontend audit — bundle size, dependencies, accessibility, performance, component quality. Use when asked for "frontend review", "performance audit", "accessibility check", or "bundle size".