Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add nobodyohm-web/Thot --skill qmdgit clone --depth 1 https://github.com/nobodyohm-web/ThotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nobodyohm-web/thot/qmd)<a href="https://agentmods.dev/skills/nobodyohm-web/thot/qmd"><img src="https://agentmods.dev/badge/skills/nobodyohm-web/thot/qmd/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nobodyohm-web/thot/qmd"><img src="https://agentmods.dev/badge/skills/nobodyohm-web/thot/qmd.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.03420 |
| Opus 5.5 | $0.00006 | $0.01368 |
| Sonnet 5.5 | $0.00003 | $0.00684 |
| Haiku 4.5 | $0.00001 | $0.00342 |
Grade B, and why
qmd scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - This is a copy
100% identical to qmd — 4 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 442 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QMD — Query Markup Documents
Local, on-device search engine for personal knowledge bases. Indexes markdown notes, meeting transcripts, documentation, and any text-based files, then provides hybrid search combining keyword matching, semantic understanding, and LLM-powered reranking — all running locally with no cloud dependencies.
Created by Tobi Lütke. MIT licensed.
When to Use
- User asks to search their notes, docs, knowledge base, or meeting transcripts
- User wants to find something across a large collection of markdown/text files
- User wants semantic search ("find notes about X concept") not just keyword grep
- User has already set up qmd collections and wants to query them
- User asks to set up a local knowledge base or document search system
- Keywords: "search my notes", "find in my docs", "knowledge base", "qmd"
Prerequisites
Node.js >= 22 (required)
# Check version
node --version # must be >= 22
# macOS — install or upgrade via Homebrew
brew install node@22
# Linux — use NodeSource or nvm
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs
# or with nvm:
nvm install 22 && nvm use 22
SQLite with Extension Support (macOS only)
macOS system SQLite lacks extension loading. Install via Homebrew:
brew install sqlite
Install qmd
npm install -g @tobilu/qmd
# or with Bun:
bun install -g @tobilu/qmd
First run auto-downloads 3 local GGUF models (~2GB total):
| Model | Purpose | Size |
|---|---|---|
| embeddinggemma-300M-Q8_0 | Vector embeddings | ~300MB |
| qwen3-reranker-0.6b-q8_0 | Result reranking | ~640MB |
| qmd-query-expansion-1.7B | Query expansion | ~1.1GB |
Verify Installation
qmd --version
qmd status
Quick Reference
| Command | What It Does | Speed |
|---|---|---|
qmd search "query" |
BM25 keyword search (no models) | ~0.2s |
qmd vsearch "query" |
Semantic vector search (1 model) | ~3s |
qmd query "query" |
Hybrid + reranking (all 3 models) | ~2-3s warm, ~19s cold |
qmd get <docid> |
Retrieve full document content | instant |
qmd multi-get "glob" |
Retrieve multiple files | instant |
qmd collection add <path> --name <n> |
Add a directory as a collection | instant |
qmd context add <path> "description" |
Add context metadata to improve retrieval | instant |
qmd embed |
Generate/update vector embeddings | varies |
qmd status |
Show index health and collection info | instant |
qmd mcp |
Start MCP server (stdio) | persistent |
qmd mcp --http --daemon |
Start MCP server (HTTP, warm models) | persistent |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 442 lines · 14 tokens per session scan B 3c53e604f099
qmd is a skill published in the GitHub repository nobodyohm-web/Thot (0 stars, last pushed 1mo ago), licensed MIT. It adds 14 tokens to every session and 3,420 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). It is 100% identical to qmd, differing in 4 lines, and is treated as a copy.
Other skills, from other repositories
mem0-oss-to-platform
Plan, then execute, a migration of a project from the mem0 open-source / self-hosted SDK (local Memory class) to the mem0 Platform / hosted SDK (MemoryClient). TRIGGER when: the developer wants to move, switch, or migrate mem0 off OSS/self-hosted to the hosted API, e.g. "migrate my mem0 setup to the platform", "switch…
rem-project-sessions
Write or update one project page from the owner's messages and a bounded packet of local project evidence.
wisdom-keep
Protect a CocoWisdom entry from consolidation. Usage: $wisdom keep --id --text " ".
kortix-user-memory
Per-user memory in the user's own Drive folder: /drives/me/Memory. Who this user is, how they like to work, what they corrected, what they are working on — kept across every session they start, private to them. Load at the start of a task for a person, when the user says remember / forget / you should know, when they…
autograph
Schema-as-code enforcement for any Obsidian vault. Zero hardcoded domains. Use when creating vault cards, checking vault health, running schema compliance, deduplicating entities, generating MOC indexes, running decay cycles, bootstrapping a vault, fixing wikilinks, finding orphans or backlinks, extracting entities…
persistent-memory
Give this agent durable memory across sessions using YantrikDB. Use at the start of every session to load prior context, whenever the user or a job references past decisions, people, preferences, or earlier runs, and whenever something worth keeping is learned (a decision, a fact, a working method, a qualified lead, a…