Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/okedeji/mcpvessel/claude-codenpx skills add okedeji/mcpvessel --skill claude-codegit clone --depth 1 https://github.com/okedeji/mcpvesselWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/okedeji/mcpvessel/claude-code)<a href="https://agentmods.dev/skills/okedeji/mcpvessel/claude-code"><img src="https://agentmods.dev/badge/skills/okedeji/mcpvessel/claude-code.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00152 | $0.05419 |
| Opus 5 | $0.00076 | $0.02710 |
| Sonnet 5 | $0.00030 | $0.01084 |
| Haiku 4.5 | $0.00015 | $0.00542 |
Grade A, and why
mcpvessel scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringlowPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
If one form is not found, try the other before concluding anything. Never tell the user a server does not exist because a search or one coordinate missed; Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 360 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Driving mcpvessel
mcpvessel runs an MCP server inside a cage with deny-default egress: the server reaches only hosts on its allow-list, and a new host is blocked or held until a human approves it. Your loop is this: get an MCP server caged and running so you can use it, then, as you use it, watch what it does and report what ensues, above all anything it tries to send out. The caged server is meant for you to use: you register it as your own tools and call them, and caging is what makes that safe, because everything it sends stays inspectable. You are the user's eyes on a server they cannot otherwise see inside. Everything else the tool can do is out of your lane.
You are the operator and the analyst; the human is the approver. You cage, serve, register, watch, and report. You never approve a server's egress or grant it a secret yourself.
Prerequisite: the daemon must be running. If a command says it is not, run
mcpvessel init --skip-skill. Always pass --skip-skill: the skill is already
installed (it is how you are reading this), and --skip-skill keeps init from
prompting to install it, which would stall you.
You already have a reference. mcpvessel init installed and served
mcpvessel-docs, a caged MCP server carrying every mcpvessel doc and all its
code, and registered it with Claude Code as mcpvessel-docs. You do not set it
up; it is already there. Query its tools whenever this skill does not cover
something, the user asks about mcpvessel behavior you are unsure of, or you are
not confident in an answer, rather than guessing. If those tools are not
available (the user skipped that step in init), fall back to the open-source
repository at github.com/okedeji/mcpvessel, where every doc and all the code
live.
Before you cage anything (do this first, once per session)
The first time you take up an mcpvessel task in a session, ground yourself before you act. Skipping this is how you cage the wrong server or misread what the cage does:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 360 lines · 0 tokens per session scan A 34d75d31cedc
mcpvessel is a skill published in the GitHub repository okedeji/mcpvessel (4 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 152 tokens to every session and 5,419 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
harness-design-fuzzing
Reference vocabulary for designing instrumented harnesses that drive vulnerability discovery — design classes (trigger-driven vs coverage-driven), tiered scope (T1 isolated function / T2 multi-component / T3 full build), systematic input exploration, the two-coverage distinction (fuzzer-feedback vs audit)…
memory-safety-c-cpp
Reference vocabulary for memory-safety vulnerabilities in native C/C++ code — bug-class taxonomy, common arithmetic patterns that lead to corruption, dispatch-family discipline, type-confusion idioms, use-after-free patterns, and exploitability factors. Read when analyzing, hypothesizing, designing harnesses for, or…
vulnerability-triage
Reference vocabulary for interpreting vulnerability findings — detector-vs-impact distinction, severity anchoring on demonstrated evidence, the eleven-item interpretation rubric, delegation transparency, primitive-extent scaling, the disqualifier taxonomy (D-0..D-4), CVSS Achievable / Environmental framing…
gmail-query-syntax
Reference for Gmail's search query syntax — operators like is:sent, newerthan:, from:, has:attachment, label:, and how they compose. Read this when constructing a Gmail search query string for the googleworkspace.gmailsearchmessages Code Mode call, especially when filtering by sent vs received, recency, sender, or…
email-formatting
Markdown formatting conventions for email summary documents — heading depth, list style, line length, emoji policy, and a mandatory provenance footer. Read this when producing a markdown report that summarizes one or more email messages so the output matches the project's house style.
json-schema-emails
Canonical shape of the .workflow/emails/emails.json file passed between the fetch and summarize states — required fields (sender, recipient, subject, date, body), types, and field semantics. Read this whenever you write or read emails.json so producer and consumer agree on the shape.