ghttp

ghttp is a skill for Claude Code, Codex from onsi/gomega. It costs 100 tokens per session (2,128 once invoked), scanned A, original, MIT.

A test HTTP server for Go programs that make outgoing web requests. Tests can inspect incoming requests, return prepared responses, and record what the client sent.

In plain words
What is it for?
Test clients, SDKs, and other code using Go's net/http package, including request headers, JSON, forms, authentication, content types, and response handling.
Why use it?
It lets you test an HTTP client locally without depending on a real external service or hard-coding a live URL.

Skill for Claude CodeCodex

Part of the gomega plugin — 12 skills shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/onsi/gomega/ghttp
Any agent
npx skills add onsi/gomega --skill ghttp
Clone the repo
git clone --depth 1 https://github.com/onsi/gomega

Made for: Claude Code, Codex.

Or install gomega, the plugin that ships this one along with the rest of its 12 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ghttp

README.md
[![agentmods](https://agentmods.dev/badge/skills/onsi/gomega/ghttp.svg)](https://agentmods.dev/skills/onsi/gomega/ghttp)
Your own site
<a href="https://agentmods.dev/skills/onsi/gomega/ghttp"><img src="https://agentmods.dev/badge/skills/onsi/gomega/ghttp.svg" alt="Measured on agentmods" height="20"></a>
Per session 100 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,128 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00100 $0.02128
Opus 5 $0.00050 $0.01064
Sonnet 5 $0.00020 $0.00426
Haiku 4.5 $0.00010 $0.00213

Measured 4d ago against content hash ffdb9c4481ac, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ghttp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/gomega/skills/ghttp/SKILL.md · 203 lines

How it starts

The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ghttp: testing HTTP clients

ghttp spins up a real test HTTP server so you can exercise code that makes outbound HTTP requests (clients, SDKs, anything calling net/http). You register handlers that assert on the incoming request and return a canned response; the server records every request it receives. It wraps net/http/httptest.

import (
	. "github.com/onsi/gomega"
	"github.com/onsi/gomega/ghttp"
	"net/http"
)

This skill assumes a dot-import of gomega. Docs: https://onsi.github.io/gomega/#ghttp-testing-http-clients. See gomega:matchers for the matchers used in assertions and gomega:async if the client is non-blocking.

Lifecycle

server := ghttp.NewServer()          // or ghttp.NewTLSServer()
defer server.Close()                 // ALWAYS defer Close

client := myapi.NewClient(server.URL())   // URL is random per run — inject it

The server URL is auto-generated and varies between runs, so you must inject server.URL() into the code under test rather than hard-coding it. With Ginkgo, server = ghttp.NewServer() in BeforeEach and server.Close() in AfterEach.

The handler model

server.AppendHandlers(handlers...) registers an ordered list of handlers, one per expected request. The first request is matched against the first handler, the second against the second, and so on. A handler is just an http.HandlerFunc.

server.AppendHandlers(
	ghttp.VerifyRequest("GET", "/sprockets"),
)

Gotchas (the core mental model):

  • AppendHandlers is strictly ordered. Requests must arrive in exactly the registered order.
  • Each handler handles exactly one request. To run several checks against a single request, combine them with ghttp.CombineHandlers (below).
  • The request count is asserted by default. If the client sends more requests than there are handlers (or hits an unregistered route), the test fails. Guard the trivial false-positive (client made no request) with Expect(server.ReceivedRequests()).To(HaveLen(1)).

Read the full file on GitHub · 203 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 203 lines · 100 tokens per session scan A ffdb9c4481ac

Subscribe to this mod's changes

ghttp is a skill published in the GitHub repository onsi/gomega (2,356 stars, last pushed 7d ago), licensed MIT. It adds 100 tokens to every session and 2,128 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.