connect-self-hosted-https

Instructions for connecting the infracodebase MCP server to an API you host yourself over HTTPS. They cover access tokens, API addresses, and certificates for private or self-signed HTTPS connections.

In plain words
What is it for?
Use it to connect Claude Code to an internal infracodebase instance, including one running locally or with a private certificate.
Why use it?
It explains the configuration needed when the server is not using its hosted service or when normal certificate checks fail.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/onwardplatforms/infracodebase-mcp/connect-self-hosted-https
Any agent
npx skills add onwardplatforms/infracodebase-mcp --skill connect-self-hosted-https
Clone the repo
git clone --depth 1 https://github.com/onwardplatforms/infracodebase-mcp

Made for: Claude Code, Codex.

Per session 91 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,976 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00091 $0.01976
Opus 5 $0.00046 $0.00988
Sonnet 5 $0.00018 $0.00395
Haiku 4.5 $0.00009 $0.00198

Measured yesterday against content hash e41631b65e2e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

connect-self-hosted-https scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

> **Don't test the cert with `curl`.** On macOS `curl` trusts the system keychain, so
.claude/skills/connect-self-hosted-https/SKILL.md · 169 lines

How it starts

The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Connect the infracodebase MCP server to a self-hosted HTTPS API

The server takes all configuration from environment variables (or flags) supplied by the MCP client — there is no init, no auth login, and no stored config file. Connecting to a self-hosted instance means setting two (sometimes three) env vars in the client's server definition.

The variables

Variable Purpose Required
INFRACODEBASE_TOKEN Personal access token (icb_pat_...) Yes
INFRACODEBASE_API_URL Your instance's API base, e.g. https://infra.acme.com/api/v1 Yes for self-hosted (defaults to the SaaS)
NODE_EXTRA_CA_CERTS Path to your CA cert — only for HTTPS with a private/self-signed cert Only if TLS fails

Step 1 — point at your instance

Use the --env flag (repeatable) on claude mcp add. The -- separates Claude's flags from the command that launches the server.

Via npx (published package):

claude mcp add infracodebase \
  --env INFRACODEBASE_TOKEN=icb_pat_xxx \
  --env INFRACODEBASE_API_URL=https://infra.acme.com/api/v1 \
  -- npx -y @infracodebase/mcp@latest

From a local clone (after npm install && npm run build):

claude mcp add infracodebase \
  --env INFRACODEBASE_TOKEN=icb_pat_xxx \
  --env INFRACODEBASE_API_URL=https://localhost:3000/api/v1 \
  -- node /abs/path/to/infracodebase-mcp/dist/index.js

Equivalent mcp.json (Claude Desktop / Cursor / etc.):

{
  "mcpServers": {
    "infracodebase": {
      "command": "npx",
      "args": ["-y", "@infracodebase/mcp@latest"],
      "env": {
        "INFRACODEBASE_TOKEN": "icb_pat_xxx",
        "INFRACODEBASE_API_URL": "https://infra.acme.com/api/v1"
      }
    }
  }
}

Add --scope user (or set it in user config) to make the server available across all projects instead of just the current one.

Step 2 — handle the certificate (HTTPS only)

Plain http:// (e.g. http://localhost:3000) needs nothing further — skip this step.

Read the full file on GitHub · 169 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 169 lines · 91 tokens per session scan A e41631b65e2e

Subscribe to this mod's changes

connect-self-hosted-https is a skill published in the GitHub repository onwardplatforms/infracodebase-mcp (2 stars, last pushed 8d ago), licensed MIT. It adds 91 tokens to every session and 1,976 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

conducting-cyber-risk-assessment-with-nist-800-30

Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk…

adriannoes/awesome-agentic-ai · 219 tokens

achieving-cmmc-level-2-compliance

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when…

mukul975/Anthropic-Cybersecurity-Skills · 255 tokens

agt-policy-authoring

Create and validate a minimal AGT Copilot CLI policy tailored to the repository being inspected.

microsoft/agent-governance-toolkit · 23 tokens

compliance

Use when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or standing up the cadence that keeps it audit-ready. NOT drafting privacy-policy/ROPA/DPA or ToS text (that is gdpr-privacy, terms-conditions)…

ericrisco/rsc-harness · 96 tokens

lq-board-document-review

Use when reviewing board-level governance documents — Delegation of Authority policies, charters, board resolutions, related party transaction policies, or committee terms of reference. Produces a structured four-category finding set with tracked changes in Word, a populated Reconciliation Log in Excel, and a draft…

LegalQuants/lq-skills · 68 tokens

lq-governance-playbook-benchmark

Use when benchmarking a board-level governance document against the LQ Governance Playbook — a Delegation of Authority policy, committee charter, related party transaction framework, or board terms of reference. Produces a classification table (Match / Partial Match / Below Fallback / Red Flag / Omitted) with specific…

LegalQuants/lq-skills · 75 tokens