Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add opencue/cuecards --skill api-gatewaygit clone --depth 1 https://github.com/opencue/cuecardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opencue/cuecards/api-gateway)<a href="https://agentmods.dev/skills/opencue/cuecards/api-gateway"><img src="https://agentmods.dev/badge/skills/opencue/cuecards/api-gateway/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/opencue/cuecards/api-gateway"><img src="https://agentmods.dev/badge/skills/opencue/cuecards/api-gateway.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.06690 |
| Opus 5.5 | $0.00017 | $0.02676 |
| Sonnet 5.5 | $0.00008 | $0.01338 |
| Haiku 4.5 | $0.00004 | $0.00669 |
Grade B, and why
api-gateway scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
response = requests.post( 'https://gateway.maton.ai/slack/api/chat.postMessage', Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
import urllib.request, os, json This is a copy
86% identical to api-gateway — 271 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 562 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Gateway
Passthrough proxy for direct access to third-party APIs using managed auth connections. The API gateway lets you call native API endpoints directly.
Quick Start
# Native Slack API call
python <<'EOF'
import urllib.request, os, json
data = json.dumps({'channel': 'C0123456', 'text': 'Hello from gateway!'}).encode()
req = urllib.request.Request('https://gateway.maton.ai/slack/api/chat.postMessage', data=data, method='POST')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
req.add_header('Content-Type', 'application/json')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF
Base URL
https://gateway.maton.ai/{app}/{native-api-path}
Replace {app} with the service name and {native-api-path} with the actual API endpoint path.
IMPORTANT: The URL path MUST start with the connection's app name (eg. /google-mail/...). This prefix tells the gateway which app connection to use. For example, the native Gmail API path starts with gmail/v1/, so full paths look like /google-mail/gmail/v1/users/me/messages.
Authentication
All requests require the Maton API key in the Authorization header:
Authorization: Bearer $MATON_API_KEY
The API gateway automatically injects the appropriate OAuth token for the target service.
Environment Variable: You can set your API key as the MATON_API_KEY environment variable:
export MATON_API_KEY="YOUR_API_KEY"
Getting Your API Key
- Sign in or create an account at maton.ai
- Go to maton.ai/settings
- Click the copy button on the right side of API Key section to copy it
Connection Management
Connection management uses a separate base URL: https://ctrl.maton.ai
List Connections
python <<'EOF'
import urllib.request, os, json
req = urllib.request.Request('https://ctrl.maton.ai/connections?app=slack&status=ACTIVE')
req.add_header('Authorization', f'Bearer {os.environ["MATON_API_KEY"]}')
print(json.dumps(json.load(urllib.request.urlopen(req)), indent=2))
EOF
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- CONTRIBUTING.md 1.2 KB
- LICENSE 1.0 KB
- README.md 4.6 KB
- references/active-campaign.md 3.2 KB
- references/acuity-scheduling.md 3.0 KB
- references/airtable.md 3.0 KB
- references/apollo.md 4.0 KB
- references/asana.md 2.7 KB
- references/attio.md 2.0 KB
- references/basecamp.md 2.8 KB
- references/beehiiv.md 2.6 KB
- references/box.md 2.8 KB
- references/brevo.md 3.7 KB
- references/calendly.md 2.6 KB
- references/callrail.md 3.1 KB
- references/chargebee.md 5.5 KB
- references/clickfunnels.md 5.3 KB
- references/clicksend.md 2.3 KB
- references/clickup.md 2.9 KB
- references/cognito-forms.md 2.4 KB
- references/constant-contact.md 2.5 KB
- references/dropbox.md 3.1 KB
- references/eventbrite.md 4.2 KB
- references/fathom.md 1.9 KB
- references/fireflies.md 1.8 KB
- references/gateway-skill-api-1.2.zip 530 KB
- references/gateway-skill-api-v3.8-alpha.3.zip 536 KB
- references/github.md 2.5 KB
- references/google-ads.md 3.9 KB
- references/google-analytics-admin.md 5.7 KB
- references/google-analytics-data.md 4.2 KB
- references/google-calendar.md 3.7 KB
- references/google-contacts.md 3.3 KB
- references/google-docs.md 2.9 KB
- references/google-drive.md 3.7 KB
- references/google-forms.md 4.1 KB
- references/google-mail.md 3.6 KB
- references/google-meet.md 2.7 KB
- references/google-merchant.md 2.7 KB
- references/google-play.md 3.8 KB
- references/google-search-console.md 3.8 KB
- references/google-sheets.md 6.0 KB
- references/google-slides.md 4.5 KB
- references/google-tasks.md 3.0 KB
- references/google-workspace-admin.md 4.6 KB
- references/gumroad.md 3.3 KB
- references/hubspot.md 9.8 KB
- references/jira.md 4.5 KB
- references/jobber.md 3.6 KB
- references/jotform.md 3.6 KB
- references/keap.md 3.1 KB
- references/kit.md 3.3 KB
- references/klaviyo.md 3.8 KB
- references/linear.md 4.3 KB
- references/linkedin.md 6.0 KB
- references/mailchimp.md 4.1 KB
- references/mailerlite.md 4.0 KB
- references/manychat.md 3.6 KB
- references/microsoft-excel.md 3.8 KB
- references/microsoft-to-do.md 3.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 562 lines · 42 tokens per session scan B 7df8cf00ae28
api-gateway is a skill published in the GitHub repository opencue/cuecards (6 stars, last pushed yesterday), licensed MIT. It adds 42 tokens to every session and 6,690 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). It is 86% identical to api-gateway, differing in 271 lines, and is treated as a copy.
Other skills, from other repositories
api-endpoint
Generate a complete REST API endpoint with validation, tests, and documentation.
loongsuite-pilot-insight
A reporting workflow for turning LoongSuite Pilot and AI coding-agent logs into structured reports about events, teams, data quality, development efficiency, and AI use. It defines the meaning of the log fields and the measurements used in dashboards.
gamedev-multiplayer
Use when adding multiplayer or netcode to a game — client-server vs P2P, server authority and anti-cheat, state replication vs RPCs, prediction and reconciliation, lag compensation, plus Godot 4 / Unity NGO / Unreal wiring. NOT single-player gameplay (that is godot, unity, unreal), NOT matchmaking or server hosting…
go
Use when writing, reviewing, testing, or shipping Go code and HTTP services: idioms, %w error wrapping, goroutine/context/errgroup concurrency, net/http 1.22 routing, log/slog, project layout, table-driven tests, Go hardening. NOT language-agnostic threat modeling (that is secure-coding), NOT Dockerfile/CI shipping…
csharp-dotnet
Use when writing, reviewing, testing, or shipping C# / .NET code — ASP.NET Core APIs (minimal APIs vs controllers), EF Core data access, async correctness, solution layout in .cs/.csproj/.sln. NOT a Java/Spring backend (that is spring-boot), NOT a Node/TypeScript backend (that is nestjs), NOT framework-neutral REST…
firebase
Use when building on Firebase — Firestore data modeling, Security Rules, Auth and custom claims, Cloud Functions, Storage, modular Web/Admin SDK imports — including symptoms like a database open to the internet, a query rejected by rules, or a doc stuck at 1 write/sec. NOT managed-Postgres BaaS with SQL and RLS (that…