Borrowing it
Nothing to install: this file belongs to opencue/cuecards. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/opencue/cuecards/main/.agents/skills/trace-mcp-codemod/SKILL.mdgit clone --depth 1 https://github.com/opencue/cuecardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opencue/cuecards/trace-mcp-codemod)<a href="https://agentmods.dev/skills/opencue/cuecards/trace-mcp-codemod"><img src="https://agentmods.dev/badge/skills/opencue/cuecards/trace-mcp-codemod.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.00753 |
| Opus 5 | $0.00023 | $0.00377 |
| Sonnet 5 | $0.00009 | $0.00151 |
| Haiku 4.5 | $0.00005 | $0.00075 |
Grade A, and why
trace-mcp-codemod scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to trace-mcp-codemod — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
trace-mcp — Codemod Workflow
apply_codemod is the correct tool for any repeated mechanical change. Using Edit for the same pattern twice or more is a waste of tokens and is error-prone.
When to Use — HARD RULE
If you are about to make the same kind of change 2 or more times — whether in one file or across many — stop and use apply_codemod. This includes:
- Adding
async/awaitto a set of functions - Updating a function signature everywhere it is called
- Fixing import paths after a move
- Adding or removing keywords/decorators
- Wrapping calls in a logger, try/catch, or feature flag
- Replacing a deprecated API usage
- Any regex-replaceable refactor
No exceptions. "It's just three edits" is still a violation — use apply_codemod.
Standard Workflow
1. Preview with dry run (default)
apply_codemod({
pattern: "oldFunction\\(",
replacement: "newFunction(",
file_pattern: "src/**/*.ts",
dry_run: true // default
})
Review the preview: matched files, context lines, and replacement correctness. Look for false positives.
2. Narrow scope when needed
Use filter_content to only touch files that also contain a second marker:
apply_codemod({
pattern: "extractNodes\\(",
replacement: "extractNodes(ctx, ",
file_pattern: "src/**/*.ts",
filter_content: "import.*extractNodes",
dry_run: true
})
For patterns that cross line boundaries, enable multiline mode:
apply_codemod({
pattern: "function\\s+foo\\([^)]*\\)\\s*\\{",
replacement: "async function foo() {",
multiline: true,
dry_run: true
})
3. Apply the change
apply_codemod({ ..., dry_run: false })
If more than 20 files are affected, add confirm_large: true.
4. Reindex and verify
register_editis not needed for codemods —apply_codemodhandles reindexing internally.- Run the test suite or
check_quality_gateswithscope: "changed".
Planning Larger Changes
For changes that span packages or require version awareness (e.g. upgrading a dependency), use plan_batch_change first:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 97 lines · 46 tokens per session scan A b71dbf00ffe2
trace-mcp-codemod is a skill published in the GitHub repository opencue/cuecards (5 stars, last pushed today), licensed MIT. It adds 46 tokens to every session and 753 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to trace-mcp-codemod, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
atomic-git-discipline
Compressed commit message and PR body generator. Cuts noise from both while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious; PR bodies state only what the diff can't show, 120 words max. Use when user says "write a commit", "commit message", "generate…
repo-hygiene
Use when the scheduled repo-hygiene workflow runs from GitHub Actions (or an operator dry-run) to scan the repository for small, certain docs/test/code hygiene issues and fix them as one batched branch.
docs-update-from-diff
Review local code changes with git diff and update the official docs under docs/ to match. Use when the user asks to document current uncommitted work, sync docs with local changes, update docs after a feature or refactor, or when phrases like "git diff", "local changes", "update docs", or "official docs" appear.
moai-workflow-worktree
Git worktree management for parallel SPEC development with isolated workspaces, automatic branch registration, and seamless MoAI-ADK integration. Use when setting up parallel development environments.
safe-extraction
Apply when extracting code from a large monolith file into submodules. Covers barrel re-exports, internals DI seam proxy patterns, CI invariant allowlist updates, and cross-file test verification. Prevents CI failures, broken imports, and test regressions from code extraction.
memstack-security-git-guard
Use when the user says 'git-guard', 'check git protection', 'is this repo protected', 'verify gitleaks', 'set up git hooks', 'install git-guard', or wants to confirm a repo blocks secrets and internal files before commit. This is an installer and verifier, NOT a scanner (gitleaks does the actual scanning). Do NOT use…