Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OrcaQubits/agentic-commerce-skills-plugins --skill nlweb-auth-multitenancygit clone --depth 1 https://github.com/OrcaQubits/agentic-commerce-skills-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy)<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01800 |
| Opus 5.5 | $0.00033 | $0.00720 |
| Sonnet 5.5 | $0.00017 | $0.00360 |
| Haiku 4.5 | $0.00008 | $0.00180 |
Grade A, and why
nlweb-auth-multitenancy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NLWeb Auth & Multitenancy
Before writing code
Fetch live docs:
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/setup-oauth.md for OAuth configuration.
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/nlweb-memory.md for conversation persistence.
- Inspect
AskAgent/python/webserver/routes/oauth.pyfor the current OAuth flow. - Inspect
AskAgent/python/core/conversation_history.pyandstorage_providers/for persistence backends. - Check
config/config_oauth.yamlandconfig/config_storage.yamlfor current keys.
Conceptual Architecture
NLWeb's Auth Model — What It Does and Doesn't Do
NLWeb ships OAuth-based user identification — it lets a logged-in user have persistent conversation memory tied to their identity. It does not ship:
- Fine-grained authorization (per-site ACLs)
- API key auth for service-to-service callers
- Multi-tenant data isolation at the retrieval layer
If you need any of those, you build them as middleware on top.
OAuth Providers Supported
Per config_oauth.yaml:
| Provider | Notes |
|---|---|
| GitHub | Standard OAuth 2.0 |
| Standard OAuth 2.0 | |
| Microsoft | Entra ID / personal accounts |
| Standard OAuth 2.0 |
Adding a new provider means a new client class in the OAuth routes module + a config entry. Verify the current extensibility mechanism in the live code.
OAuth Routes
| Route | Purpose |
|---|---|
GET /api/oauth/login/{provider} |
Start the OAuth dance |
GET /api/oauth/callback/{provider} |
OAuth callback handler |
GET /api/oauth/logout |
End session |
GET /api/oauth/me |
Current user info |
(Verify exact paths in webserver/routes/oauth.py.)
Session Storage
By default, NLWeb stores sessions in-memory or via an aiohttp session backend. For multi-instance deployments, configure a shared session store (Redis, etc.). The session cookie carries the user identity; conversation persistence keys off that identity.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 187 lines · 83 tokens per session scan A ade86e472b3a
nlweb-auth-multitenancy is a skill published in the GitHub repository OrcaQubits/agentic-commerce-skills-plugins (40 stars, last pushed 1mo ago), licensed MIT. It adds 83 tokens to every session and 1,800 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
metengine-data-agent
Real-time smart money analytics API for Polymarket prediction markets, Hyperliquid perpetual futures, and Meteora Solana LP/AMM pools. 63 endpoints. Pay-per-request via x402 on Solana Mainnet USDC. No API keys.
internet-court
Entry point for Internet Court — the trust layer for agent-to-agent commerce. Use whenever an agent needs to transact with another agent or a paid service, or a user mentions agent payments, paid APIs (HTTP 402/x402), wallet custody or trust concerns, spending mandates, delegated permissions (ERC-7710/7715), escrow…
okx-agent-payments-protocol
Use when an agent hits HTTP 402 / payment-required, or the user mentions x402, x402Version, X-PAYMENT, PAYMENT-REQUIRED, PAYMENT-SIGNATURE, WWW-Authenticate: Payment, permit2, upto, metered billing, a payment channel / voucher / session, channelId / channelid, opening / closing / topping up / settling / refunding a…
intelligent-oracle
Design, deploy, and monitor a GenLayer Intelligent Oracle prediction market from any coding agent. Use when a user wants to create a settled-by-web-evidence prediction market without opening the web UI.
lifi
LI.FI REST API for cross-chain and same-chain token swaps, bridging, DeFi deposits (Composer), yield discovery (Earn), and intent-based execution (Intents). USE THIS SKILL WHEN USER WANTS TO: Swap tokens between different blockchains (e.g., "swap USDC on Ethereum to ETH on Arbitrum") Bridge tokens to another chain…
okx-ai
A set of tools for registering, managing, searching, and evaluating blockchain agents, plus a marketplace for creating and handling tasks between agents. It supports roles such as service providers, buyers, and evaluators.