Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OrcaQubits/agentic-commerce-skills-plugins --skill nlweb-auth-multitenancygit clone --depth 1 https://github.com/OrcaQubits/agentic-commerce-skills-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy)<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy"><img src="https://agentmods.dev/badge/skills/orcaqubits/agentic-commerce-skills-plugins/nlweb-auth-multitenancy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01800 |
| Opus 5 | $0.00042 | $0.00900 |
| Sonnet 5 | $0.00017 | $0.00360 |
| Haiku 4.5 | $0.00008 | $0.00180 |
Grade A, and why
nlweb-auth-multitenancy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 187 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NLWeb Auth & Multitenancy
Before writing code
Fetch live docs:
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/setup-oauth.md for OAuth configuration.
- Fetch https://github.com/nlweb-ai/NLWeb/blob/main/docs/nlweb-memory.md for conversation persistence.
- Inspect
AskAgent/python/webserver/routes/oauth.pyfor the current OAuth flow. - Inspect
AskAgent/python/core/conversation_history.pyandstorage_providers/for persistence backends. - Check
config/config_oauth.yamlandconfig/config_storage.yamlfor current keys.
Conceptual Architecture
NLWeb's Auth Model — What It Does and Doesn't Do
NLWeb ships OAuth-based user identification — it lets a logged-in user have persistent conversation memory tied to their identity. It does not ship:
- Fine-grained authorization (per-site ACLs)
- API key auth for service-to-service callers
- Multi-tenant data isolation at the retrieval layer
If you need any of those, you build them as middleware on top.
OAuth Providers Supported
Per config_oauth.yaml:
| Provider | Notes |
|---|---|
| GitHub | Standard OAuth 2.0 |
| Standard OAuth 2.0 | |
| Microsoft | Entra ID / personal accounts |
| Standard OAuth 2.0 |
Adding a new provider means a new client class in the OAuth routes module + a config entry. Verify the current extensibility mechanism in the live code.
OAuth Routes
| Route | Purpose |
|---|---|
GET /api/oauth/login/{provider} |
Start the OAuth dance |
GET /api/oauth/callback/{provider} |
OAuth callback handler |
GET /api/oauth/logout |
End session |
GET /api/oauth/me |
Current user info |
(Verify exact paths in webserver/routes/oauth.py.)
Session Storage
By default, NLWeb stores sessions in-memory or via an aiohttp session backend. For multi-instance deployments, configure a shared session store (Redis, etc.). The session cookie carries the user identity; conversation persistence keys off that identity.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 187 lines · 83 tokens per session scan A ade86e472b3a
nlweb-auth-multitenancy is a skill published in the GitHub repository OrcaQubits/agentic-commerce-skills-plugins (39 stars, last pushed 2d ago), licensed MIT. It adds 83 tokens to every session and 1,800 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-15.
Other skills, from other repositories
managing-archestra-releases
Runs rolling beta releases, stable patches, and complete stable-line cutovers. Use when backporting fixes, cutting or retiring release branches, configuring release protections, testing artifacts, recovering failed runs, or approving releases.
archestra-dev-testing
Use when deciding whether a change needs a test and at which level — unit, backend route-level integration, MSW-backed frontend integration, or e2e — or when reviewing tests for the "fluff test" anti-pattern. Start here before archestra-dev-backend-tests or archestra-dev-e2e.
migrate-to-archestra
Migrate an existing agentic PoC/pilot (Claude Code project files, MCP configs, hooks, local tools, openclaw config, or similar hand-rolled setup artifacts) into an Archestra instance. Use when the user wants to move, port, or convert an existing agentic setup into an Archestra pilot.
archestra-dev-backend-tests
Use when writing or modifying Archestra backend unit tests (platform/backend/src//.test.ts) — mocking modules, stubbing globals, database fixtures, vitest projects/isolation, or test performance.
archestra-dev-frontend
Use when modifying Archestra frontend Next.js/React code, UI components, forms, TanStack Query hooks, generated API client usage, frontend copy, or documentation links.
archestra-dev-interactions-migrations
Use BEFORE writing or running any Drizzle migration that touches the interactions table (or any other very large, write-hot table). The interactions table is the platform's biggest, append-heavy table — every LLM proxy call writes a row — so a careless migration can take a write-blocking lock and stall the proxy.…