Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/os-tack/fcp/setupnpx skills add os-tack/fcp --skill setupgit clone --depth 1 https://github.com/os-tack/fcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.00401 |
| Opus 5 | $0.00010 | $0.00200 |
| Sonnet 5 | $0.00004 | $0.00080 |
| Haiku 4.5 | $0.00002 | $0.00040 |
Grade C, and why
setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **uv**: `curl -LsSf https://astral.sh/uv/install.sh | sh` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **uv**: `curl -LsSf https://astral.sh/uv/install.sh | sh` What it actually says
FCP Setup
Check for required FCP dependencies and install any that are missing.
Steps
-
Check dependencies — run each check and collect results:
Dependency Check command Needed for nodenode --versiondrawio uvuv --versionmidi, sheets, slides fcp-terraformfcp-terraform --versionterraform -
Report status — show a table of what's installed and what's missing. If everything is present, say so and stop.
-
Install missing dependencies — for each missing dependency, offer to install it:
- uv:
curl -LsSf https://astral.sh/uv/install.sh | sh - fcp-terraform:
curl -LsSf https://github.com/os-tack/fcp-terraform/releases/latest/download/install.sh | sh - node: Direct user to https://nodejs.org/ (cannot auto-install)
Ask the user which missing dependencies they want to install. Install the selected ones.
- uv:
-
Verify MCP servers — for each newly installed dependency, verify the MCP server can start:
- drawio:
npx -y @ostk-ai/fcp-drawio --help(or similar smoke test) - midi:
uvx --refresh-package fcp-midi --python 3.13 fcp-midi --help - sheets:
uvx --refresh-package fcp-sheets --python 3.13 fcp-sheets --help - terraform:
fcp-terraform --help
- drawio:
-
Summary — report final status of all dependencies.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 39 lines · 19 tokens per session scan C bf676258288f
setup is a skill published in the GitHub repository os-tack/fcp (2 stars, last pushed 1mo ago), licensed MIT. It adds 19 tokens to every session and 401 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
design-mcp-server
Design the tool surface, resources, and service layer for a new MCP server. Use when starting a new server, planning a major feature expansion, or when the user describes a domain/API they want to expose via MCP. Produces a design doc at docs/design.md that drives implementation.
api-canvas
DataCanvas primitive reference — a Tier 3 SQL/analytical workspace for tabular MCP servers, backed by DuckDB. Use when registering tables from upstream APIs, running ad-hoc SQL across them, and exporting results. Covers the acquire → register → query → export flow, per-table TTL, the token-sharing pattern for…
field-test
Exercise tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, and produces a tight report with concrete findings and numbered follow-up options. Use after adding or modifying definitions, or when the user asks to…
api-config
Reference for core and server configuration in @cyanheads/mcp-ts-core. Covers env var tables with defaults, priority order, server-specific Zod schema pattern, and Workers lazy-parsing requirement.
api-telemetry
Catalog of OpenTelemetry instrumentation built into framework @cyanheads/mcp-ts-core — spans, metrics, completion logs, env config, runtime caveats, custom instrumentation patterns, and cardinality rules. Use when enabling OTel export, adding custom spans or metrics in services, debugging missing telemetry, looking up…
maintenance
Investigate, adopt, and verify dependency updates — with special handling for @cyanheads/mcp-ts-core. Captures what changed, understands why, cross-references against the codebase, adopts framework improvements, syncs project skills, and runs final checks. Supports two entry modes: run the full flow end-to-end, or…