Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pipefy/ai-toolkit --skill pipefy-ipaasgit clone --depth 1 https://github.com/pipefy/ai-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pipefy/ai-toolkit/pipefy-ipaas)<a href="https://agentmods.dev/skills/pipefy/ai-toolkit/pipefy-ipaas"><img src="https://agentmods.dev/badge/skills/pipefy/ai-toolkit/pipefy-ipaas/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pipefy/ai-toolkit/pipefy-ipaas"><img src="https://agentmods.dev/badge/skills/pipefy/ai-toolkit/pipefy-ipaas.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
- Socket pass
- Snyk warn
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.02633 |
| Opus 5.5 | $0.00039 | $0.01053 |
| Sonnet 5.5 | $0.00020 | $0.00527 |
| Haiku 4.5 | $0.00010 | $0.00263 |
Grade A, and why
pipefy-ipaas scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
iPaaS (Advanced Automations)
MCP clients: read references/mcp.md. CLI users: read references/cli.md. Examples below describe shared operation arguments.
Pipefy's embedded workflow-automation platform. A flow is a trigger plus a sequence of steps that call pieces (integration connectors). The flow-builder verbs are catalog entries you discover per pipe and invoke through call_ipaas_tool, never a fixed operation list.
When to use
- "Integrate with Slack / Gmail / Google Sheets / an external app."
- User asks to integrate Pipefy with an external app (Slack, Gmail, Sheets, etc.) — use iPaaS tools here, not traditional automations or AI agents by default.
- "When a webhook comes in, do X." "On a schedule, do Y."
- "Build a multi-step flow with a router / loop / code step."
- Managing iPaaS data tables (separate from Pipefy database tables).
When not to use: native if/then rules on card events, or prompt-driven AI automations, both live in pipefy-automations. Simple HTTP callbacks on card events are create_webhook in pipefy-members-email-webhooks.
Prerequisites
-
iPaaS enabled on the organization. If not, the backend typically returns a permission error (often coded
PERMISSION_DENIEDwith text like "iPaaS is disabled for your organization" — exact code/string is backend-dependent). -
Permission to create automations on the pipe (pipe-admin ability).
-
Service account must be a pipe member. When a flow runs under a service account, that account must be a member of the target pipe, or pipe-scoped calls under its identity fail with a permission error even after the flow is built. Adding the account elsewhere (org-level) is not enough. Provision one with
create_service_accountif needed, then attach it withadd_service_account_to_pipe(pipe_id, email, role_name)immediately — seepipefy-members-email-webhooksand docs/mcp/tools/service-accounts.md. The catalog operations act as the calling session's identity, so this applies to the service account your flow runs under, not to the catalog caller.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · +1 lines · -6 tokens per session 3319b70c246f
- 1mo ago First seen · 127 lines · 104 tokens per session scan A 7a3e27790d29
pipefy-ipaas is a skill published in the GitHub repository pipefy/ai-toolkit (51 stars, last pushed today), licensed Apache-2.0. It adds 98 tokens to every session and 2,633 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fdcnal-usda-fooddata-central-agent
The FoodData Central API provides REST access to FoodData Central (FDC), assisting developers in incorporating nutrient data into their applications. It provides access to Standard Reference (SR) Legacy data, USDA Global Branded Foods Database, Foundation Foods, and FNDDS.
notebooklm
Install, authenticate, troubleshoot, and operate Gemini Notebook through the notebooklm-py CLI or typed async Python API. Use for notebook and source management, grounded chat and research, and artifact generation or download when the user mentions Gemini Notebook, notebooklm-py, the notebooklm CLI, or its Python API.…
zapier-sdk
Zapier SDK for TypeScript. Programmatic access to 9,000+ apps on a user's behalf via Zapier's OAuth and audit layer. Use when writing code that needs to run actions in third-party apps (send an email, upsert a CRM record, look up a spreadsheet row, post to a chat) without managing per-app OAuth or vendor SDKs.…
huawei-cloud-apig-instance-management
Manage Huawei Cloud APIG (API Gateway, dedicated instances) via hcloud CLI: instance lifecycle (create/list/delete), API groups, API create/update/delete, publish/offline, request throttling policies, signature keys, access control (ACL) policies, and public ingress EIP binding, plus read-only diagnosis of public…
huawei-cloud-smn-dms-message
Manage Huawei Cloud SMN (Simple Message Notification) topics, subscriptions, message templates and message publishing, and manage DMS (Distributed Message Service) Kafka/RabbitMQ/RocketMQ instances and Kafka topics. 15 built-in actions cover query (list topics/subscriptions/message templates/DMS instances/Kafka…
frontmcp-development
Use when building any FrontMCP server component other than a tool (for tools, use create-tool). Covers @Resource static resources and parameterized URI templates; @Prompt reusable prompts (RAG, multi-turn); @Provider singleton dependency-injection providers (database pools, API clients); @Agent autonomous LLM agents…