Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pipefy/ai-toolkit --skill pipefy-portal-setupgit clone --depth 1 https://github.com/pipefy/ai-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pipefy/ai-toolkit/pipefy-portal-setup)<a href="https://agentmods.dev/skills/pipefy/ai-toolkit/pipefy-portal-setup"><img src="https://agentmods.dev/badge/skills/pipefy/ai-toolkit/pipefy-portal-setup.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.04454 |
| Opus 5 | $0.00028 | $0.02227 |
| Sonnet 5 | $0.00011 | $0.00891 |
| Haiku 4.5 | $0.00006 | $0.00445 |
Grade A, and why
pipefy-portal-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 338 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Portal setup
Configure an organization's Pipefy portal: bootstrap the main hub, add pages and widgets, wire and publish sub-portals. 20 MCP tools (Interfaces GraphQL + internal_api for sub-portal wiring).
Deep reference: docs/mcp/tools/portal.md. Parity matrix: docs/parity.md. Env vars: docs/config.md.
When to use
- "Create our company portal", "list portals for org X", "publish a sub-portal".
- Add or change portal pages, layout, or page elements (
forms,link, etc.). - Attach, publish, unpublish, or delete sub-portals on the main portal.
Do not use for:
- Pipes, phases, cards, or automations — see
skills/pipes-and-cards/,skills/automations/. - Raw GraphQL when a portal tool exists — prefer the tools below.
- Bootstrapping a portal via undocumented
createInterfaceGraphQL — always usecreate_portal/pipefy portal create.
Prerequisites
- Organization id: UUID or numeric org id from
pipefy org get/ the Pipefy URL (examples below use fictional123456789perfixture_ids.py). SDK resolves numeric ids before Interfaces calls. The org you pass tolist_portals/create_portalmust be the same org your token can write on. - Portal writes: token needs
create_portaland/ormanage_portalson that org. Many service accounts only have pipe/card scope on their default org →PERMISSION_DENIEDon portal mutations even when reads succeed elsewhere. - One main portal per org —
create_portalis idempotent (second call returns the same portal UUID). - Cursor MCP: after changing
PIPEFY_*in.env, restart the MCP server so tools pick up the new credentials.
Confirm access before writes
Reads on the wrong org can succeed while Interfaces writes fail. Before page/element/sub-portal mutations:
- Call
list_portalswith the intendedorganization_uuid. - Ensure the token is meant for that org (service account email vs human user on a different org is a common mismatch).
- Prefer an org where the account has
manage_portalsand portal admin in Pipefy (not onlycanManagePortalson a read query from another org).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 338 lines · 57 tokens per session scan A ffb95c012b6f
pipefy-portal-setup is a skill published in the GitHub repository pipefy/ai-toolkit (45 stars, last pushed 4d ago), licensed Apache-2.0. It adds 57 tokens to every session and 4,454 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
frontmcp-deployment
Use when deploying, building for production, packaging, or shipping a FrontMCP server. Covers build targets (node, cli SEA binary, browser, embeddable SDK, mcpb archive for Claude Desktop, serverless) and deploying to Vercel (with Vercel KV), AWS Lambda (API Gateway, SAM, CDK), Cloudflare Workers (KV, D1, Durable…
doris-debug-tablet
Use for Doris tablet/replica health, version skew, clone backlog, disk balance, and tablet repair. Commands: SHOW PROC tablethealth, SHOW TABLET, ADMIN REPAIR.
wjx-mcp-use
A guide for using Wenjuanxing, a Chinese online questionnaire platform, through connected tools. It covers creating and editing surveys, reading responses, analyzing data, managing contacts, and generating sign-in links.
wjx-survey-ppt
Instructions for turning Wenjuanxing questionnaire responses into a presentation report. Wenjuanxing, also called 问卷星, is a platform for creating surveys and collecting answers.
metagit-projects
Ongoing workspace and project management for OpenClaw and Hermes agents. Use when starting work, organizing repos, or before creating a new project folder so existing metagit projects are reused instead of duplicated.
metagit-control-center
Use when running metagit as an MCP control center for multi-repo awareness, guarded sync, and operational knowledge across ongoing agent tasks.