Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add polygraphso/litmus --skill polygraphgit clone --depth 1 https://github.com/polygraphso/litmusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/polygraphso/litmus/polygraph)<a href="https://agentmods.dev/skills/polygraphso/litmus/polygraph"><img src="https://agentmods.dev/badge/skills/polygraphso/litmus/polygraph/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/polygraphso/litmus/polygraph"><img src="https://agentmods.dev/badge/skills/polygraphso/litmus/polygraph.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00225 | $0.03348 |
| Opus 5.5 | $0.00090 | $0.01339 |
| Sonnet 5.5 | $0.00045 | $0.00670 |
| Haiku 4.5 | $0.00022 | $0.00335 |
Grade A, and why
polygraph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 246 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Polygraph: Behavioral Trust Grades for MCP Servers
Agents wire up third-party MCP servers and then trust whatever those servers' tools return. Polygraph tests an MCP server's behavior before your agent does, and assigns a letter grade A–F backed by reproducible evidence.
A passing grade is a measurement, not a guarantee — it says "this exact tool surface did not misbehave under these probes," and because the harness is open and deterministic, anyone can re-run it and disprove a bad grade. That falsifiability is the whole point.
- Home / methodology: polygraph.so
- Lookup CLI (npm):
polygraphso - Grading harness:
@polygraphso/litmus(open source)
What a grade measures
Polygraph connects to a server the way an agent would — stdio for local packages,
Streamable HTTP for remote URLs — fingerprints its exact tool surface
(tools/list → canonical JSON → sha256 → bytes32), then runs four probe categories:
- C-01 — Tool-output injection. Does the server try to hijack the agent? Static scan of tool names/descriptions/schemas for injection-shaped content (invisible unicode, instruction mimicry, markdown tricks) plus dynamic bait calls that check whether tool outputs smuggle in instructions.
- C-02 — Permission / egress overreach. Does the server do more than it claims? Flags
tools that declare
readOnlyHint: truebut carry destructive verbs, and runs the server in a hardened default-deny Docker sandbox where any outbound network attempt is a finding. - C-03 — Sensitive-data handling. Does the server leak secrets? Plants canary values in the environment and working directory, exercises the tools, and scans both tool outputs and egress for any canary that surfaces.
- C-04 — Adversarial-input handling. Does the server stay robust under hostile input? Runs two probes on non-state-changing tools, with no Docker required: stress-tests each tool with malformed and oversized inputs (fails if the server crashes, hangs, or leaks an uncaught stack trace — a clean validation error or benign result passes); and feeds jailbreak-pattern strings and scans the server's outputs with the C-01 injection scanners, failing only if the server emits injection-shaped content it did not merely reflect from the input (a verbatim echo is excluded). A C-04 failure caps the overall grade at D.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 246 lines · 225 tokens per session scan A 3ab06611b465
polygraph is a skill published in the GitHub repository polygraphso/litmus (8 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 225 tokens to every session and 3,348 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
polygraph
Behavioral trust grades (A–F) for MCP servers. Use when an agent needs to check whether an MCP server is safe before using it, verify an onchain attestation before trusting or paying a server, look up a server's published grade, get a project graded, or understand why a server received a grade. Polygraph connects to…
aishield
An AI and MCP security scanner aligned with the OWASP MCP Top 10, a list of common risks for tool-connected AI systems. It checks for issues such as prompt injection, command injection, poisoned tools, leaked secrets, unsafe permissions, supply-chain attacks, SSRF, and banned Chinese-language content.
daily-briefing
Start your day with a prioritized CRM briefing — works for any monday CRM setup: pipeline, contacts, accounts, leads, or no board at all. Use when someone says 'morning briefing', 'daily brief', 'what's on my plate today', 'catch me up on my deals', 'what needs attention', 'what needs my attention', 'anything urgent…
workspace-builder
Build a CRM workspace from scratch — describe your business and get boards, columns, and pipeline stages created in monday. Use when someone says "set up my CRM", "build me a CRM", "create CRM boards for me", "I need a new sales pipeline", "help me get started in monday", "I don't know how to set up my pipeline", or…
data-cleanup
Check your CRM board's health and clean up messy data — run a scored health check (missing fields, stalled deals, abandoned columns, automation gaps) as a report, or fix data in bulk (phone formats, missing emails, country codes, unowned deals, stale dates). Use when someone says "clean my CRM", "fix my data"…
meeting-to-deal
Turn meeting transcripts into deal updates — key points, commitments, and next steps posted to matching CRM deals automatically. Auto-creates contacts for new attendees. Use when someone says "log my meetings to deals", "update CRM from calls", "what did I commit to in meetings", "sync notetaker", "log this meeting"…