Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/polygraphso/litmus/polygraphnpx skills add polygraphso/litmus --skill polygraphgit clone --depth 1 https://github.com/polygraphso/litmusWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00225 | $0.03348 |
| Opus 5 | $0.00112 | $0.01674 |
| Sonnet 5 | $0.00045 | $0.00670 |
| Haiku 4.5 | $0.00022 | $0.00335 |
Grade A, and why
polygraph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 246 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Polygraph: Behavioral Trust Grades for MCP Servers
Agents wire up third-party MCP servers and then trust whatever those servers' tools return. Polygraph tests an MCP server's behavior before your agent does, and assigns a letter grade A–F backed by reproducible evidence.
A passing grade is a measurement, not a guarantee — it says "this exact tool surface did not misbehave under these probes," and because the harness is open and deterministic, anyone can re-run it and disprove a bad grade. That falsifiability is the whole point.
- Home / methodology: polygraph.so
- Lookup CLI (npm):
polygraphso - Grading harness:
@polygraphso/litmus(open source)
What a grade measures
Polygraph connects to a server the way an agent would — stdio for local packages,
Streamable HTTP for remote URLs — fingerprints its exact tool surface
(tools/list → canonical JSON → sha256 → bytes32), then runs four probe categories:
- C-01 — Tool-output injection. Does the server try to hijack the agent? Static scan of tool names/descriptions/schemas for injection-shaped content (invisible unicode, instruction mimicry, markdown tricks) plus dynamic bait calls that check whether tool outputs smuggle in instructions.
- C-02 — Permission / egress overreach. Does the server do more than it claims? Flags
tools that declare
readOnlyHint: truebut carry destructive verbs, and runs the server in a hardened default-deny Docker sandbox where any outbound network attempt is a finding. - C-03 — Sensitive-data handling. Does the server leak secrets? Plants canary values in the environment and working directory, exercises the tools, and scans both tool outputs and egress for any canary that surfaces.
- C-04 — Adversarial-input handling. Does the server stay robust under hostile input? Runs two probes on non-state-changing tools, with no Docker required: stress-tests each tool with malformed and oversized inputs (fails if the server crashes, hangs, or leaks an uncaught stack trace — a clean validation error or benign result passes); and feeds jailbreak-pattern strings and scans the server's outputs with the C-01 injection scanners, failing only if the server emits injection-shaped content it did not merely reflect from the input (a verbatim echo is excluded). A C-04 failure caps the overall grade at D.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 246 lines · 225 tokens per session scan A 3ab06611b465
polygraph is a skill published in the GitHub repository polygraphso/litmus (8 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 225 tokens to every session and 3,348 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-wormhole
Use Agent Wormhole for one-time sealed handoffs between autonomous agents, including encrypted mission briefs, scoped secrets, temporary artifacts, receipts, config drops, CLI/API usage, ECHO holder access, and Bankr x402 paid opens.
aishield
AIShield Security Scanner — 对齐 OWASP MCP Top 10 (2025 v0.1) 的 AI Agent 安全扫描工具。 133条检测规则，5维评分体系（安全性/权限/数据处理/供应链/可靠性）。 检测能力：工具投毒、命令注入、Prompt注入（中英文）、供应链攻击、 SSRF、密钥泄露、权限提升、违禁词合规等。.
maiat-trust-check
Check if an agent or token is trustworthy before transacting. Returns trust score and verdict from 29,000+ indexed agents on Base. Use before any swap, transfer, or agent interaction.
pinion-chain-intel
On-chain intelligence, transactions and wallet tools on Base. 9 x402-paywalled skills at $0.01 USDC each.
pinion-broadcast
Sign and broadcast an unsigned transaction on Base. Requires the sender's private key. Costs $0.01 USDC via x402.
pinion-send
Construct an unsigned ETH or USDC transfer transaction on Base. Client signs and broadcasts. Costs $0.01 USDC via x402.