Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add QVerisAI/qveris-agent-toolkit --skill qveris-cligit clone --depth 1 https://github.com/QVerisAI/qveris-agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qverisai/qveris-agent-toolkit/qveris-cli)<a href="https://agentmods.dev/skills/qverisai/qveris-agent-toolkit/qveris-cli"><img src="https://agentmods.dev/badge/skills/qverisai/qveris-agent-toolkit/qveris-cli/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qverisai/qveris-agent-toolkit/qveris-cli"><img src="https://agentmods.dev/badge/skills/qverisai/qveris-agent-toolkit/qveris-cli.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 12 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00923 |
| Opus 5 | $0.00021 | $0.00462 |
| Sonnet 5 | $0.00008 | $0.00185 |
| Haiku 4.5 | $0.00004 | $0.00092 |
Grade A, and why
qveris-cli scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# Generate production code snippet (curl/python/js) — only on successful calls How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Quick first run
New to QVeris? With your QVERIS_API_KEY set (create one at qveris.ai), init is a client-side first-call wizard: auth, discover, inspect, a real call, and exact usage/ledger commands to reconcile billing. It is not a server-side aggregate API.
export QVERIS_API_KEY="sk-..."
npx @qverisai/cli init
Re-run anytime with --query "..." to target a different capability, or --dry-run to validate without consuming credits. Once you've seen the loop, the commands below are the day-to-day surface.
Commands
# Discover tools by capability
qveris discover "weather forecast API" --json --limit 10
# Call after selecting result 1 because its contract matches these exact fields
qveris call 1 --params '{"wfo": "BOU", "x": 50, "y": 30}' --json
# Inspect only when selection/request construction needs missing or stale details
qveris inspect 1 --json
# Probe only for parameter validation or a current quote; it does not reserve a price
qveris probe 1 --params '{"wfo": "BOU", "x": 50, "y": 30}' --checks schema,quote --json
# Validate without consuming credits
qveris call 1 --params '{"wfo": "BOU", "x": 50, "y": 30}' --dry-run --json
# Generate production code snippet (curl/python/js) — only on successful calls
qveris call 1 --params '{"wfo": "BOU", "x": 50, "y": 30}' --codegen curl
Always use --json for structured output.
Response Size
Default: 4KB (TTY) / 20KB (piped/--json). Use --max-size -1 for unlimited.
Large responses are auto-truncated with a download link for the full result.
Session Mechanism
The CLI saves the last Discover ID, query, endpoint, and result summaries for 30 minutes. This supports numeric indices and real discovery attribution; it is not semantic routing memory or a complete schema cache. A new Discover replaces the indices. Use qveris history --clear to clear it.
Build parameters from the selected capability's current contract and the user's current request. An explicit empty contract is a zero-parameter tool; an omitted contract requires Inspect. Do not copy sample business values, drop required/enum/one-of constraints, or reuse a previous entity/date value.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines · -5 tokens per session f4b9c43a75c0
- 9d ago First seen · 84 lines · 47 tokens per session scan A ca3c88113a79
qveris-cli is a skill published in the GitHub repository QVerisAI/qveris-agent-toolkit (260 stars, last pushed today), licensed MIT. It adds 42 tokens to every session and 923 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
apple-cktool-js
Builds and troubleshoots CloudKit automation with Apple's CKTool JS packages, including @apple/cktool.database, @apple/cktool.target.nodejs, and @apple/cktool.target.browser. Use when Codex needs typed JavaScript or TypeScript for CloudKit schema import, export, validation, or reset; container and team discovery…
pn-backend-architecture
Scalable system design, database schemas, API contracts, microservices patterns. Use when designing APIs, DBs, or infrastructure before or during backend implementation.
pn-a2a-interop
Design and implement Agent2Agent (A2A) Protocol integrations — connecting pnCore-orchestrated agents with external agents built on other frameworks (LangGraph, ADK, CrewAI, AutoGen) or owned by other organizations. Covers A2A service cards, task routing, trust/auth, capability negotiation, and audit trail. Use when a…
pn-backend-scaffolding
Scaffolds new API routes, modules, or services in Node (Express, Fastify, Hono) or similar. Use when adding a new route/module/service; covers project layout, env/secrets pattern, error-handling stub, and stack-specific conventions. Reference pn-node-api and pn-backend-philosophy for design rules.
pn-graphql
GraphQL schema design, resolvers, DataLoader, Federation, and security. Use when building or reviewing GraphQL APIs with Apollo Server, Pothos, or GraphQL Yoga.
pn-node-api
Guides Node/API design, DB access patterns, and env/secrets. Use when designing or implementing Node/API code; covers API design, error handling, config, and DB patterns.