Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ruvnet/metaharness --skill threat-modelgit clone --depth 1 https://github.com/ruvnet/metaharnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ruvnet/metaharness/threat-model)<a href="https://agentmods.dev/skills/ruvnet/metaharness/threat-model"><img src="https://agentmods.dev/badge/skills/ruvnet/metaharness/threat-model.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00664 |
| Opus 5 | $0.00000 | $0.00332 |
| Sonnet 5 | $0.00000 | $0.00133 |
| Haiku 4.5 | $0.00000 | $0.00066 |
Grade A, and why
threat-model scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
threat-model
Codex skill: MCP threat-model artifact for PR / compliance review (iter 112 → iter 114). User-labelled "enterprise gold."
What it does
Renders the existing mcp-scan findings as a clean threat-model artifact
in the shape a security / compliance reviewer wants to see attached to a
PR:
MCP Threat Model
Allowed tools: 3
Denied tools: 14
Dangerous permissions: 0
Secrets reachable: no
Network access: no
Shell access: no
File write: no
Default-deny policy: yes
Audit log: yes
Verdict: clean (exit 0)
Same underlying scan as mcp-scan, presented as a single-screen artifact.
| Verdict | Exit | Triggers |
|---|---|---|
clean |
0 | no dangerous perms, no secret exposure |
medium |
1 | network OR file-write granted, OR no audit log |
high |
2 | shell granted OR default-deny OFF OR secrets reachable |
The "secrets reachable" heuristic is conservative: true when MCP is in
use AND deny rules don't guard .env* AND allow rules include any
Read(...) grant.
Usage from Codex
/threat-model path=./my-harness
/threat-model path=./my-harness bundle=true
Equivalent CLI
harness threat-model ./my-harness # text artifact
harness threat-model ./my-harness --json # full envelope
harness threat-model ./my-harness --bundle # ADR-031 schema-1
harness threat-model ./my-harness --out tm.json # write to file
When to attach this to a PR
- Adding a new MCP server / tool
- Loosening a permission allow rule
- Pulling in a new dependency that exposes shell/network capabilities
- Any change to
.harness/mcp-policy.jsonor.claude/settings.jsonpermissions
The artifact is small enough to paste verbatim into the PR description.
Related skills
validate-harness(iter 22) — release-readiness umbrella (includes mcp-scan)score-harness(iter 114) — broader 0-100 scorecard; MCP safety is one of its 5 dimensionsrepo-genome(iter 114) — pre-scaffold readiness; MCP risk is one of its 7 sections
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 83 lines · 0 tokens per session scan A 2106856f0f27
threat-model is a skill published in the GitHub repository ruvnet/metaharness (633 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 664 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-agent
Agent skill for agent - invoke with $agent-agent.
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-performance-benchmarker
Agent skill for performance-benchmarker - invoke with $agent-performance-benchmarker.
agent-quorum-manager
Agent skill for quorum-manager - invoke with $agent-quorum-manager.
agent-topology-optimizer
Agent skill for topology-optimizer - invoke with $agent-topology-optimizer.
agent-adaptive-coordinator
Agent skill for adaptive-coordinator - invoke with $agent-adaptive-coordinator.