Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add salatmaster/keenetic-mcp --skill keenetic-segmentsgit clone --depth 1 https://github.com/salatmaster/keenetic-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/salatmaster/keenetic-mcp/keenetic-segments)<a href="https://agentmods.dev/skills/salatmaster/keenetic-mcp/keenetic-segments"><img src="https://agentmods.dev/badge/skills/salatmaster/keenetic-mcp/keenetic-segments/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/salatmaster/keenetic-mcp/keenetic-segments"><img src="https://agentmods.dev/badge/skills/salatmaster/keenetic-mcp/keenetic-segments.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02505 |
| Opus 5 | $0.00028 | $0.01252 |
| Sonnet 5 | $0.00011 | $0.00501 |
| Haiku 4.5 | $0.00006 | $0.00250 |
Grade A, and why
keenetic-segments scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- keenetic-segments — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Creating a segment the router will admit exists
The trap
The obvious way to build an isolated network is a bridge with an address, NAT, and a Wi-Fi network bound to it:
interface Bridge2
interface Bridge2 ip address 192.168.3.1 255.255.255.0
interface Bridge2 up
ip nat Bridge2
This works. Clients associate, get addresses, reach the internet, and stay off
the home network. It is also invisible: nothing appears under
/access-points, nothing appears in the segment list, and the user cannot
manage from the web interface the thing they just asked you to create.
Reported as "it works but I can't see it", which is a much harder bug to find after the fact than before.
What the web interface means by a segment
A segment is VLAN-backed. The bridge is only half of it. Three things are missing from the sequence above:
- a VLAN subinterface,
GigabitEthernet0/VlanN - that VLAN trunked over every port of the switch
- the subinterface bridged into the segment
Do those and the router fills in the rest itself. iseg - the block the web
interface reads - is computed, not written:
"iseg": { "vlan": "2", "port": "1,2,3,4,5", "vlan-port": "1,2,3,4,5",
"free-port": "", "busy-vlan": "1" }
You never set those fields. If they are empty, the VLAN is missing.
Use the tool
create_segment does all of it, picks free identifiers, verifies the result
against iseg, and rolls the whole thing back if any step fails:
create_segment { "name": "iot", "ssid": "…", "psk": "…" }
create_segment { "name": "vpn", "permit_interfaces": ["Wireguard1"] }
create_segment { "name": "wired-lab", "subnet": 40 }
list_segments shows what exists and, per bridge, whether uiVisible is true.
Run it first: a bridge that is already there but not visible has the same
missing VLAN, and is worth mentioning to the user.
Everything below is for doing it by hand through rci_call, which is worth
reading anyway, because it is what the tool is doing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 260 lines · 55 tokens per session scan A dde5227c2576
keenetic-segments is a skill published in the GitHub repository salatmaster/keenetic-mcp (22 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 2,505 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
keenetic-segments
Use when creating an isolated network on a Keenetic - a guest network, an IoT network, a segment routed through a VPN - explains why the obvious way produces a working network the web interface refuses to list, and the VLAN it is actually missing.
keenetic-rci
Use when a Keenetic question is not covered by the curated tools and you need rcicall - explains the RCI tree, the paths that exist, the responses that will blow up your context, and the traps that make a wrong call look like success.
keenetic-troubleshoot
Use when someone reports the internet is down, Wi-Fi is bad, a device cannot connect, or the network is slow on a Keenetic router - an ordered playbook that narrows the fault instead of guessing.
keenetic-safe-changes
Use before changing anything on a Keenetic router - explains that changes are not saved until asked, what the router's fail-safe does and does not protect against, and the order that avoids locking yourself out.
telephony-and-conferencing
Runs voice and meeting infrastructure — phone systems and numbers, emergency calling obligations, conference rooms and their AV, call recording and its retention consequences, and the porting that makes provider changes go badly. Use this to replace a phone system, fix rooms nobody can start a meeting in, meet…
endpoint-management
Manages laptops, desktops and mobile devices — enrollment, configuration, patching, software distribution, and lost or compromised devices. Use this to set up device management, standardize builds, roll out software or an OS upgrade, handle a lost device, or bring an unmanaged fleet under control.