Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add salitaba/maven-decoder-mcp --skill maven-code-searchgit clone --depth 1 https://github.com/salitaba/maven-decoder-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/salitaba/maven-decoder-mcp/maven-code-search)<a href="https://agentmods.dev/skills/salitaba/maven-decoder-mcp/maven-code-search"><img src="https://agentmods.dev/badge/skills/salitaba/maven-decoder-mcp/maven-code-search/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/salitaba/maven-decoder-mcp/maven-code-search"><img src="https://agentmods.dev/badge/skills/salitaba/maven-decoder-mcp/maven-code-search.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.01686 |
| Opus 5.5 | $0.00044 | $0.00674 |
| Sonnet 5.5 | $0.00022 | $0.00337 |
| Haiku 4.5 | $0.00011 | $0.00169 |
Grade A, and why
maven-code-search scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Maven Code Search
Overview
Use the maven-decoder MCP server before guessing about third-party Java dependencies. It can search the user's installed Maven repository, search Maven Central online, inspect jars, prefer source jars when available, and decompile bytecode when source is missing.
The MCP sees both local and remote artifacts. Artifacts already in the local Maven repository are used directly; anything else is downloaded from Maven Central into a separate cache on demand, so you can inspect a library the user has never installed. Local copies always take precedence.
If a remote lookup fails, check whether offline mode is enabled (MAVEN_OFFLINE) before telling the user an artifact does not exist.
Quick Workflow
- Identify the target coordinates when possible:
group_id,artifact_id, andversion. Readpom.xml,build.gradle, lockfiles, or existing imports if the user did not provide them. - Use MCP search tools to confirm what is available before inspecting code. Search locally first; go online when the artifact is not installed.
- Prefer narrow queries: a class name, package pattern, artifact coordinates, or method pattern.
- Use pagination for broad searches and ask for the next page only when the current page is not enough.
- Report findings with exact coordinates, class names, method names, whether the result came from sources or decompiled bytecode, and whether it came from the local repository or was downloaded.
Tool Selection
Local first
Use list_artifacts to discover installed artifacts or filter by partial group_id, artifact_id, or version.
Use get_version_info when the user asks which versions of an artifact are installed. Set include_remote: true to also show versions published on Maven Central.
Use search_classes when the user knows a class name, simple type name, wildcard, or package but not the artifact that contains it. This scans installed jars only.
Going online
Use search_maven_central when the artifact is not installed, when the user asks what exists on Maven Central, or when search_classes finds nothing. Search by class_name or fully_qualified_class to discover which published artifact contains a type.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +22 lines · +14 tokens per session df0795c00ce7
- 1mo ago First seen · 85 lines · 95 tokens per session scan A 6f79d78fab46
maven-code-search is a skill published in the GitHub repository salitaba/maven-decoder-mcp (20 stars, last pushed 1mo ago), licensed MIT. It adds 109 tokens to every session and 1,686 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
loom-java
Java language expertise for idiomatic, production-quality code.
Build Tool Conventions
Maven/Gradle standard layout, dependency management, plugin versioning, and reproducible builds.
jar-analysis
Explore, search, read, and decompile Java JAR, WAR, EAR, AAR, and Spring Boot fat-jar files via the dejared MCP server. Use this skill whenever the user references a .jar file path, asks what a third-party Java library does, wants to read a config embedded in a JAR (application.yml, spring.factories, MANIFEST.MF)…
java-specifications
Structural verification for Java and Kotlin — SpotBugs/Error Prone, Detekt. Load when planning, implementing, or reviewing Java/Kotlin code (.java, .kt; build.gradle, pom.xml).
java-affected-tests
Use before opening or updating an OpenMetadata PR that changes Java, a JSON schema, an index mapping, a SQL migration, seed data or a pom — PR CI no longer runs the Java integration tests (they run only in the merge queue) and the JavaUIIT/search-it suites run only nightly, so this selects the unit tests and…
azure-security-keyvault-secrets-java
Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.