Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sebahrens/bpmn-mcp --skill bpmn-modelergit clone --depth 1 https://github.com/sebahrens/bpmn-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sebahrens/bpmn-mcp/bpmn-modeler)<a href="https://agentmods.dev/skills/sebahrens/bpmn-mcp/bpmn-modeler"><img src="https://agentmods.dev/badge/skills/sebahrens/bpmn-mcp/bpmn-modeler/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sebahrens/bpmn-mcp/bpmn-modeler"><img src="https://agentmods.dev/badge/skills/sebahrens/bpmn-mcp/bpmn-modeler.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00109 | $0.01279 |
| Opus 5 | $0.00055 | $0.00639 |
| Sonnet 5 | $0.00022 | $0.00256 |
| Haiku 4.5 | $0.00011 | $0.00128 |
Grade A, and why
bpmn-modeler scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BPMN modeler
Use the tools exposed by the mcp-bpmn server. Refer to tools by their semantic names below; the host may display an MCP namespace prefix. Treat each live tool description and input schema as authoritative.
Route the request
- Determine whether the requested artifact is a single process or a collaboration.
- Use a process for one participant's control flow when pools and lanes are unnecessary.
- Use a collaboration for pools or lanes, and when distinct participants or organizations exchange messages. Model each participant as a pool; use lanes only inside white-box pools.
- Ask a focused question when participant boundaries, ownership, execution profile, or destructive file intent would materially change the model. Otherwise state a small assumption and proceed.
- Choose the authoring path.
- Prefer typed tools for edits, collaborations requiring precise ownership, specialized activity/event types, conditions, lanes, data, annotations, or extension-profile fields.
- Use
new_from_mermaidoropen_mermaid_fileonly to bootstrap a diagram that fits the supported flowchart subset. Read references/capabilities.md before choosing Mermaid.
- Default to the
portableextension profile. Usecamunda7only when the user requests its supported execution metadata. Do not translate unsupported profiles into Camunda 7 or portable fields.
Operate on the diagram
- Establish context with
current,new_bpmn,new_from_mermaid,open_bpmn, oropen_mermaid_file. If a diagram may already be current, inspect it before switching unless the request clearly authorizes the replacement. - For an existing diagram, inspect elements with
list_elementsandget_element, and inspect relationships withlist_connectionsandget_connection, before editing. Follow pagination untilhasMoreis false when the complete model matters. - Create owners before their contents: collaboration, pools, then pool-owned elements. Create all required elements before relationships. Retain every returned
processId,elementId,laneId,connectionId,associationId, and generated filename; never invent or reconstruct server IDs. - In collaborations, pass the returned pool
processIdasownerIdand normallyscopeIdfor its flow nodes. Connect nodes within one scope as sequence flow and across participants as message flow. Let server validation reject illegal endpoints rather than forcing an approximation. - Add lanes only after their flow nodes exist. Add sequence flows, message flows, conditions/defaults, and associations only after both endpoints exist.
- Before changing a connection, call
get_connection, then pass itssemanticRevisionasexpectedSemanticRevisiontoupdate_connection. Endpoint changes must namesourceIdand/ortargetIdand explicitly setendpointPolicytosnap-to-boundary; do not infer or hand-edit endpoint geometry. On a revision conflict, refresh withget_connection, reassess the current state, and retry only if the requested change is still valid. - For a local connection obstruction, call
route_connectionin its default proposal-only mode with the currentgeometryRevision. Inspect its diagnostics and score before passing the returned patch directly toapply_geometry_patch; useapply: trueonly when immediate atomic selection is intended. Do not hand-invent waypoints before trying the router. - Run
validateat meaningful semantic checkpoints, including after the main control-flow skeleton and after substantial edits. Resolve errors before continuing; report warnings that require user judgment. - For creation or edit deliverables, apply
auto_layoutnear the end, after semantic construction, unless the user asks to preserve manual geometry. It replaces coordinates and autosaves. Runvalidateagain atfulllevel after layout. Do not mutate a review-only request. - Use
exportin the requestedxmlorsvgformat when the result should be returned inline. Usesave_svgorsave_pngonly when the user requests a separate managed artifact filename; setoverwrite: trueonly with explicit replacement intent. Report the active BPMN filename, export or artifact format, validation result, and any warnings.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 48 lines · 109 tokens per session scan A ecd55dbc7aef
bpmn-modeler is a skill published in the GitHub repository sebahrens/bpmn-mcp (0 stars, last pushed 5d ago), licensed MIT. It adds 109 tokens to every session and 1,279 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…
next-partial-prefetching-adoption
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…