Borrowing it
Nothing to install: this file belongs to SharpLu/ko-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SharpLu/ko-mcp/main/.claude/skills/new-tool/SKILL.mdgit clone --depth 1 https://github.com/SharpLu/ko-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sharplu/ko-mcp/new-tool)<a href="https://agentmods.dev/skills/sharplu/ko-mcp/new-tool"><img src="https://agentmods.dev/badge/skills/sharplu/ko-mcp/new-tool/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sharplu/ko-mcp/new-tool"><img src="https://agentmods.dev/badge/skills/sharplu/ko-mcp/new-tool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00583 |
| Opus 5 | $0.00022 | $0.00292 |
| Sonnet 5 | $0.00009 | $0.00117 |
| Haiku 4.5 | $0.00004 | $0.00058 |
Grade A, and why
new-tool scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
新/改 tool 的 `/api/v1/...` 要对着 ko-api 路由核对并 **curl 过** What it actually says
新 MCP tool 变更流程
本 skill 是 AGENTS.md 的快捷入口：五步清单见 §4，铁律见 §3， 验证命令见 §6，Definition of Done 见 §5。
动手前自检这五件事（ko-mcp 事故/约束 Top5）：
-
24-count 契约：加/删/改名 tool 必须同步
server/src/__tests__/tools-proxy.test.ts的EXPECTED_TOOLS（恰好 24 + 全名）。漏改 CI 直接 fail（铁律 #1）。 -
Int64 是字符串：ko-api 的 Int64/UInt64（net_value / shares_held / holding_value…） 以字符串到达——喂给
fmtMoney/fmtShares/fmtPct前先num()强转，别当 number 用。crypto.ts是范本，num()在format.ts（铁律 #2）。 -
ko-api 路径必须 LIVE：契约门只查 tool 是否注册（调
/api/路径），不查 liveness。 新/改 tool 的/api/v1/...要对着 ko-api 路由核对并 curl 过 （https://api.ko.io/api/v1/...?demo=true），别写一个打不通的 tool（铁律 #3/#7）。 -
动态代理，别硬编码：
mcp-proxy动态转发 mcp.ko.io 的tools/list；KO_API_URL = api.ko.io是地理路由（正确，别改）。不在代理里写死 tool 列表（铁律 #4）。 -
跑 server 测试：
cd server && npm run type-check && npm test全绿再提。 单测禁触网（vi.mock("../ko-fetch.js")）。眼看 ≠ verified——没 curl 过的路径别声称好使（铁律 #6/#7）。
收尾必做：tools-proxy.test.ts 24-count 同步 + 验证证据贴 PR；版本齐步
（server.json + package.json，SDK 三包同版本，铁律 #8）；普适教训回写 AGENTS.md §3。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 32 lines · 44 tokens per session scan A 9666c570acb3
new-tool is a skill published in the GitHub repository SharpLu/ko-mcp (0 stars, last pushed 11d ago), licensed MIT. It adds 44 tokens to every session and 583 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
azure-event-grid-webhooks
Receive and validate Azure Event Grid webhook deliveries. Use when setting up an Event Grid WebHook event handler, implementing the Microsoft.EventGrid.SubscriptionValidationEvent handshake (echo data.validationCode as validationResponse with HTTP 200), implementing the CloudEvents v1.0 HTTP OPTIONS abuse-protection…
baselinker-webhooks
Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: orderid, state), there is NO signature…
claude-managed-agents-webhooks
Receive and verify Anthropic Claude Managed Agents (CMA) webhooks. Use when setting up Claude Managed Agents webhook handlers, debugging signature verification, or handling agent session and vault events like session.statusidled, session.statusterminated, session.threadcreated, vault.created, or…
cronofy-webhooks
Receive and verify Cronofy push notifications (webhooks). Use when setting up Cronofy notification channels, debugging Cronofy-HMAC-SHA256 verification, or handling Cronofy calendar events like verification, change, profiledisconnected, conferencingprofiledisconnected, profileinitialsynccompleted, and gdprrequested.…
fireflies-webhooks
Receive and verify Fireflies.ai webhooks. Use when setting up Fireflies webhook handlers, debugging X-Hub-Signature verification, or handling the meeting.transcribed, meeting.summarized, and meeting.botjoined events from Webhooks V2. Also covers the legacy V1 scheme.
alipay-webhooks
Receive and verify Alipay (Antom / Alipay+) webhook notifications. Use when setting up Alipay webhook handlers, debugging RSA256 Signature header verification, or handling payment events like notifyPayment, notifyCapture, notifyRefund, notifyAuthorization, and notifyDispute.