Borrowing it
Nothing to install: this file belongs to SharpLu/ko-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SharpLu/ko-mcp/main/.claude/skills/new-tool/SKILL.mdgit clone --depth 1 https://github.com/SharpLu/ko-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sharplu/ko-mcp/new-tool)<a href="https://agentmods.dev/skills/sharplu/ko-mcp/new-tool"><img src="https://agentmods.dev/badge/skills/sharplu/ko-mcp/new-tool/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sharplu/ko-mcp/new-tool"><img src="https://agentmods.dev/badge/skills/sharplu/ko-mcp/new-tool.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00611 |
| Opus 5.5 | $0.00018 | $0.00244 |
| Sonnet 5.5 | $0.00009 | $0.00122 |
| Haiku 4.5 | $0.00004 | $0.00061 |
Grade A, and why
new-tool scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
新/改 tool 的 `/api/v1/...` 要对着 ko-api 路由核对并 **curl 过** What it actually says
新 MCP tool 变更流程
本 skill 是 AGENTS.md 的快捷入口：五步清单见 §4，铁律见 §3， 验证命令见 §6，Definition of Done 见 §5。
动手前自检这五件事（ko-mcp 事故/约束 Top5）：
-
30-count 契约：加/删/改名 tool 必须同步
server/src/__tests__/tools-proxy.test.ts的EXPECTED_TOOLS（恰好 30 + 全名，MIN_TOOLS同步）。漏改 CI 直接 fail（铁律 #1）。 -
Int64 是字符串：ko-api 的 Int64/UInt64（net_value / shares_held / holding_value…） 以字符串到达——喂给
fmtMoney/fmtShares/fmtPct前先num()强转，别当 number 用。crypto.ts是范本，num()在format.ts（铁律 #2）。 -
ko-api 路径必须 LIVE：契约门只查 tool 是否注册（调
/api/路径），不查 liveness。 新/改 tool 的/api/v1/...要对着 ko-api 路由核对并 curl 过 （https://api.ko.io/api/v1/...?demo=true），别写一个打不通的 tool（铁律 #3/#7）。 -
动态代理，别硬编码：
mcp-proxy动态转发 mcp.ko.io 的tools/list；KO_API_URL = api.ko.io是地理路由（正确，别改）。不在代理里写死 tool 列表（铁律 #4）。 -
跑 server 测试：
cd server && npm run type-check && npm test全绿再提。 单测禁触网（vi.mock("../ko-fetch.js")）。眼看 ≠ verified——没 curl 过的路径别声称好使（铁律 #6/#7）。
收尾必做：tools-proxy.test.ts 30-count 同步 + 验证证据贴 PR；版本齐步
（server.json + package.json + server/src/index.ts 的 McpServer({version}) 三处，
SDK 三包同版本，铁律 #8）；普适教训回写 AGENTS.md §3。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed 4267b89a25a3
- 1mo ago Changed · +1 lines 043fab242be0
- 1mo ago First seen · 32 lines · 44 tokens per session scan A 9666c570acb3
new-tool is a skill published in the GitHub repository SharpLu/ko-mcp (0 stars, last pushed 3d ago), licensed MIT. It adds 44 tokens to every session and 611 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
quo-webhooks
Receive and verify Quo webhooks (quo.com — the business phone / VoIP platform formerly known as OpenPhone). Use when setting up a Quo webhook handler, debugging signature verification, or handling call and message events like message.received, call.completed, call.summary.completed, call.transcript.completed…
azure-event-grid-webhooks
Receive and validate Azure Event Grid webhook deliveries. Use when setting up an Event Grid WebHook event handler, implementing the Microsoft.EventGrid.SubscriptionValidationEvent handshake (echo data.validationCode as validationResponse with HTTP 200), implementing the CloudEvents v1.0 HTTP OPTIONS abuse-protection…
formstack-webhooks
Receive and verify Formstack Forms webhooks (the "WebHook" submit action, aka "Send Data to an External URL"). Use when setting up a Formstack form submission webhook handler, debugging X-FS-Signature HMAC verification, handling application/x-www-form-urlencoded or JSON submission payloads, or working out which fields…
baselinker-webhooks
Receive BaseLinker (Base.com) webhooks. Use when building a BaseLinker order or warehouse callback receiver, because BaseLinker is not a normal webhook source: deliveries arrive as HTTP HEAD requests with NO body, the entire payload is in the query string (observed params: orderid, state), there is NO signature…
fireflies-webhooks
Receive and verify Fireflies.ai webhooks. Use when setting up Fireflies webhook handlers, debugging X-Hub-Signature verification, or handling the meeting.transcribed, meeting.summarized, and meeting.botjoined events from Webhooks V2. Also covers the legacy V1 scheme.
mailgun-webhooks
Receive and verify Mailgun webhooks. Use when setting up Mailgun webhook handlers, debugging Mailgun signature verification, or handling email events like delivered, failed, opened, clicked, unsubscribed, and complained.