Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/simokod/codecks-mcp/codecks-mcp-extendnpx skills add Simokod/codecks-mcp --skill codecks-mcp-extendgit clone --depth 1 https://github.com/Simokod/codecks-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/simokod/codecks-mcp/codecks-mcp-extend)<a href="https://agentmods.dev/skills/simokod/codecks-mcp/codecks-mcp-extend"><img src="https://agentmods.dev/badge/skills/simokod/codecks-mcp/codecks-mcp-extend.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00163 | $0.03310 |
| Opus 5 | $0.00081 | $0.01655 |
| Sonnet 5 | $0.00033 | $0.00662 |
| Haiku 4.5 | $0.00016 | $0.00331 |
Grade A, and why
codecks-mcp-extend scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const res = await fetch(url, { How it starts
The opening of the file, as written. The whole thing — 194 lines — stays where its author put it; the contents beside it link to each section on GitHub.
codecks-mcp-extend
This skill extends the CodecksMCP server (an MCP that bridges AI assistants to the Codecks task-management API) with new capabilities. It encodes a workflow proven to work for this codebase: research → probe → implement → smoke-test → clean up.
The Codecks API is not exhaustively documented. You will not know the dispatch endpoint payload shapes from training data alone. Discovering them by probing the live API is the core of this workflow — do not skip it and do not guess.
When this skill applies
- The user wants to add a new entity, tool, or capability to this MCP (CRUD for some Codecks model, attaching one entity to another, exposing a Codecks feature, etc.)
- A working
.envwithCODECKS_AUTH_TOKENandCODECKS_SUBDOMAINmust exist at the project root — the probe step depends on it. If it's missing, stop and ask the user.
Quick orientation
Read these files first, in order. They establish the patterns you must follow:
src/codecks/client.ts— therequestmethod. Two modes:request(query)posts a GraphQL-like body tohttps://api.codecks.io/for reads;request(payload, endpoint)posts tohttps://api.codecks.io/dispatch/<endpoint>for actions. Auth headers:X-Account(subdomain),X-Auth-Token. Existing dispatch endpoints used:cards/create,cards/update,decks/create,milestones/create|update|delete.src/tools/ToolGroup.ts— the base class.registerTool(name, description, handler, zodSchema, formatter?)is what every tool uses. Errors are caught and returned as text; you do not need to wrap your handler in try/catch.src/tools/CardTools.ts— the most complete example. Mirror its patterns for: dynamic Zod schemas fromclient.context.metadata, splitting/joining card content as${title}\n\n${description}, conditional spread for optional update fields (...(args.x !== undefined && { x: args.x })).src/tools/DeckTools.ts— minimal example. Good template if your entity has just create/list.src/tools/MilestoneTools.ts— full CRUD example with a dispatch action endpoint requiringuserId,accountId, and a relation array (projectIds).src/codecks/entities.ts— where API and MCP-facing types live. Split:CodecksApi<X>for the raw response shape,Codecks<X>for what your tool returns. Const enums (CardStatus,MilestoneColor) are used both as TS types and Zod enums.src/codecks/APItypes.ts— response wrapper types per endpoint. Add alist<X>Response, aget<X>Response, and (for dispatch endpoints) an action response shape if it doesn't already exist.src/server.ts— register the new ToolGroup here with onenew XTools(server, client).register()line.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 194 lines · 0 tokens per session scan A c99144f3d34d
codecks-mcp-extend is a skill published in the GitHub repository Simokod/codecks-mcp (4 stars, last pushed 1mo ago), licensed MIT. It adds 163 tokens to every session and 3,310 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
repo-context
Use repo-context-mcp tools to map, search, and pack repository context before large edits or PR review.
rpgmaker-mv-mcp
Use when building, editing or reasoning about an RPG Maker MV game through the RpgMakerMVUltimate MCP server (tools prefixed rpgmaker / the 13 consolidated tools: querydatabase, createdatabaseentry, generatemap, managemapevent, analyzeproject, etc.). Covers the correct workflow so maps, NPCs, chests, shops, doors…
vscode-ext-analyze-params
Analyze the parameter signature of a specific VSCode extension command by reverse-engineering the minified extension.js source code. Given an extension ID and a command name, extracts the registerCommand callback's formal parameters, infers types from runtime type-checking patterns (typeof, Array.isArray), and checks…
project-brain
Triggers (all require explicit user request — do NOT activate just because a brain/ folder exists): (1) The user wants to set up project-level memory ("set up project brain", "scaffold project context", "init project brain", "建项目脑"). (2) The user is in a directory containing brain/ AND explicitly asks to resume /…
social-scrape
Collect public posts and discussion from X, LinkedIn and Hacker News through a local signed-out browser, then report them in chat or write them to a document. Use when the user wants to scrape, monitor or research specific accounts, topics, hashtags or discussions on social platforms.
inspecto-onboarding-codex
Use when Codex should install or set up Inspecto in the current frontend project through the shared onboarding workflow.