Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sparq-org/sparq/http-servernpx skills add sparq-org/sparq --skill http-servergit clone --depth 1 https://github.com/sparq-org/sparqWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sparq-org/sparq/http-server)<a href="https://agentmods.dev/skills/sparq-org/sparq/http-server"><img src="https://agentmods.dev/badge/skills/sparq-org/sparq/http-server.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00252 | $0.42702 |
| Opus 5 | $0.00126 | $0.21351 |
| Sonnet 5 | $0.00050 | $0.08540 |
| Haiku 4.5 | $0.00025 | $0.04270 |
Grade D, and why
http-server scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST -H 'Authorization: Bearer <TOKEN>' --data-binary @snapshot.spqb http://127.0.0.1:3030/admin/restore Cloud metadata endpointhighServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
> the `169.254.169.254` cloud-metadata IP). The allowlist is enforced before any socket is Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --compressed -G http://127.0.0.1:3030/sparql \ How it starts
The opening of the file, as written. The whole thing — 1,948 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sparq-http-server
sparq-server is a W3C-conformant HTTP server (axum/tokio) that exposes the sparq
query engine over a sparq_core::Graph — in-memory by default, or durable on disk
with --persist DIR (updates WAL-fsync'd, survive a restart with no rebuild; see the
"Durability" gotcha). It implements the SPARQL 1.1 Protocol (query + update at
/sparql) and the Graph Store HTTP Protocol (read + write), with Accept-driven
content negotiation, hardening guards, Prometheus /metrics, WebSocket + SSE subscriptions,
and opt-in grouped facet counts, prefix completion, time-travel, and GeoSPARQL.
Build with the default-off response-compression feature to negotiate gzip or zstd for outbound
result bodies from Accept-Encoding. Compression is transport-transparent and streaming; SSE
subscription responses and bodies that already have a Content-Encoding are left uncompressed:
cargo run -p sparq-server --features response-compression
curl --compressed -G http://127.0.0.1:3030/sparql \
--data-urlencode 'query=SELECT * WHERE { ?s ?p ?o }'
Quickstart
Run the binary (server stack is the default-on server feature):
# serve a Turtle file on the default address 127.0.0.1:3030 (loopback — safe default)
cargo run -p sparq-server -- --format turtle data.ttl
# no data file => empty default graph (still answers queries, just no rows)
cargo run -p sparq-server
# custom bind addr / format (turtle | ntriples | nquads | trig). A NON-loopback bind
# (e.g. 0.0.0.0) is REFUSED unless --allow-remote / SPARQ_ALLOW_REMOTE=1 (no auth — see below).
cargo run -p sparq-server -- --addr 0.0.0.0:8080 --allow-remote --format ntriples data.nt
Opt-in HTTP/2 switches the TCP listener from its default HTTP/1.1-only builder to the
hyper-util h1+h2 auto builder. With no certificate flags it accepts HTTP/1.1 and cleartext h2c;
supplying both PEM paths enables TLS 1.3 with ALPN h2,http/1.1:
cargo run -p sparq-server --features http2 -- data.ttl \
--tls-cert ./cert.pem --tls-key ./key.pem
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 167c60a32b0c
- 4d ago First seen · 1,948 lines · 252 tokens per session scan D 22c51b0097c7
http-server is a skill published in the GitHub repository sparq-org/sparq (10 stars, last pushed today), licensed MIT. It adds 252 tokens to every session and 42,702 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it D with 3 findings (sends data to an external url, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
instrument-data-to-allotrope
Convert laboratory instrument output files (PDF, CSV, Excel, TXT) to Allotrope Simple Model (ASM) JSON format or flattened 2D CSV. Use this skill when scientists need to standardize instrument data for LIMS systems, data lakes, or downstream analysis. Supports auto-detection of instrument types. Outputs include full…
exploratory-data-analysis
Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…
media-ingest
Ingest video, audio, PDF, book, screenshot, and GitHub repo content into the brain. Multi-format handling with entity extraction and backlink propagation. Covers video-ingest, youtube-ingest, and book-ingest subtypes.
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
read
Reads URLs and PDFs by fetching source content, defaulting to concise summaries for plain read requests and clean Markdown when asked to convert, save, quote, cite, or feed downstream work. Use when users ask in any language to read, fetch, check, summarize, quote, cite, convert, or save a URL or PDF. Not for local…
docx-comment-reply
Reply to comments (批注) in Word .docx/.doc files: extract comment context, draft replies, write threaded replies back, and validate OOXML.