http-server

http-server is a skill for Claude Code, Codex from sparq-org/sparq. It costs 252 tokens per session (42,702 once invoked), scanned D, original, MIT.

An HTTP server that exposes a SPARQL graph, a database of linked data, so programs can query and update it over standard web requests.

In plain words
What is it for?
Use it to serve SPARQL queries and updates, read or write graph data over HTTP, stream subscriptions, monitor the service, and optionally enable compression, facets, time travel, or GeoSPARQL.
Why use it?
It lets applications use the graph remotely through familiar HTTP protocols instead of embedding the query engine in every application. It also supports persistence and health or metrics endpoints.

Skill for Claude CodeCodex

Part of the sparq plugin — 35 skills, 20 agents, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/sparq-org/sparq/http-server
Any agent
npx skills add sparq-org/sparq --skill http-server
Clone the repo
git clone --depth 1 https://github.com/sparq-org/sparq

Made for: Claude Code, Codex.

Or install sparq, the plugin that ships this one along with the rest of its 35 skills, 20 agents, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for http-server

README.md
[![agentmods](https://agentmods.dev/badge/skills/sparq-org/sparq/http-server.svg)](https://agentmods.dev/skills/sparq-org/sparq/http-server)
Your own site
<a href="https://agentmods.dev/skills/sparq-org/sparq/http-server"><img src="https://agentmods.dev/badge/skills/sparq-org/sparq/http-server.svg" alt="Measured on agentmods" height="20"></a>
Per session 252 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 42,702 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00252 $0.42702
Opus 5 $0.00126 $0.21351
Sonnet 5 $0.00050 $0.08540
Haiku 4.5 $0.00025 $0.04270

Measured today against content hash 167c60a32b0c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

http-server scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

curl -X POST -H 'Authorization: Bearer <TOKEN>' --data-binary @snapshot.spqb http://127.0.0.1:3030/admin/restore

Cloud metadata endpointhighServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

> the `169.254.169.254` cloud-metadata IP). The allowlist is enforced before any socket is

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl --compressed -G http://127.0.0.1:3030/sparql \
skills/http-server/SKILL.md · 1,948 lines

How it starts

The opening of the file, as written. The whole thing — 1,948 lines — stays where its author put it; the contents beside it link to each section on GitHub.

sparq-http-server

sparq-server is a W3C-conformant HTTP server (axum/tokio) that exposes the sparq query engine over a sparq_core::Graph — in-memory by default, or durable on disk with --persist DIR (updates WAL-fsync'd, survive a restart with no rebuild; see the "Durability" gotcha). It implements the SPARQL 1.1 Protocol (query + update at /sparql) and the Graph Store HTTP Protocol (read + write), with Accept-driven content negotiation, hardening guards, Prometheus /metrics, WebSocket + SSE subscriptions, and opt-in grouped facet counts, prefix completion, time-travel, and GeoSPARQL.

Build with the default-off response-compression feature to negotiate gzip or zstd for outbound result bodies from Accept-Encoding. Compression is transport-transparent and streaming; SSE subscription responses and bodies that already have a Content-Encoding are left uncompressed:

cargo run -p sparq-server --features response-compression
curl --compressed -G http://127.0.0.1:3030/sparql \
  --data-urlencode 'query=SELECT * WHERE { ?s ?p ?o }'

Quickstart

Run the binary (server stack is the default-on server feature):

# serve a Turtle file on the default address 127.0.0.1:3030 (loopback — safe default)
cargo run -p sparq-server -- --format turtle data.ttl
# no data file => empty default graph (still answers queries, just no rows)
cargo run -p sparq-server
# custom bind addr / format (turtle | ntriples | nquads | trig). A NON-loopback bind
# (e.g. 0.0.0.0) is REFUSED unless --allow-remote / SPARQ_ALLOW_REMOTE=1 (no auth — see below).
cargo run -p sparq-server -- --addr 0.0.0.0:8080 --allow-remote --format ntriples data.nt

Opt-in HTTP/2 switches the TCP listener from its default HTTP/1.1-only builder to the hyper-util h1+h2 auto builder. With no certificate flags it accepts HTTP/1.1 and cleartext h2c; supplying both PEM paths enables TLS 1.3 with ALPN h2,http/1.1:

cargo run -p sparq-server --features http2 -- data.ttl \
  --tls-cert ./cert.pem --tls-key ./key.pem

Read the full file on GitHub · 1,948 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed 167c60a32b0c
  2. 4d ago First seen · 1,948 lines · 252 tokens per session scan D 22c51b0097c7

Subscribe to this mod's changes

http-server is a skill published in the GitHub repository sparq-org/sparq (10 stars, last pushed today), licensed MIT. It adds 252 tokens to every session and 42,702 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it D with 3 findings (sends data to an external url, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

instrument-data-to-allotrope

Convert laboratory instrument output files (PDF, CSV, Excel, TXT) to Allotrope Simple Model (ASM) JSON format or flattened 2D CSV. Use this skill when scientists need to standardize instrument data for LIMS systems, data lakes, or downstream analysis. Supports auto-detection of instrument types. Outputs include full…

anthropics/knowledge-work-plugins · 123 tokens

exploratory-data-analysis

Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…

K-Dense-AI/scientific-agent-skills · 83 tokens

media-ingest

Ingest video, audio, PDF, book, screenshot, and GitHub repo content into the brain. Multi-format handling with entity extraction and backlink propagation. Covers video-ingest, youtube-ingest, and book-ingest subtypes.

garrytan/gbrain · 52 tokens

feishu

Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.

Hmbown/CodeWhale · 33 tokens

read

Reads URLs and PDFs by fetching source content, defaulting to concise summaries for plain read requests and clean Markdown when asked to convert, save, quote, cite, or feed downstream work. Use when users ask in any language to read, fetch, check, summarize, quote, cite, convert, or save a URL or PDF. Not for local…

tw93/Waza · 78 tokens

docx-comment-reply

Reply to comments (批注) in Word .docx/.doc files: extract comment context, draft replies, write threaded replies back, and validate OOXML.

foryourhealth111-pixel/Vibe-Skills · 39 tokens