Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/stacklok/toolhive-catalog/catalog-auditnpx skills add stacklok/toolhive-catalog --skill catalog-auditgit clone --depth 1 https://github.com/stacklok/toolhive-catalogWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stacklok/toolhive-catalog/catalog-audit)<a href="https://agentmods.dev/skills/stacklok/toolhive-catalog/catalog-audit"><img src="https://agentmods.dev/badge/skills/stacklok/toolhive-catalog/catalog-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00137 | $0.02264 |
| Opus 5 | $0.00068 | $0.01132 |
| Sonnet 5 | $0.00027 | $0.00453 |
| Haiku 4.5 | $0.00014 | $0.00226 |
Grade A, and why
catalog-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Catalog audit
Audit catalog entries that are already in the registry for three kinds of drift:
- Still valid - the pinned OCI image still resolves;
repository.urlstill loads. - Still active - the upstream repo isn't archived/disabled and isn't stale.
- Still canonically correct - declared env vars and the network-permission profile match what the upstream project actually documents and requires.
This is report-only. Produce findings for a human to triage; never edit a
server.json, open a PR, or change permissions. The output is a dated markdown
report under audits/.
Checks 1 and 2 are mechanical and run via the bundled script. Check 3 needs judgment over upstream docs and is done by fanning out sub-agents. Grading rules and severity live in references/audit-criteria.md - read it before writing findings.
Step 1 - resolve scope
Infer scope from the request, don't ask for rigid flags. Map intent to a server set:
- "the community servers" / "community tier" ->
--tier community - "official servers" ->
--tier official - "the whole catalog" / "everything" ->
--tier all - "re-check X, Y, Z" / a list of names ->
--names X,Y,Z - a specific registry tree ->
--registry toolhive|official|all(defaulttoolhive)
The repo has two server trees: registries/toolhive/servers/ (contribution path,
default) and registries/official/servers/ (curated subset). Default to toolhive
unless the user clearly means otherwise.
Skills (registries/toolhive/skills/) are out of scope unless explicitly asked.
If asked, audit them separately (their packages[] carry registryType: git with a
ref/subfolder and registryType: oci images - check the git ref resolves and the
repo is active; there are no env vars or network permissions to canonicalize).
State the resolved scope and the entry count back to the user before crawling, so a mistaken scope is caught early.
Step 2 - mechanical checks (script)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 190 lines · 137 tokens per session scan A 0bbf9fb97786
catalog-audit is a skill published in the GitHub repository stacklok/toolhive-catalog (22 stars, last pushed today), licensed Apache-2.0. It adds 137 tokens to every session and 2,264 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
npm-search
Search npm packages, compare libraries, and check download stats via MCP. Use when evaluating or researching npm packages.
agent-registry
Discover, register, and hire ERC-8004 autonomous agents across 22,000+ agents on EVM + Solana. Search by capability, check on-chain reputation scores, compare agent services by category with composite scoring, browse the service catalog, enrich agent profiles, check buyer reputation, and get complete machine-readable…
opik-diagnose
Surface the Opik traces worth a developer's attention, ranked by signal — errors, failed tool calls, latency, regressions, and low online-eval scores — plus Diagnostics issues. Reads live/production traces via the SDK (searchtraces and agentinsights) and works with no MCP; uses the MCP issue entity when connected.…
client-scripts
Write ServiceNow client scripts (onLoad/onChange/onSubmit/onCellEdit) using gform, guser, GlideAjax, field visibility/mandatory toggles, and validation with debounced server calls.
agoragentic-transaction-assurance
Prepare, evaluate, and reconcile autonomous agent transactions without self-granting payment or owner authority. Use when an agent must bind principal authority, seller terms, payment evidence, execution, delivered outcome, and reconciliation; handle paid retries safely; or prepare an authority request for owner…
maya-shot-export
Pipeline stage — shot-level export: frame ranges, cameras, FBX / Alembic packaging for editorial. Use when packaging shot data for downstream departments. Not for full pipeline publish (maya-pipeline) or scene assembly (maya-scene-assembly).