Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Sugra-Systems/sugra-api-mcp --skill envelope-attributiongit clone --depth 1 https://github.com/Sugra-Systems/sugra-api-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sugra-systems/sugra-api-mcp/envelope-attribution)<a href="https://agentmods.dev/skills/sugra-systems/sugra-api-mcp/envelope-attribution"><img src="https://agentmods.dev/badge/skills/sugra-systems/sugra-api-mcp/envelope-attribution/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sugra-systems/sugra-api-mcp/envelope-attribution"><img src="https://agentmods.dev/badge/skills/sugra-systems/sugra-api-mcp/envelope-attribution.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00388 |
| Opus 5 | $0.00023 | $0.00194 |
| Sonnet 5 | $0.00009 | $0.00078 |
| Haiku 4.5 | $0.00005 | $0.00039 |
Grade A, and why
envelope-attribution scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Envelope and attribution
Payload shapes
Most Sugra API responses are {data, meta}. Shape limit and fields on call_endpoint / fetch_data apply to data. Some payloads are envelope-less (a flat dict with _meta or meta on the same object). Provenance keys survive field projection.
meta.shaped reports what shaping actually did (fields_applied, fields_unmatched, limit_applied). It is not an echo of the request. limit bounds only the top-level list (data or a bare array), never lists nested inside records.
Time
When present, meta.data_time is the observation or publication clock of the data, not the HTTP response time. A row-level as_of is the period the figure is about. Quote both when they differ. Do not describe a delayed series as a live tick.
Attribution
Every figure needs a source and an as-of. Read them from meta / _meta and from the skill resource sugra://attribution.
- Sovereign, intergovernmental, and academic sources are named openly (for example FRED, IMF, ECB, NOAA, World Bank, SEC EDGAR).
- Commercial upstreams appear under Sugra-branded wrappers (Sugra Finance, Sugra News, Sugra Crypto, Sugra Forex, Sugra Weather). Do not substitute a commercial vendor name.
- The full source list is https://sugra.ai/sources.
This is data presentation, not investment, legal, or compliance advice. Screening tools return a signal, not a determination.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 27 lines · 45 tokens per session scan A 0084b3014d05
envelope-attribution is a skill published in the GitHub repository Sugra-Systems/sugra-api-mcp (2 stars, last pushed today), licensed MIT. It adds 45 tokens to every session and 388 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-11.
Other skills, from other repositories
webmcp-nexus
A coding guide for adding WebMCP tools to JavaScript or TypeScript projects. WebMCP lets AI agents call selected application functions through a standard interface.
unblock
Use whenever you need to read a web page, URL, article, documentation page, search result, product page or any live website content. Fetches through UnblockingAPI (unblockfetch, findtemplates) instead of the built-in WebFetch, starting with a plain fetch and rendering with a real browser only when the page needs…
dark-memory
Use for governance, memory, drift detection, and audit trail via dark-memory-mcp. Covers 52 canonical + 3 red-team tools across 16 namespaces: session lifecycle, agentmemory CRUD+search, vibe-flow spec/artifact publish + drift, LLM-as-judge, delegation+mindset, research, observability, error observatory, governance…
driving-unreal
Use when driving an Unreal Engine 5.x editor through the unreal-ai-connection MCP tools — building or populating a level, spawning/transforming actors, authoring materials and material instances, setting up lighting and atmosphere, reconstructing a scene from a reference photo, setting up a sequencer/cinematic shot…
youtube-transcripts
Read and search YouTube videos through VidWords. Use when the user supplies a YouTube URL, a bare 11-character video id, a youtu.be or Shorts link, or a channel handle, and wants any of: the transcript or subtitles (TXT/SRT/VTT), what a video says about a topic, a quote with a citable timestamp, only the words spoken…
lyrenth-web-reading
Read the content of one or many public web pages through Lyrenth, as clean Markdown instead of raw HTML. Use when the user gives a URL to read, summarize, quote, compare or extract from, or when a link needs to be opened to answer a question.