Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add theYahia/WWmcp --skill base-discoverygit clone --depth 1 https://github.com/theYahia/WWmcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/theyahia/wwmcp/base-discovery)<a href="https://agentmods.dev/skills/theyahia/wwmcp/base-discovery"><img src="https://agentmods.dev/badge/skills/theyahia/wwmcp/base-discovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/theyahia/wwmcp/base-discovery"><img src="https://agentmods.dev/badge/skills/theyahia/wwmcp/base-discovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium analysis-evasion · line 1 Suspicious Unicode normalization or mixed-script contentFix: Review the flagged content for security risks. Ensure no credentials, secrets, or sensitive data are exposed.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00716 |
| Opus 5 | $0.00014 | $0.00358 |
| Sonnet 5 | $0.00005 | $0.00143 |
| Haiku 4.5 | $0.00003 | $0.00072 |
Grade A, and why
base-discovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/base-discovery — Что за база 1С перед нами
Первое, что делает агент на чужой базе. Ничего не пишет.
Алгоритм
get_config_preset— типовая конфигурация (УТ 11 / ERP 2 / БП 3.0 / ЗУП 3.1): подсказывает имена документов и регистров, не ходя в базу.list_entities(type — фильтр по виду сущности, search — подстрока) — список доступных в OData сущностей: Catalog_, Document_, четыре вида регистров, ChartOf*, Constant_, DocumentJournal_, Report_*.describe_entity(entity) — поля одной сущности по одной образцовой записи. Дешевле полногоget_metadata; полный EDMX бери только когда нужны типы и связи.count_entities(entity, filter) — сколько записей реально есть. Делай это до выгрузки: строить выводы по обрезанной выборке нельзя.- Точечный поиск:
find_by_description(entity, query, top) по полю Description,get_by_key(entity, ref_key, select) по GUID. - Быстрый взгляд на данные:
get_catalogs(catalog_name, filter, select, top, skip, orderby) иget_documents(document_type, filter, top, orderby). Произвольный запрос с $expand —odata_query.
Важно
- Ответы
get_catalogs/get_documents/odata_query— конверт с полями value, returned, has_more, next_skip. has_more: true = выборка неполная: итоги, суммы и «сколько всего» по ней считать нельзя. Либо страница дальше со skip: next_skip, либо сузить фильтр, либоcount_entities. - Префикс Catalog_ / Document_ можно опускать — оба варианта имени принимаются.
- Часть модулей может быть отключена через ONEC_SERVICES: если инструмента нет в списке доступных, это конфигурация сервера, а не ошибка запроса.
Формат ответа
## База 1С
**Конфигурация**: Управление торговлей 11 (по get_config_preset)
**Сущностей в OData**: 214 (справочников 96, документов 78, регистров 34)
### Ключевые документы
| Сущность | Записей |
|----------|---------|
| Document_РеализацияТоваровУслуг | 41 205 |
| Document_ПоступлениеТоваровУслуг | 12 880 |
### Поля Catalog_Контрагенты
Ref_Key, Description, ИНН, КПП, ЮридическоеФизическоеЛицо, DeletionMark
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 51 lines · 27 tokens per session scan A 2231c5b4363c
base-discovery is a skill published in the GitHub repository theYahia/WWmcp (29 stars, last pushed 4d ago), licensed MIT. It adds 27 tokens to every session and 716 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other skills, from other repositories
drizzle-orm-expert
Expert in Drizzle ORM for TypeScript — schema design, relational queries, migrations, serverless DB integration. Use when building type-safe database layers with Drizzle, migrating from Prisma, or optimizing edge runtime DB access.
supabase-schema-generator
An SRE-grade automation skill to parse SQL schemas and auto-generate safe TypeScript interfaces for the frontend and Row Level Security (RLS) policies for Supabase.
supabase
Operate Supabase via its two REST surfaces — the Management API (org/project admin) and per-project APIs (PostgREST database queries, Auth, Storage, Realtime, Edge Functions). Use when the user wants to list/create projects, fetch project API keys, or read/write their database without the MCP server installed.
database-design
Database design and optimization skill covering ER diagrams, normalization, indexing, sharding, query optimization, and database best practices. Use this skill when designing database schemas, optimizing queries, planning data architecture, or need guidance on database scaling and performance tuning.
javascript-typescript
Professional JavaScript and TypeScript development skill covering modern ES6+, TypeScript, Node.js, Express, React, testing frameworks, and best practices. Use this skill when developing JavaScript/TypeScript applications, building React/Node.js projects, implementing RESTful APIs, or need guidance on modern JS/TS…
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.