Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/timohaa/scopewalker-mcp/create-toolnpx skills add timohaa/scopewalker-mcp --skill create-toolgit clone --depth 1 https://github.com/timohaa/scopewalker-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/timohaa/scopewalker-mcp/create-tool)<a href="https://agentmods.dev/skills/timohaa/scopewalker-mcp/create-tool"><img src="https://agentmods.dev/badge/skills/timohaa/scopewalker-mcp/create-tool.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.00435 |
| Opus 5 | $0.00015 | $0.00217 |
| Sonnet 5 | $0.00006 | $0.00087 |
| Haiku 4.5 | $0.00003 | $0.00044 |
Grade A, and why
create-tool scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Create Tool
Scaffold all files for a new MCP tool following project conventions.
Workflow
1. Gather requirements
Ask the user:
- Tool name (snake_case, e.g.,
get_dependency_graph) - Description (one sentence, used in MCP tool listing)
- Input parameters (name, type, required/optional, description)
- Output shape (what the result looks like)
2. Reference existing patterns
Read docs/patterns.md for tool registration, error handling, and testing patterns. Also read an existing tool in src/tools/ as a concrete example.
3. Create files
- Types:
src/types/[concern].ts(named by domain, e.g.complexity.ts,thresholds.ts), export fromsrc/types/index.ts - Implementation:
src/tools/[toolName].tsfollowing the registration pattern - Tests:
src/tools/[toolName].test.tsusinggetToolHandler/parseContentfromsrc/testUtils/toolTestHarness.ts - Registration: add the import and
register*Tool(server)call increateServer()insrc/server.ts, and add the tool name toEXPECTED_TOOLSinsrc/server.test.ts
4. Update documentation
- Add the tool to the quick reference table in
TOOLS.md - Add detailed docs to the appropriate
docs/tools-*.mdfile - Add the tool to the list in
README.md, and bump the tool count there and indocs/tools-overview.md(both currently say 8)
5. Verify
npm run check # check:versions + lint:fix + typecheck
npm run test # all tests pass
Use check_thresholds to verify the new files are within size limits.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 46 lines · 30 tokens per session scan A a5740167dea5
create-tool is a skill published in the GitHub repository timohaa/scopewalker-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 435 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tsa-edit-then-verify
The full edit-and-verify loop mandated by CLAUDE.md and docs/agent-tooling-gap-report.md:58. Pre-edit gate (edit action=safe + baseline health action=file) → LLM edits → post-edit verify (health action=file diff + edit action=impact + scoped verificationcommand). Replaces "edit then run the whole pytest suite" (5 min)…
tsa-pr-review
AST-grounded PR / diff review. One workflow → per-file risk ranking, blast radius per changed symbol, the exact pytest command to gate merge, any architecture-constraint violations, and a final BLOCK / REVIEW / APPROVE verdict — in 1–2k tokens and 4–6 MCP calls. Goes beyond a generic LLM diff-read because only TSA's…
tsa-refactor-queue
Build a top-N prioritized refactoring queue by intersecting three signals: health grade (which files are F/D), temporal churn (which files change most often), and dead-code density (which files carry the most unreachable symbols). For each candidate the queue surfaces (a) the dimension that dragged the grade down, (b)…
tsa-temporal
Find "hot zones" — symbols modified often in recent git history that need extra review attention. Adds temporal context (modcount30d / 90d / all) to call-graph queries. Like Hebbian "fire-together-wire-together" but for code: functions that change together often deserve scrutiny together. Use when: User asks "what's…
tsa-constraints
Architectural constraint enforcement. Detect forbidden cross-module calls ("MCP must not depend on CLI") at index time and gate edits on them. Rules live in YAML at repo root; violations bubble up through edit action=safe and edit action=impact as UNSAFE verdicts. Use when: User asks "does this PR break architecture?"…
tsa-edit-safety
Pre-edit safety check using tree-sitter-analyzer. One workflow → verdict (SAFE/REVIEW/CAUTION/UNSAFE) + verification command + risk factors → ≤2k tokens, ≤3 MCP calls. Replaces 10k tokens of grep/read/git-diff exploration before touching a file. Use when: About to edit a file you haven't touched in this session…