Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codexnpx skills add varaprasadreddy9676/openproject-codex-plugin --skill openproject-codexgit clone --depth 1 https://github.com/varaprasadreddy9676/openproject-codex-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex)<a href="https://agentmods.dev/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex"><img src="https://agentmods.dev/badge/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.00881 |
| Opus 5 | $0.00014 | $0.00441 |
| Sonnet 5 | $0.00005 | $0.00176 |
| Haiku 4.5 | $0.00003 | $0.00088 |
Grade A, and why
openproject-codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenProject Codex
Use this plugin when the user wants to work with OpenProject from Codex instead of using the OpenProject UI.
The plugin is intended to cover common project-management actions directly and then fall back to the generic authenticated API tool for any OpenProject module that is not yet represented by a dedicated MCP tool.
Behavior
- Prefer the MCP tools from this plugin for project, team, membership, and work package operations.
- Default to the configured
OPENPROJECT_DEFAULT_PROJECTwhen present, unless the user explicitly asks for another project. - Use
openproject_connection_statusfirst if credentials or connectivity are uncertain. - If configuration is missing, use
openproject_setup_connectionto capture the base URL and API token directly from chat before attempting other actions. - Use
openproject_test_connectionoropenproject_whoamiafter setup when you need a quick verification step. - API token authentication is preferred, but UI-session authentication is supported when
OPENPROJECT_UI_USERNAMEandOPENPROJECT_UI_PASSWORDare configured. - Use
openproject_list_types,openproject_list_statuses,openproject_list_priorities, andopenproject_list_project_assigneesbefore write operations when a value needs to be discovered. - Use
assignee_name,responsible_name,status_name,priority_name, andcustomeronopenproject_create_work_packageandopenproject_update_work_packagewhen the user provides human-readable values. - Use
openproject_list_custom_field_optionsoropenproject_resolve_custom_field_optionfor Customer or other list-style custom fields instead of using the browser UI. - Use dedicated tools first for projects, users, groups, memberships, versions, categories, queries, work packages, relations, watchers, comments, documents, news, time entries, attachments, file links, boards, wiki pages, meetings, reporting, and bulk task operations.
- Prefer
openproject_my_workfor “my items” or “items assigned to me” requests. - Prefer the query tools when the user refers to saved views or wants bulk actions across a query result set.
- Prefer the bulk tools for repeated edits instead of issuing many single-item calls one by one.
- Prefer the reporting tools for workload, overdue, burndown, and project health export requests instead of assembling ad hoc summaries by hand.
- If the user needs an OpenProject action that does not yet have a dedicated tool, use
openproject_call_apiagainst the relevant/api/v3/...endpoint instead of sending the user back to OpenProject UI. - The official OpenProject
/mcpendpoint is read-only, so write operations should continue to use this plugin's API tools. - Boards, wiki pages, and meetings may use authenticated UI-backed workflows when the public API surface is incomplete; ensure the UI credential env vars are configured before relying on those tools.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 51 lines · 27 tokens per session scan A 203cb28ce2da
openproject-codex is a skill published in the GitHub repository varaprasadreddy9676/openproject-codex-plugin (0 stars, last pushed 1mo ago), licensed MIT. It adds 27 tokens to every session and 881 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
senmu-build-kernel
Senmu BuildOS 治理内核引导入口(豆包适配)。当用户开始或继续一个需要项目治理的多阶段、跨会话开发或项目管理任务,需要先明确权威项目根、owner、授权、门禁与交付证据时加载本 Skill。它提供通用治理底线和八个专业 Skill(project/product/design/workflow/engineering/delivery/assurance/learning)的路由表。豆包没有 Codex/Claude Code 的生命周期 Hook,本 Skill 以引导入口形式替代 SessionStart 内核注入。.
senmu-build-delivery
Govern development batches, non-routine Git, repository and release units, artifacts, deployment, rollback, and production state. Not for ordinary implementation.
senmu-build-engineering
Govern architecture, engineering contracts, implementation review, testing strategy, technical debt, or refactoring when project rules are missing or changing. Not for routine fixes, visual or interaction direction or prototype validation, or ordinary implementation under clear project rules.
senmu-build-product
Define durable product scope, version placement, priority, acceptance, state, and cross-page interface content. Not for one-off edits, implementation review, technical design, or deployment.
senmu-build-project
Create or repair project governance, authority mapping, structure, and durable cross-stage state. Not for routine work under an established project system.
senmu-build-learning
Review BuildOS feedback, retrospectives, verified lessons, or external guidance for reusable rules. Not for ordinary corrections, logs, or independent audits.