Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add VeloCMS/velocms-mcp --skill velocms-publishinggit clone --depth 1 https://github.com/VeloCMS/velocms-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/velocms/velocms-mcp/velocms-publishing)<a href="https://agentmods.dev/skills/velocms/velocms-mcp/velocms-publishing"><img src="https://agentmods.dev/badge/skills/velocms/velocms-mcp/velocms-publishing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/velocms/velocms-mcp/velocms-publishing"><img src="https://agentmods.dev/badge/skills/velocms/velocms-mcp/velocms-publishing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.00960 |
| Opus 5 | $0.00049 | $0.00480 |
| Sonnet 5 | $0.00020 | $0.00192 |
| Haiku 4.5 | $0.00010 | $0.00096 |
Grade A, and why
velocms-publishing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VeloCMS Publishing
Drives the velocms-mcp MCP server's tools against a VeloCMS blog's /api/v1
API. Requires the server to already be configured with VELOCMS_SITE_URL
(the tenant's blog URL) and VELOCMS_API_KEY (a Pro-plan-or-higher API key
from /admin/settings -> API Keys) — if tool calls fail with an
UNAUTHORIZED or missing-env error, tell the user to check that
configuration rather than guessing at a workaround.
Draft -> review -> publish workflow
- Check for an existing post first with
list_posts(optionallystatus: "draft") before creating a new one — avoid duplicate drafts for the same topic. - Create the draft with
create_post. Always omitstatusor passstatus: "draft"unless the user explicitly asked to publish immediately — a draft is safe to review and never appears on the live site. WritecontentHtml(plain HTML) unless the user specifically wants a TipTap ProseMirror document (contentJson). - Iterate with
update_post, passing only the fields that changed — it's a partial patch, not a full replace. Good candidates for a first pass:excerpt(shown in listings),seoTitle(<=60 chars), andseoDescription(<=160 chars) — these matter for how the post shows up in search results and social previews. - Publish with
publish_postonce the user confirms the draft looks right. This stampspublished_atand makes the post live immediately — never call it without an explicit go-ahead from the user. - To retract a live post without deleting it, use
unpublish_post(sets it back to draft). Usedelete_postonly when the user wants it gone permanently — it cannot be undone.
Other tools
get_post— fetch one post's full content (includingcontent_html) by ID, e.g. before editing something you don't already have loaded.list_media— look up existing media library items (optionally filtered by MIME type prefix, e.g."image") to reference in post content; this server has no upload tool, so link to media the user has already uploaded through the dashboard.list_comments/moderate_comment— review pending comments and set their status toapproved,pending, orspam.list_members— list subscribers (emails are masked, e.g.u***@example.com) for a quick audience snapshot; there is no tool to read a full unmasked email.get_site_settings— read the blog's name, description, and members/comments-enabled flags before writing content that assumes a particular site configuration.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 71 lines · 98 tokens per session scan A 42355f99b28c
velocms-publishing is a skill published in the GitHub repository VeloCMS/velocms-mcp (0 stars, last pushed 1mo ago), licensed MIT. It adds 98 tokens to every session and 960 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ghost-publish
Professional publishing with Ghost CMS.
wordpress-publisher
Publish posts to WordPress. Use for: publish blog post, upload to WordPress, פרסם בבלוג.
cms-metadata-tagger
Takes a finished piece of content and produces a complete, archive-ready metadata record — including descriptive tags, subject classifications, rights notes, and an archival summary — for entry into a content management or digital archive system.
cms-metadata-writer
Writes structured metadata fields — title tag, meta description, tags, category, slug, and Open Graph text — for a CMS entry, optimized for search discoverability and social sharing.
blog-cms
Sets up and integrates OpenBlog — a Git-based blog CMS module for product sites (Markdown, Next.js, theme, chrome, sitemap/RSS). Routes agents to integrate on an existing site or scaffold greenfield. Use when the user mentions blog CMS, OpenBlog, /blog on a product site, headless blog, Git-backed blog, or…
integrate-product-site
Mount OpenBlog on an existing product website — chrome, deploy patterns, brand import. PRIMARY path. Use when the user already has a main site and wants /blog or blog subdomain. Ask the user to confirm before suggesting create-openblog.