Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vodailocz/kilo-kit-mcp/api-patternsnpx skills add VoDaiLocz/kilo-kit-mcp --skill api-patternsgit clone --depth 1 https://github.com/VoDaiLocz/kilo-kit-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vodailocz/kilo-kit-mcp/api-patterns)<a href="https://agentmods.dev/skills/vodailocz/kilo-kit-mcp/api-patterns"><img src="https://agentmods.dev/badge/skills/vodailocz/kilo-kit-mcp/api-patterns.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.00581 |
| Opus 5 | $0.00014 | $0.00291 |
| Sonnet 5 | $0.00006 | $0.00116 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
api-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to api-patterns — 8 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Patterns
API design principles and decision-making for 2025. Learn to THINK, not copy fixed patterns.
🎯 Selective Reading Rule
Read ONLY files relevant to the request! Check the content map, find what you need.
📑 Content Map
| File | Description | When to Read |
|---|---|---|
api-style.md |
REST vs GraphQL vs tRPC decision tree | Choosing API type |
rest.md |
Resource naming, HTTP methods, status codes | Designing REST API |
response.md |
Envelope pattern, error format, pagination | Response structure |
graphql.md |
Schema design, when to use, security | Considering GraphQL |
trpc.md |
TypeScript monorepo, type safety | TS fullstack projects |
versioning.md |
URI/Header/Query versioning | API evolution planning |
auth.md |
JWT, OAuth, Passkey, API Keys | Auth pattern selection |
rate-limiting.md |
Token bucket, sliding window | API protection |
documentation.md |
OpenAPI/Swagger best practices | Documentation |
security-testing.md |
OWASP API Top 10, auth/authz testing | Security audits |
🔗 Related Skills
| Need | Skill |
|---|---|
| API implementation | @[skills/backend-development] |
| Data structure | @[skills/database-design] |
| Security details | @[skills/security-hardening] |
✅ Decision Checklist
Before designing an API:
- Asked user about API consumers?
- Chosen API style for THIS context? (REST/GraphQL/tRPC)
- Defined consistent response format?
- Planned versioning strategy?
- Considered authentication needs?
- Planned rate limiting?
- Documentation approach defined?
❌ Anti-Patterns
DON'T:
- Default to REST for everything
- Use verbs in REST endpoints (/getUsers)
- Return inconsistent response formats
- Expose internal errors to clients
- Skip rate limiting
DO:
- Choose API style based on context
- Ask about client requirements
- Document thoroughly
- Use appropriate status codes
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 82 lines · 28 tokens per session scan A d8c2cbe8a096
api-patterns is a skill published in the GitHub repository VoDaiLocz/kilo-kit-mcp (27 stars, last pushed 2d ago), licensed Apache-2.0. It adds 28 tokens to every session and 581 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to api-patterns, differing in 8 lines, and is treated as a copy.
Other skills, from other repositories
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
nw-ddd-eventsourcing
Event Sourcing and CQRS as DDD implementation patterns — when to use, aggregate event streams, projections, snapshots, sagas, upcasting, conflict resolution.
nw-fp-clojure
Clojure language-specific patterns, data-first modeling, REPL-driven development, and spec.
codex
Run benchmark-selected GPT-5.6 work through the Codex CLI.
video-assets
Use when publishing, replacing, auditing, or linking cctop promo/demo video assets through GitHub Releases, especially the non-latest media-assets release. Trigger for requests like "upload the launch video", "add another video asset", "replace the README demo video", "where should this video live", "update…
voice-writer
Unified voice content generation pipeline with mandatory validation and joy-check. 13-phase pipeline: LOAD, GROUND, STATS-CHECKPOINT, GENERATE, HOOK-GATE, VALIDATE, REFINE, VARIETY-GATE, JOY-CHECK, ANTI-AI, CLOSE-GATE, OUTPUT, CLEANUP. Use when writing articles, blog posts, or any content that uses a voice profile.…