api-context

api-context is a skill for Claude Code from wallieinformal201/pentest-mcp-server. It costs 72 tokens per session (7,388 once invoked), scanned A, original, Apache-2.0.

A reference guide for the Context object given to every tool and resource handler in the cyanheads MCP TypeScript framework. The object carries request details and provides logging, storage, cancellation, progress, and other handler services.

In plain words
What is it for?
Use it when implementing or reviewing handlers that need logging, storage, tracing, user input, sampling, progress updates, or enrichment.
Why use it?
It explains where handlers should get request identity, tenant data, logs, state, and optional protocol features instead of managing them separately.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: mentions CLAUDE.md; mentions AGENTS.md.

Part of the @cyanheads/pentest-mcp-server plugin — 31 skills shipped together

Good fit Use it when implementing or reviewing handlers that need logging, storage, tracing, user input, sampling, progress updates, or enrichment.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/wallieinformal201/pentest-mcp-server/api-context
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add wallieinformal201/pentest-mcp-server --skill api-context
Clone the repo
git clone --depth 1 https://github.com/wallieinformal201/pentest-mcp-server

Made for: Claude Code.

Or install @cyanheads/pentest-mcp-server, the plugin that ships this one along with the rest of its 31 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for api-context

README.md
[![agentmods](https://agentmods.dev/badge/skills/wallieinformal201/pentest-mcp-server/api-context.svg)](https://agentmods.dev/skills/wallieinformal201/pentest-mcp-server/api-context)
Your own site
<a href="https://agentmods.dev/skills/wallieinformal201/pentest-mcp-server/api-context"><img src="https://agentmods.dev/badge/skills/wallieinformal201/pentest-mcp-server/api-context.svg" alt="Measured on agentmods" height="20"></a>
Per session 72 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 7,388 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00072 $0.07388
Opus 5 $0.00036 $0.03694
Sonnet 5 $0.00014 $0.01478
Haiku 4.5 $0.00007 $0.00739

Measured 6d ago against content hash 6ce6b18a1904, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

api-context scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

const response = await fetch(url, { signal: ctx.signal });
skills/api-context/SKILL.md · 638 lines

How it starts

The opening of the file, as written. The whole thing — 638 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Overview

Every tool and resource handler receives a single Context (ctx) argument. It provides request identity, structured logging, tenant-scoped storage, optional protocol capabilities (elicitation, sampling), cancellation, and task progress — all auto-correlated to the current request.

The framework auto-instruments every handler call (OTel span, duration, payload metrics). Use ctx.log for domain-specific logging and ctx.state for storage inside handlers. Use the global logger and StorageService directly only in lifecycle/background code (setup(), services).


Context interface

import type { Context } from '@cyanheads/mcp-ts-core';

interface Context {
  // Identity & tracing
  readonly requestId: string;       // Unique per request, auto-generated
  readonly timestamp: string;       // ISO 8601 request start time
  readonly tenantId?: string;       // JWT 'tid' claim; 'default' for stdio and HTTP+MCP_AUTH_MODE=none
  readonly sessionId?: string;      // Mcp-Session-Id (HTTP stateful/auto); undefined elsewhere unless opted in
  readonly traceId?: string;        // OTEL trace ID (present when OTEL enabled)
  readonly spanId?: string;         // OTEL span ID (present when OTEL enabled)
  readonly auth?: AuthContext;      // Parsed auth claims (clientId, scopes, sub)

  // Structured logging — auto-includes requestId, traceId, tenantId
  readonly log: ContextLogger;

  // Tenant-scoped key-value storage
  readonly state: ContextState;

  // Optional protocol capabilities (undefined when client doesn't support them)
  readonly elicit?: (message: string, schema: z.ZodObject<z.ZodRawShape>) => Promise<ElicitResult>;
  readonly sample?: (messages: SamplingMessage[], opts?: SamplingOpts) => Promise<CreateMessageResult>;

  // List-changed / resource-updated notifications — wired in every handler ctx;
  // delivery is request-scoped (see § list-changed notifications)
  readonly notifyResourceListChanged?: () => void;
  readonly notifyResourceUpdated?: (uri: string) => void;
  readonly notifyPromptListChanged?: () => void;
  readonly notifyToolListChanged?: () => void;

  // Cancellation
  readonly signal: AbortSignal;

  // Task progress — present only when tool is defined with task: true
  readonly progress?: ContextProgress;

  // Raw URI — present only for resource handlers
  readonly uri?: URL;

  // Agent-facing success-path enrichment — accumulates notices, query echo, totals
  // onto the request; reaches structuredContent + content[]. Always present (no-op
  // when no `enrichment` block), strictly typed on HandlerContext<R, E> against the
  // declared fields. Kind-tagged helpers: enrich.notice / .total / .echo.
  readonly enrich: Enrich;

  // Opt-in contract resolver — always present (returns {} when no contract is attached
  // or the reason is unknown), strictly typed on HandlerContext<R> against declared reasons.
  recoveryFor(reason: string): { recovery: { hint: string } } | {};
}

Read the full file on GitHub · 638 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 638 lines · 72 tokens per session scan A 6ce6b18a1904

Subscribe to this mod's changes

api-context is a skill published in the GitHub repository wallieinformal201/pentest-mcp-server (2 stars, last pushed yesterday), licensed Apache-2.0. It adds 72 tokens to every session and 7,388 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.