Coral is a local application that gives AI agents one SQL interface for querying connected APIs, files, and live data sources. It is for agents and developers who need to retrieve and correlate data across sources while reducing repeated tool calls, pagination, and source-specific integration code. Coral exposes its query interface to compatible agents through MCP, and the catalogue add-ons support using it in agent workflows.
Borrowing it
Nothing to install: this file belongs to withcoral/coral. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/withcoral/coral/main/.agents/skills/add-recipe/SKILL.mdgit clone --depth 1 https://github.com/withcoral/coralWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/withcoral/coral/add-recipe)<a href="https://agentmods.dev/skills/withcoral/coral/add-recipe"><img src="https://agentmods.dev/badge/skills/withcoral/coral/add-recipe/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/withcoral/coral/add-recipe"><img src="https://agentmods.dev/badge/skills/withcoral/coral/add-recipe.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01569 |
| Opus 5.5 | $0.00009 | $0.00628 |
| Sonnet 5.5 | $0.00004 | $0.00314 |
| Haiku 4.5 | $0.00002 | $0.00157 |
Grade A, and why
add-recipe scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Write a Provider Recipe for the service the user names. A recipe states facts about one Upstream Service (its source, how to authenticate, its inputs and servers) so Reef can pre-fill Provider Setup. It lives at apps/reef/recipes/<id>/recipe.yaml, with an optional icon beside it.
Before you start, read:
GLOSSARY.md, the Provider Recipe entry.- ADRs 0002, 0003 and 0004 in
docs/adr/. apps/reef/recipes/schema.json: the recipe format. Itsdescriptionfields are the field docs.- Example recipes:
linear(MCP, OAuth discovery),github(OpenAPI, device code, public client) andsentry(region input, owner-configured client, servers).
1. Check the id
Derive the id from the service name: lowercase, [a-z][a-z0-9_]*. If apps/reef/recipes/<id>/ exists, stop and ask the user whether to update that recipe or pick a new id.
2. Find a source
Coral reads two kinds of source:
- An OpenAPI 3.0 or 3.1 document, fetched once from a URL without following redirects. Swagger 2.0 fails.
- An MCP server over Streamable HTTP. Standalone SSE and stdio servers fail.
Search the vendor's official docs for both. Record the URL of every doc page you rely on; the PR description cites them.
Done when you hold at least one usable source URL, or have reported that none exists.
3. Plan, then wait
Show the user a short plan and wait for their approval. Cover each point:
- Recipes and ids. One source: use the bare id. OpenAPI and MCP both: offer two recipes,
<id>for OpenAPI and<id>_mcpfor MCP. Give both the samedisplay_nameand setservice: <id>in the MCP recipe, so the catalog shows both on one card and suggests one namespace (asgithub_mcpdoes). A self-hosted edition with its own host: offer<id>_self_hostedas well. - Source URLs, and for a third-party document, the audit result and why you pinned it or not.
- Authentication options and the
default(see below). - Scopes for each OAuth option, or why it names none.
- Inputs and servers, e.g. a region.
- Icon source.
- Gaps: anything the format cannot express.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -9 lines 9125154c2596
- 8d ago First seen · 112 lines · 22 tokens per session scan A 70c259ad83f8
add-recipe is a skill published in the GitHub repository withcoral/coral (4,938 stars, last pushed today), licensed Apache-2.0. It adds 22 tokens to every session and 1,569 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-13.
Other skills, from other repositories
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
insight-error-page
Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…
next-cache-components-optimizer
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route and entry point at a time; the shipped test then guards…