Coral is a local application that gives AI agents one SQL interface for querying connected APIs, files, and live data sources. It is for agents and developers who need to retrieve and correlate data across sources while reducing repeated tool calls, pagination, and source-specific integration code. Coral exposes its query interface to compatible agents through MCP, and the catalogue add-ons support using it in agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add withcoral/coral --skill coral-create-source-specgit clone --depth 1 https://github.com/withcoral/coralWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/withcoral/coral/coral-create-source-spec)<a href="https://agentmods.dev/skills/withcoral/coral/coral-create-source-spec"><img src="https://agentmods.dev/badge/skills/withcoral/coral/coral-create-source-spec/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/withcoral/coral/coral-create-source-spec"><img src="https://agentmods.dev/badge/skills/withcoral/coral/coral-create-source-spec.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 96 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 268 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.03876 |
| Opus 5 | $0.00030 | $0.01938 |
| Sonnet 5 | $0.00012 | $0.00775 |
| Haiku 4.5 | $0.00006 | $0.00388 |
Grade A, and why
coral-create-source-spec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 308 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Coral Create Source Spec
Use this skill when the task is to author or repair a Coral source spec.
Goal
Produce a valid, queryable Coral source spec that works with:
coral source lint <path>coral source add --file <path>coral source test <name>coral sqlcoral.tablesandcoral.columnscoral.inputsfor source variables and secrets
Default Mode
Default to standalone source authoring for external developers.
That means:
- create a YAML source spec file
- lint it early with
coral source lint <path> - add it to Coral with
coral source add --file <path>when you need to exercise it as a source - validate by querying it
- iterate until the shape is correct
Only switch to Coral repo layout when the user is explicitly editing the Coral repo.
Output Modes
- External authoring:
- create a standalone source spec such as
./my-source.yaml - validate structure with
coral source lint ./my-source.yaml - load it with
coral source add --file ./my-source.yamlwhen you need to query it through Coral
- create a standalone source spec such as
- Coral repo contribution:
- write community source specs to
sources/community/<name>/manifest.yaml - write core source specs to
sources/core/<name>/manifest.yamlonly when the user is intentionally changing bundled core sources - add representative
test_queriesfor a basic smoke/connection check of the source - validate with
coral source test <name>and repo checks
- write community source specs to
Workflow
- Read the provider API docs or inspect the local dataset.
- Start with one small table and a few columns.
- Define:
- source metadata
- backend
- base URL or file location
- auth
- variables and secrets
- credential retrieval methods for secrets, including OAuth when the provider supports browser-based setup
- if authoring a separate
kind: identitymanifest, identity setup inputs and OAuth method config - tables
- table functions for source-scoped parameterized endpoints
- filters
- response extraction
- pagination
- typed columns
- Lint the source spec:
coral source lint <path>
- Validate the source in the right mode:
- standalone specs:
coral source add --file <path>and inspect withcoral sql coral source addis non-interactive by default: each inputkeyis read from the matching environment variable. Export required variables and secrets before running, or pass--interactiveto be prompted.- for OAuth credential methods, run
coral source add --interactive --file <path>with no environment value for the target secret so Coral offers the authored credential choices - repo sources or already-named sources:
coral source test <name>
- standalone specs:
- Inspect the exposed shape:
- inspect
coral.tablesfor visible tables, descriptions, guides, and required filters; keep metadata queries bounded withLIMIT/OFFSET - inspect
coral.table_functionsfor source-scoped functions, descriptions, guides, arguments, result columns, kind, and search limits - inspect
coral.columnsfor canonical column metadata, includingis_virtualandis_required_filter; filter by one table or page large column sets - inspect
coral.filtersfor normalized table filter names, types, modes, required flags, and descriptions - inspect
coral.inputsto verify variables, secrets, defaults, hints, and required flags
- inspect
- Query representative tables with
coral sql. - If you are relying on
coral source test, make suretest_queriesgives you a basic smoke/connection check for the source. - Refine the spec and repeat.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed 18dd5afdbb6c
- 11d ago First seen · 308 lines · 59 tokens per session scan A 35f3549a0a1b
coral-create-source-spec is a skill published in the GitHub repository withcoral/coral (4,951 stars, last pushed today), licensed Apache-2.0. It adds 59 tokens to every session and 3,876 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gemini-api-agent-platform
Guides the usage of the Gemini API on Agent Platform with the Google Gen AI SDK for enterprise AI applications. Covers SDK usage (Python, JS/TS, Go, Java, C#), capabilities like Live API, tools, multimedia generation, caching, and batch prediction.
open-source
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browseruse, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle…
deepstream-sop
Use this skill when building, deploying, evaluating, debugging, or measuring latency for the DeepStream SOP Inference Microservice — a GPU-accelerated FastAPI service that detects whether operators perform assembly-line steps in order via event boundary detection (GEBD) plus VLM classification. Trigger even if the…
gemini-api-dev
Use this skill when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, video generation, streaming responses, background research tasks, function calling, structured output, or migrating from the old generateContent API. Covers SDK usage and best…
azure-search-documents-dotnet
Azure AI Search SDK for .NET (Azure.Search.Documents). Use for building search applications with full-text, vector, semantic, and hybrid search. Covers SearchClient (queries, document CRUD), SearchIndexClient (index management), and SearchIndexerClient (indexers, skillsets). Triggers: "Azure Search .NET"…
azure-search-documents-ts
Build search applications using Azure AI Search SDK for JavaScript (@azure/search-documents). Use when creating/managing indexes, implementing vector/hybrid search, semantic ranking, or building agentic retrieval with knowledge bases.