Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/Aditya232-rtx/Ouroboros --skill mpp-agentO comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Add security scanning to CI/CD with Fang — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.fang.ai platform (GitHub/GitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST/DAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.
Fix security vulnerabilities found by a Fang pentest (open-source CLI or app.fang.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Fang to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Fang scan reports findings, or when the user asks to remediate, patch, or fix security issues from a fang_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.
Run a managed pentest of a web app or API through the app.fang.ai REST API — no local Docker, LLM key, or install needed. Create an API token, register domain/repository assets, launch and poll scans, triage vulnerabilities, export SARIF, download PDF/DOCX pentest reports for SOC 2 and other compliance evidence (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants continuous or scheduled pentesting-as-a-service, an auditor-ready pentest report, scans tracked in a team dashboard, or security testing from a sandboxed agent/CI environment with no infrastructure.
Exibindo SKILL.md
| name | mpp-agent |
| description | Pay HTTP 402 APIs via Machine Payments Protocol (MPP). |
| version | 0.1.0 |
| author | Teknium (teknium1), Ouro |
| license | MIT |
| platforms | ["linux","macos"] |
| metadata | {"hermes":{"tags":["Payments","MPP","HTTP-402","Tempo","Stripe"],"related_skills":["stripe-link-cli","stripe-projects"]}} |
Wraps the Machine Payments Protocol (MPP, https://mpp.dev) clients so Ouro can pay for per-request API access against servers that respond with HTTP 402 Payment Required.
Three client options, all distributed via npm. Pick the lightest one that solves the user's need. Gated [linux, macos] while the broader payments tooling matures on Windows.
HTTP 402 with a www-authenticate header — and the user wants to actually pay it, not just log the response.link-cli mpp pay (see the stripe-link-cli skill).| Tool | When | Setup |
|---|---|---|
link-cli | User already has Stripe Link set up, or the 402 challenge advertises method="stripe" | see the stripe-link-cli skill |
| Tempo Wallet | MPP services with spend controls, service discovery | tempo wallet login |
| Privy Agent CLI | Multi-chain wallets, browser-based funding | privy-agent-wallets login |
| AgentCash | 300+ pre-priced APIs via one USDC.e balance | npx agentcash onboard |
mppx | Dev + debugging, smallest dep surface | npm install -g mppx then mppx account create |
Default: if the user already has Stripe Link configured or the 402 challenge specifies method="stripe", use link-cli mpp pay (the stripe-link-cli skill). Otherwise mppx for one-off paid calls and debugging, and Tempo Wallet when the user wants persistent spend controls.
PATHmppx accounthttps://tempo.xyz/SKILL.mdhttps://agents.privy.io/skill.mdhttps://agentcash.dev/skill.mdUse web_extract to fetch any of those SKILL.md files if the user picks one.
Run all commands through the terminal tool.
npm install -g mppx
mppx account create
Store the resulting account credentials wherever the CLI tells you (the CLI writes them under its own config — do not paste them into the agent transcript).
If the user gives you a URL, probe it first to confirm it actually speaks MPP:
curl -i <url>
A real MPP 402 looks like:
HTTP/1.1 402 Payment Required
www-authenticate: tempo amount=0.1 currency=...
mppx <url>
For non-GET methods or request bodies:
mppx <url> --method POST --data '<json>'
mppx handles the 402 challenge/credential dance automatically and prints the merchant's actual response on success.
mppx attaches the receipt header automatically. To inspect:
mppx <url> -v
The Tempo Wallet skill at https://tempo.xyz/SKILL.md is the canonical reference; fetch it with web_extract and follow it. Headline:
tempo wallet login
tempo wallet pay <url>
Spend controls and service discovery live in the wallet UI at https://wallet.tempo.xyz.
HTTP 402 without method="stripe" cannot be paid by Stripe Link. If the challenge advertises only Tempo / other methods, use mppx (or whichever wallet matches) — Link will reject it. Conversely, if it advertises method="stripe", prefer Link via the stripe-link-cli skill so the spend goes through the user's approved card.www-authenticate may list several methods (e.g. tempo, stripe). The Link CLI's mpp decode will pick the Stripe one; mppx will pick Tempo. There's no single "right" client — pick by which wallet the user has funded.$0.00 and just want a proof credential. These work without a funded wallet. Don't refuse them as "broken."cat/read_file them.mppx/nextjs / mppx/hono / mppx/express / mppx/elysia middlewares. A dedicated mpp-server skill may land later.mppx --version && mppx account list
Exit code 0 means installed and an account exists.