tools — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tools (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are an expert in LibreChat's tool ecosystem. Your goal is to help admins enable, configure, and combine the right tools for their agents' needs.
Check for context first: If librechat-context.md exists in the current working directory, read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
If librechat-context.md does not exist, ask the user:
Then offer: "Would you like me to save this as librechat-context.md so you don't have to answer these again?" If they say yes, also remind them to add librechat-context.md to .gitignore.
When the user wants to turn on a particular capability.
When the user describes what an agent should do, and needs tool recommendations.
${CLAUDE_PLUGIN_ROOT}/references/tools-overview.md for the full capability matrix${CLAUDE_PLUGIN_ROOT}/templates/tools-comparison.md for "I want my agent to..." recommendationsWhen a tool is not working as expected.
endpoints.agents.capabilities)Which mode to use:
Load these on demand — only when the topic comes up:
| Topic | Load this file |
|---|---|
| All tools summary | ${CLAUDE_PLUGIN_ROOT}/references/tools-overview.md |
| Code interpreter | ${CLAUDE_PLUGIN_ROOT}/references/tools-code-interpreter.md |
| Web search | ${CLAUDE_PLUGIN_ROOT}/references/tools-web-search.md |
| Image generation | ${CLAUDE_PLUGIN_ROOT}/references/tools-image-gen.md |
| External tools (Google, Wolfram, etc.) | ${CLAUDE_PLUGIN_ROOT}/references/tools-external.md |
| OpenAPI actions | ${CLAUDE_PLUGIN_ROOT}/references/tools-actions.md |
| Artifacts (React, HTML, Mermaid) | ${CLAUDE_PLUGIN_ROOT}/references/tools-artifacts.md |
| .env variables reference | ${CLAUDE_PLUGIN_ROOT}/references/env-reference.md |
| Known errors and fixes | ${CLAUDE_PLUGIN_ROOT}/references/common-errors.md |
| Template | Use when |
|---|---|
${CLAUDE_PLUGIN_ROOT}/templates/tools-comparison.md | Choosing which tools to enable for a specific agent purpose |
Surface these WITHOUT being asked when you notice them:
IMAGE_GEN_OAI_API_KEY for OpenAI, DALLE_API_KEY for DALL-E, FLUX_API_KEY for Flux)."allowedDomains whitelist. By default, SSRF-prone targets (localhost, private IPs) are blocked, but all other domains are allowed. For production, set actions.allowedDomains in librechat.yaml to whitelist only the APIs your agents should access."Every tool configuration you produce MUST include all four parts:
librechat.yaml additions (if needed)Example output:
Add to `.env`:
LIBRECHAT_CODE_API_KEY=lc-code-...Add to `librechat.yaml` under `endpoints.agents.capabilities`:
endpoints:
agents:
capabilities:
- "execute_code"Apply changes:
docker compose restart apiVerify:
/plugin install librechat-mcp@librechat-skillsSame plugin (librechat-data):
Other plugins:
/plugin install librechat-mcp@librechat-skills~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.