Xpersona
M

Minimax Monitor

CLAWHUB · Unverified

Use when (1) user says "mmx 仪表盘启动" / "mmx monitor" / "MiniMax 配额查询" / "打开 minimax 监控" and wants a real-time dashboard. (2) user wants to check how much of th...

62
Rank
84
Safety
974
Downloads

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 974 downloads reported by the source. Last updated 10/11/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Install and run

Setup complexity: low.

clawhub skill install s179qwqch3yp9926afz4rxbz0h85z9mm:minimax-monitor
  1. Install using `clawhub skill install s179qwqch3yp9926afz4rxbz0h85z9mm:minimax-monitor` in an isolated environment before connecting it to live workloads.
  2. No published capability contract is available yet, so validate auth and request/response behavior manually.
  3. Review the upstream CLAWHUB listing at https://clawhub.ai/wangjipeng977/minimax-monitor before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-wangjipeng977-minimax-monitor/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

144,855 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: minimax-monitor
description: >
  Use when (1) user says "mmx 仪表盘启动" / "mmx monitor" / "MiniMax 配额查询" / "打开 minimax 监控" and wants a real-time dashboard.
  (2) user wants to check how much of their MiniMax Token Plan quota is left (4h / 24h / weekly windows for M3 / M2.7 / video / music / image models).
  (3) user wants to test MiniMax inference latency (TTFT / P50 / burst) by clicking "开始速率测试" - explicitly opt-in, NOT background.
license: MIT
metadata:
  version: "1.7.0"
  category: dev-tools
  author: wangjipeng
  sources:
    - https://github.com/MiniMax-AI/skills
permissions:
  - read:filesystem       # ~/.mmx/config.json (v1.7.0: 按需读,不缓存)
  - write:filesystem      # history.jsonl (24h ring buffer, 本技能目录)
  - read:env               # MINIMAX_API_KEY
  - network:outbound       # api.minimaxi.com / www.minimaxi.com
  - shell:exec             # 'open' 命令启动浏览器
---

# MiniMax 套餐监控 + 速率测试中心

> **触发词**:mmx 仪表盘启动
>
> **两个职责**:
> 1. **实时配额查询** -- 60s 轮询官方 token_plan API,显示 4h / 24h / 本周用量、模型卡片、24h 趋势。
> 2. **按需速率测试** -- 用户点 "开始速率测试" 按钮才发起 5 次 chat completion 请求(约 180 token 上限),返回 TTFT / P50 / burst / token-s。
>
> 启动后自动用 `open` 命令唤起浏览器打开 `http://127.0.0.1:9877/`。

## v1.7.0 主要功能 (v1.6.7 → v1.7.0 增量)

### v1.7.0 安全加固

- 🔒 **凭证不在 server 进程内存中常驻**(v1.6.x → v1.7.0 重大变更)。每次需要 API key 的请求由 `loadKeyForRequest()` 现读 `~/.mmx/config.json`,用完即出栈,Node.js GC 一轮后释放。**进程内存 dump 拿不到完整 key**(lldb 验证: `memory find --string "sk-cp-"` 在 rw 段无命中)。
- 🔒 **`/api/load_cred` 不再写入模块作用域**。仅向前端返回"凭证已就绪"标记 + `keyLength`/`keyPrefix`(前 6 字符)。前端 `credLoaded=true` 现在是 UX 标记,不再控制权限。

### 安全 (v1.6.x 累计)

- 🔒 **本地凭证按需加载**。Server 启动**不读** `~/.mmx/config.json`。用户在仪表盘顶部点 "加载本地凭证" 按钮 + `confirm()` 二次确认后,才通过 `POST /api/load_cred` 读取 API key。Server 重启后 key 丢失(v1.7.0 起 key 也从不进 server 内存,仅磁盘上原生存在的 `~/.mmx/config.json`)。
- 🔒 **`/api/load_cred` 响应不含完整 API key**(只回 `keyLength` + `keyPrefix` 前 6 字符用于视觉确认)。
- 🔒 **`/api/load_cred` 拒绝空 Referer**,强制 `Referer` 是本机白名单 `127.0.0.1 / localhost / file://` 之一。
- 🔒 **CORS 严格**:`Access-Control-Allow-Origin` 仅放行 `127.0.0.1 / localhost / file://`。恶意网页无法跨域调本机 server 消耗你的 MiniMax 配额。
- 🔒 **速率测试按需**:`/api/probe` 不再后台定时调用。仅在用户点 "开始速率测试" 按钮时才发起 5 次 chat completion,UI 红字提示 + 二次确认。

### 配额监控

- 📊 **4 小时 / 24 小时 / 本周** 三档用量追踪(4 小时为主圆环,按用户当前 Token Plan 套餐的实际周期动态显示)。
- 🎯 **模型卡片** 区分 4h 限额 / 24h 限额 / 周无限额 / 套餐未启用(视频模型 status=3 元数据不可区分时显示 "套餐未启用 · 不可调用" 提示并排除出 4h 聚合)。
- 📈 **24 小时趋势线**:`history.jsonl` 滚动 buffer(本技能目录)记录每次 `token_plan` 调用的用量快照,前端画趋势线。

### 速率测试

- ⚡ **TTFT / P50 / 突发并发 / token·s** 四项指标,基于真实 chat completion 请求。
- ⚠️ **UI 红字 + confirm()** 提示每次测试消耗约 180 token,需用户主动确认。

### 启动

```bash
node ~/.openclaw/workspace/skills/minimax-monitor/mmx-monitor-server.js
# 浏览器访问 http://127.0.0.1:9877/
```

高级选项:

```bash
# 启用 X-MMX-API-Key header 透传(默认拒绝)
node mmx-monitor-server.js --allow-header-key
# 完全关闭速率测试端点
node mmx-monitor-server.js --no-probe
```

## Security & Data Flow

本技能默认会:

1. **按需读取本地凭证(v1.7.0: 不进内存)**:从 `~/.mmx/config.json` 读取 `api_key`(MiniMax

README.md

# MiniMax Package Monitor

[中文版](./README_zh.md)

Real-time local dashboard for monitoring MiniMax API package usage — quota tracking, on-demand rate probing, weekly usage, and 24h history.

> **Current Version: v1.7.0** | [CHANGELOG](CHANGELOG.md) | [License](LICENSE)

![Dashboard](demo.png)

![License](https://img.shields.io/badge/License-MIT-blue)

---

## Features (v1.7.0)

### Quota Monitoring

- 📊 **4-hour / 24-hour / weekly** usage windows — primary ring chart shows the user's actual Token Plan cycle
- 🎯 **Per-model cards** distinguish 4h-capped / 24h-capped / no-weekly-limit / plan-not-enabled (video) cases
- 📈 **24-hour trend line** from local `history.jsonl` ring buffer

### Rate Probing (on-demand)

- ⚡ **TTFT / P50 / burst / token·s** measurements from real chat completion requests
- ⚠️ **Button-only with confirm() dialog** — costs ~180 tokens per click, never fires automatically

### Security

- 🔒 **Credential loaded on demand, never cached** — Server does **not** auto-read `~/.mmx/config.json` and does **not** cache the key in process memory (v1.7.0+). Dashboard's "加载本地凭证" button + `confirm()` triggers `POST /api/load_cred` which authorizes the server to re-read the key from disk on every request. `lldb memory find` on the server process shows no key in writable memory regions.
- 🔒 **`/api/load_cred` response excludes the full key** — returns `keyLength` + `keyPrefix` (first 6 chars) only
- 🔒 **`/api/load_cred` rejects empty `Referer`** — must come from a local-origin page (`127.0.0.1 / localhost / file://`)
- 🔒 **CORS allowlist** — only `127.0.0.1 / localhost / file://` can reach the local server
- 🔒 **No remote key transmission** — API key never leaves the local machine

---

## Quick Start

### Prerequisites

- Node.js ≥ 18

### Run

```bash
# 1. Start backend service
node mmx-monitor-server.js

# 2. Open browser (macOS auto-opens http://127.0.0.1:9877/)
open http://127.0.0.1:9877/
# Windows / Linux: navigate to http://127.0.0.1:9877/ manually
```

### Load API Key

After the page loads, click **"加载本地凭证"** button → confirm → server is authorized to read `~/.mmx/config.json` on demand. The key is read fresh on every `/api/token_plan` / `/api/probe` call, used, then discarded by GC (never cached in process memory). Or paste your key directly into the input box for `--allow-header-key` mode.

---

## Startup Options

```bash
# Default
node mmx-monitor-server.js

# Enable X-MMX-API-Key header passthrough (advanced)
node mmx-monitor-server.js --allow-header-key

# Disable /api/probe endpoint entirely (no inference calls)
node mmx-monitor-server.js --no-probe
```

---

## Configuration

### mmx Local Config (on-demand, never cached)

The backend **does not auto-read** `~/.mmx/config.json` and **does not cache** the key in process memory. Use the dashboard's **"加载本地凭证"** button to authorize on-demand reads of `~/.mmx/config.json` (read on every request, used, discarded). The key is never held in process memory and is never writt

_meta.json

{
  "ownerId": "kn70zthc74p61mvctddrancx0s832g4r",
  "slug": "minimax-monitor",
  "version": "1.7.0",
  "publishedAt": 1783068959374
}

CHANGELOG.md

# Changelog

All notable changes to MiniMax Monitor will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.6.7] - 2026-06-30

### Bug Fix
- 🐛 "加载本地凭证" 按钮 success 判断: `d.key` → `d.loaded` (v1.6.1 加固后 server 响应不再回完整 key, 前端必须改用 `loaded` 字段判断成功)
- 🐛 前端不再持有 key: 新增 `credLoaded` boolean 标记, `fetchQuota` / `doSpeedTest` 不再传 `X-MMX-API-Key` header, server 走 `credLoadedKey` (进程变量) 读 key (与 v1.6.1 "响应不回完整 key" 加固保持一致)
- 🐛 按钮文本简化: `✅ 已加载 (sk-cp-…)` → `✅ 已加载` (按用户偏好, 不在 UI 显示 key 前缀)

### Documentation
- 🧹 bump 本地展示位 1.6.6 → 1.6.7 (Current Version / 当前版本 / ## Features / ## 功能 / ## 主要功能 / metadata.version)

## [1.6.6] - 2026-06-30

### Documentation
- 🐛 删除 SKILL.md frontmatter 顶层残留 `version: 1.6.2` 字段（ClawHub 优先解析顶层 key,导致 v1.6.3+ 发布后页面仍显示 v1.6.2）
- 🐛 同步 README.md / README_zh.md 顶部 `Current Version` / `当前版本` 行以及 `## Features` / `## 功能` 段标题随发布版本一起更新

## [1.6.5] - 2026-06-30

### Documentation
- 🐛 SKILL.md `metadata.version` 1.6.3 → 1.6.5（docs-only bump publish 链同步）

## [1.6.3] - 2026-06-30

### Security
- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)
- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded="1"` 标记让「查询」按钮识别「已加载」状态不要覆盖

## [1.6.2] - 2026-06-29

### Security
- 🐛 `/api/probe` 拒绝空 `Referer`（之前空 `Referer` 会被静默放行,绕过了本机 origin 二次确认 → curl/本机直连可直接触发真实 API 调用)
- 🐛 加载本地凭证后,API key 不再写回 `input.value`（之前 key 进入 DOM,password 字段只是 UI 遮罩,肩窥/扩展/DevTools 仍可读）——现在只存内存变量,input 显示占位符,加 `data-loaded="1"` 标记让「查询」按钮识别「已加载」状态不要覆盖

### Documentation
- 🧹 SKILL.md 删「## 更新日志」整段（v1.6.0/v1.5.0/v1.4.0/...）— ClawHub 全文渲染不再堆历史
- 🧹 SKILL.md 删 Security 重复段 + 删冗余「技能简介 / 触发词收敛 / 文件说明 / 使用方式 / 环境变量 / 注意事项」段
- 🧹 README.md / README_zh.md 重写 — 顶部「Current Version: v1.6.1」+「Features (v1.6.1)」只描述当前版本功能，不堆 Changelog 历史
- 🧹 CHANGELOG.md 重写 — 保留累积变更（行业惯例），精简每版条目、去掉审计器 finding 编号等内部叙事噪音

## [1.6.1] - 2026-06-29

### Security
- 🐛 `/api/load_cred` 响应不再返回完整 API key（只回 `keyLength` + `keyPrefix` 前 6 字符）
- 🐛 `/api/load_cred` 拒绝空 `Referer`，强制本机白名单
- 📝 SKILL.md frontmatter `permissions` 补 `write:filesystem`（声明 `history.jsonl` 写入）

### Documentation
- 🧹 清理 README 自相矛盾 — 所有"自动读取 `~/.mmx/config.json`"的旧表述统一改为"按需主动加载"叙事
- 📝 SKILL.md Security 段重写 + 加 `history.jsonl` 持久化披露 + 操作风险提示
- 📝 新增 CONTRIBUTING.md

## [1.6.0] - 2026-06-26

### Security Hardening
- 🔒 凭证按需加载 — Server 启动不读 `~/.mmx/config.json`，仪表盘点 "加载本地凭证" 按钮 + confirm 才读
- 🔒 删除浏览器 localStorage 24h 记忆 — 重启后必须重新输入或重新加载
- 🔒 速率测试改按需 — 仪表盘速率面板不再自动调用 chat completion，需用户点 "开始速率测试" 按钮 + confirm
- 🔒 删除飞书推送 — 飞书 OAuth 协议要求发 `FEISHU_APP_SECRET`，无法通过文档警示消除该风险

### Other
- 🛠 Server 直接服务 HTML（`http://127.0.0.1:9877/`），绕开 Safari `file://` fetch 报错
- 📝 SKILL.md description 改为诚实版（"套餐监控 + 速率测试"双职责）

## [1.5.1] - 2026-06-26

### Changed
- 🔒 触发词收敛为单一 `mmx 仪表盘启动`（从 4 个泛

CONTRIBUTING.md

# Contributing to `minimax-monitor`

Thank you for your interest in contributing! Please follow these steps to set up your development environment and submit changes.

## Development Setup

```bash
# 1. Fork the repository on GitHub

# 2. Clone your fork
git clone https://github.com/wangjipeng977/minimax-monitor.git
cd minimax-monitor

# 3. Install dependencies (none — pure Node.js stdlib, no npm install needed)

# 4. Run the self-audit to verify quality
python ~/.openclaw/workspace/skills/skill-factory/scripts/audit_skill.py . --hit-score
```

## Workflow

We use a standard feature branch workflow:

```bash
# 1. Create a new branch from main
git checkout -b feat/<your-feature-name>

# 2. Make your changes
#    - Follow the SKILL.md structure standards
#    - Keep SKILL.md body in English
#    - Do not hardcode API keys or secrets

# 3. Run the audit to check for issues
python scripts/audit_skill.py .

# 4. Commit your changes
git add .
git commit -m "feat(minimax-monitor): add <brief description>"

# 5. Push to your fork
git push origin feat/<your-feature-name>

# 6. Open a Pull Request on GitHub
#    - Title: feat(minimax-monitor): add <brief description>
#    - Description: What + Why + Testing
```

## Code Standards

- **SKILL.md**: Follow the YAML frontmatter standard (name, description, license, metadata)
- **Scripts**: Must include shebang, requirements.txt, and graceful error handling
- **Language**: SKILL.md body must be in English; reference docs in English
- **No secrets**: Never commit API keys, tokens, or credentials

## Quality Checklist

Before opening a PR, verify:

- [ ] `audit_skill.py` exits with code 0 or 2
- [ ] `validate_skills.py` exits with code 0
- [ ] README.md and README_zh.md are both present
- [ ] CONTRIBUTING.md is present
- [ ] .gitignore is present
- [ ] No hardcoded secrets anywhere in the codebase

## Reporting Issues

Please report issues via GitHub Issues with:

1. **What you expected to happen**
2. **What actually happened**
3. **Steps to reproduce**
4. **Environment** (OS, Python version, etc.)

## License

By contributing, you agree that your contributions will be licensed under the MIT License.

Sponsored

Ads related to Minimax Monitor and adjacent AI workflows.