Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/2fastlabs/agent-squad/customgit clone --depth 1 https://github.com/2FastLabs/agent-squadWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00011 | $0.01078 |
| Opus 5 | $0.00005 | $0.00539 |
| Sonnet 5 | $0.00002 | $0.00216 |
| Haiku 4.5 | $0.00001 | $0.00108 |
Grade A, and why
custom scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Any type that conforms to AgentProtocol is a first-class agent — the Orchestrator does not distinguish between custom and built-in agents. The protocol extension provides defaults for id, saveChat, and maxToolRounds, so a minimal implementation only needs name, description, and process.
For the full protocol definition and supporting types (AgentInput, AgentContext, AgentEvent) see the Agents overview.
Minimal example: EchoAgent
struct EchoAgent: AgentProtocol {
let name = "Echo"
let description = "Repeats the input back."
func process(
_ input: AgentInput,
history: [ConversationMessage],
context: AgentContext
) -> AsyncThrowingStream<AgentEvent, any Error> {
AsyncThrowingStream { continuation in
let text = input.text
continuation.yield(.textDelta(text))
continuation.yield(.final(ConversationMessage(role: .assistant, text: text)))
continuation.finish()
}
}
}
Register it with the orchestrator exactly like a built-in Agent:
let orchestrator = Orchestrator(
agents: [EchoAgent()],
store: myChatStorage
)
Overriding defaults
The protocol extension defaults are:
| Property | Default |
|---|---|
id |
slugify(name) |
saveChat |
true |
maxToolRounds |
1 |
Override any of them by declaring the property on your type:
struct MyAgent: AgentProtocol {
let name = "My Agent"
let description = "Does something useful."
let maxToolRounds = 10 // allow up to 10 tool-call iterations per turn
let saveChat = false // do not persist turns
func process(/* … */) -> AsyncThrowingStream<AgentEvent, any Error> { /* … */ }
}
:::caution
A custom agent that uses tools must override maxToolRounds to a value greater than 1; the default of 1 means the loop never iterates past the first model call. The built-in Agent already handles this — the caution applies only when you implement AgentProtocol directly.
:::
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 112 lines · 11 tokens per session scan A 4a09c8bb2482
custom is an agent published in the GitHub repository 2FastLabs/agent-squad (7,751 stars, last pushed 4d ago), licensed Apache-2.0. It adds 11 tokens to every session and 1,078 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pr-security-reviewer
Review a PR through a SECURITY lens — trace how every sensitive value flows from write to every reader, plus data exposure, deletion safety, credential surfaces, and injection. Read-only — never writes or edits. Reports issues with file:line citations and severity.
pr-code-reviewer
Review a PR for bugs, edge cases, security issues, dead code, and resource leaks. Read-only — never writes or edits. Reports issues with file:line citations and severity.
pr-spec-reviewer
Review a PR's implementation against a design doc the caller provides. Returns file:line citations for each decision verified, or a list of spec drifts with severity. Read-only — never writes or edits.
pr-test-reviewer
Review test adequacy for a PR — find coverage gaps, mock anti-patterns, fixture realism issues. Read-only — never writes or edits.
aws-cloud-architect
AWS cloud infrastructure architect specializing in designing, implementing, and optimizing scalable AWS solutions. Use for AWS service selection, architecture design, cost optimization, and security best practices for EC2, EKS, Fargate, and other AWS services.
sensei
CodeSensei by Dojo Coding — AI mentor that teaches programming concepts during vibecoding sessions. Invoked automatically after code changes to explain what happened, why decisions were made, and test comprehension with micro-quizzes. Adapts to the user's belt level and background. Use this agent when the user asks to…