Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/2fastlabs/agent-squad/overviewgit clone --depth 1 https://github.com/2FastLabs/agent-squadWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.01338 |
| Opus 5 | $0.00008 | $0.00669 |
| Sonnet 5 | $0.00003 | $0.00268 |
| Haiku 4.5 | $0.00002 | $0.00134 |
Grade A, and why
overview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agents are the unit of work in AgentSquad. Each agent owns its LLM call and tool-use loop; the Orchestrator decides which agent handles a given turn and manages chat persistence.
AgentProtocol
Every agent conforms to AgentProtocol:
public protocol AgentProtocol: Sendable {
var id: String { get } // storage namespace + classifier key; defaults to slugify(name)
var name: String { get }
var description: String { get }
var saveChat: Bool { get } // orchestrator persists turns; defaults to true
var maxToolRounds: Int { get } // tool-loop cap; defaults to 1
func process(
_ input: AgentInput,
history: [ConversationMessage],
context: AgentContext
) -> AsyncThrowingStream<AgentEvent, any Error>
}
The protocol extension provides default implementations for id, saveChat, and maxToolRounds, so a minimal custom agent only needs to implement name, description, and process.
| Property | Default | Notes |
|---|---|---|
id |
slugify(name) |
Used as the storage namespace and classifier routing key. |
saveChat |
true |
Set to false to opt the agent out of chat persistence. |
maxToolRounds |
1 |
Override to allow a tool-use loop. A tool-bearing agent that leaves this at 1 will never iterate past the first model call. |
AgentInput
public enum AgentInput: Sendable {
case text(String)
}
A convenience property surfaces the string without a pattern match:
let text = input.text // "" when the case is not .text
:::note
AgentInput covers turn-based text only. Continuous audio is handled by VoiceAssistant and its RealtimeEvent stream — not by AgentProtocol.
:::
AgentContext
Carries per-turn identity, arbitrary params, and the live trace span:
public struct AgentContext: Sendable {
public let userId: String
public let sessionId: String
public let params: [String: JSONValue]
public let span: (any SpanHandle)?
public init(
userId: String,
sessionId: String,
params: [String: JSONValue] = [:],
span: (any SpanHandle)? = nil
)
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 138 lines · 16 tokens per session scan A 22ad567ef33d
overview is an agent published in the GitHub repository 2FastLabs/agent-squad (7,751 stars, last pushed 4d ago), licensed Apache-2.0. It adds 16 tokens to every session and 1,338 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pr-security-reviewer
Review a PR through a SECURITY lens — trace how every sensitive value flows from write to every reader, plus data exposure, deletion safety, credential surfaces, and injection. Read-only — never writes or edits. Reports issues with file:line citations and severity.
pr-code-reviewer
Review a PR for bugs, edge cases, security issues, dead code, and resource leaks. Read-only — never writes or edits. Reports issues with file:line citations and severity.
pr-spec-reviewer
Review a PR's implementation against a design doc the caller provides. Returns file:line citations for each decision verified, or a list of spec drifts with severity. Read-only — never writes or edits.
pr-test-reviewer
Review test adequacy for a PR — find coverage gaps, mock anti-patterns, fixture realism issues. Read-only — never writes or edits.
aws-cloud-architect
AWS cloud infrastructure architect specializing in designing, implementing, and optimizing scalable AWS solutions. Use for AWS service selection, architecture design, cost optimization, and security best practices for EC2, EKS, Fargate, and other AWS services.
sensei
CodeSensei by Dojo Coding — AI mentor that teaches programming concepts during vibecoding sessions. Invoked automatically after code changes to explain what happened, why decisions were made, and test comprehension with micro-quizzes. Adapts to the user's belt level and background. Use this agent when the user asks to…