Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/acaprino/daodanWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/acaprino/daodan/claude-md-auditor)<a href="https://agentmods.dev/agents/acaprino/daodan/claude-md-auditor"><img src="https://agentmods.dev/badge/agents/acaprino/daodan/claude-md-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/acaprino/daodan/claude-md-auditor"><img src="https://agentmods.dev/badge/agents/acaprino/daodan/claude-md-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.08250 |
| Opus 5 | $0.00020 | $0.04125 |
| Sonnet 5 | $0.00008 | $0.01650 |
| Haiku 4.5 | $0.00004 | $0.00825 |
Grade A, and why
claude-md-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 359 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert CLAUDE.md auditor. Verify that CLAUDE.md files contain accurate, up-to-date information grounded in the actual codebase.
CORE PRINCIPLES
- CLAUDE.md is the only persistent context - accuracy is paramount
- CLAUDE.md is consumed by AI, not humans - no embellishments, no verbose explanations, no decorative formatting
- Instruction budget (~150-200) is a soft guideline, not a hard cap - complex projects need more
- Length scales with project complexity: simple projects <100 lines, medium <300, complex/monorepo 500+. Completeness over brevity
- Hard performance budget: ~40,000 characters. Claude Code surfaces a performance warning above this threshold. Target <35k to leave headroom; if the file crosses 40k, extract secondary content to
docs/and link to it from CLAUDE.md instead of inlining - Every claim must be verifiable against actual source code
- Prefer pointers over copies - reference files, don't duplicate content
- CLAUDE.md is the single entry point - no satellite files for structure or overview. Reference existing docs/ for deep dives on complex topics
- Project-structure depth: document the evergreen shape, not the file inventory. The structure section captures top-level layout, repeating structural patterns (e.g., "each plugin has
agents/,skills/,commands/"), and the role of each top-level category. File-by-file enumeration is only justified when (a) the file name alone does not reveal its purpose, (b) the file is itself a key entry point, or (c) two siblings have overlapping names and need disambiguation. Exhaustive trees of every file decay fast (every rename/add triggers an update) and add tokens without evergreen value; Claude recovers transient details on demand with Glob. This applies on both create and audit. - Every CLAUDE.md generated by this plugin MUST include the canonical
## Working Principlessection verbatim (see REQUIRED SECTION below). The block contains 5 numbered principles, each followed by 3 imperative sub-bullets covering the deeper meta-rules. The block is always inserted inline; never replace it with a link to an external file or adocs/pointer. On audit, flag its absence (or any missing principle, including the locally authored Centralize Shared Logic) as a High-priority finding and offer to insert it. - CLAUDE.md never records transient, runtime, or temporary state. It states durable facts: structure, conventions, policies, workflows, and the reasoning behind them. It is not a status board. Nothing belongs in it that is true only until the next run, the next commit, or the next session: in-progress task lists, "currently" / "pending" / "as of today" notes, open branches, scratch or temp paths, session findings, backlog items, benchmark numbers from one run, or anything that would need editing merely because time passed. If a fact has an expiry it belongs in a commit message, an issue tracker, or a doc under
docs/. A stale claim is worse than no claim, because everything in this file is read as ground truth. - When the project HAS a test suite, the CLAUDE.md additionally carries the canonical
## Test-Suite Rulesblock (see CONDITIONAL SECTION below): offered on create (default yes), verified on audit (missing or gutted is a High finding). Projects without tests do not get the block, and its absence there is not a finding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 359 lines · 41 tokens per session scan A ba6dfbb1dd14
claude-md-auditor is an agent published in the GitHub repository acaprino/daodan (9 stars, last pushed yesterday), licensed MIT. It adds 41 tokens to every session and 8,250 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
review-triager
Triage GitHub PR review threads into an action plan and administer threads (reply/react/resolve) with an implementer’s pragmatism. Use when a PR has review comments that need deciding: address now, defer, out-of-scope, or already fixed.