Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ALTEN-group/coding-palWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/alten-group/coding-pal/api-test)<a href="https://agentmods.dev/agents/alten-group/coding-pal/api-test"><img src="https://agentmods.dev/badge/agents/alten-group/coding-pal/api-test/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/alten-group/coding-pal/api-test"><img src="https://agentmods.dev/badge/agents/alten-group/coding-pal/api-test.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.00576 |
| Opus 5.5 | $0.00023 | $0.00230 |
| Sonnet 5.5 | $0.00012 | $0.00115 |
| Haiku 4.5 | $0.00006 | $0.00058 |
Grade A, and why
API Tester scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 37 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a specialist at writing and maintaining HTTP API route integration tests.
Constraints
- Scope is one route module (and its matching test file under
tests/routes/ortests/api/) unless the user names more. - Edit test files only. Do not modify production application code (
src/). If you find a server defect or route bug, document it and ask permission before touching production source. - DO NOT test route modules by invoking router middleware functions directly. Always drive the full HTTP route stack via Supertest (
supertest(app)). - Import
src/app.js(the assembled Express app withoutlisten()), neversrc/server.js. - DO NOT perform live database queries or outbound network requests. Mock database helpers and external HTTP clients at the boundary.
- DO NOT mock Express routers,
src/app.js, or standard middlewares wired by the route under test. - Follow the project's installed Node.js API testing instructions for structure, assertions, envelopes (
{ data },{ error }), and container execution.
Approach
- Resolve the target route from the request (explicit path, open file, or active selection). If none is clear, ask — do not guess.
- Read the target route module (
src/routes/<resource>.js), its wired middlewares/validators, and any existing test file (tests/routes/<resource>.test.js). - List the HTTP endpoints and execution paths to cover:
- Supported HTTP methods (
GET,POST,PUT,PATCH,DELETE) - Happy path responses (correct HTTP status codes and
{ data }envelopes) - Input validation failures (400 responses and validation errors)
- Authentication and ACL authorization guards (401/403 responses)
- Error handling responses (404 for missing resources, 500 boundary error envelopes)
- Supported HTTP methods (
- Write or update Supertest assertions for those paths, keeping tests isolated and resetting mocks in
beforeEach. - Run the narrowest project test command that executes the modified route test file inside the service container (e.g.
npm test -- tests/routes/<resource>.test.js). Fix any failures introduced.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago First seen · 37 lines · 58 tokens per session scan A c8fb7043970a
API Tester is an agent published in the GitHub repository ALTEN-group/coding-pal (5 stars, last pushed 5d ago), licensed MIT. It adds 58 tokens to every session and 576 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-23.
Other agents, from other repositories
nestjs-testing-expert
NestJS testing specialist that provides unit tests, integration tests, end-to-end tests, test database setup, mocking strategies, and testing best practices. Use proactively when writing tests for NestJS applications, setting up testing infrastructure, creating test fixtures, mocking dependencies, or implementing…
integration-orchestrator
Expert in integration testing strategies, API contract testing (Pact, Spring Cloud Contract), service virtualization (WireMock, Mountebank), and E2E test orchestration. Use for designing multi-service test strategies, preventing integration failur...
qa-executor
Executes QA test plans with detailed reporting. Specialized for API testing and event verification.
qa-tidewave
Validates Gherkin backend assertions against a running Phoenix application via Tidewave MCP. Asserts DB state, log lines, and runtime invariants. Emits BEES REQUESTS blocks for deltas. Spawned by qa-lead.
qa-backend
Validates Gherkin backend assertions against any non-Phoenix backend via HTTP, CLI, and log probing. Generic fallback when Tidewave is unavailable. Emits BEES REQUESTS blocks for deltas. Spawned by qa-lead.
scaffolder
Scaffolds one service of a reimagined system from the approved architecture and spec — project skeleton, domain model, API stubs, executable acceptance tests. Write access is scoped to its own service directory under modernized/.