Borrowing it
Nothing to install: this file belongs to aspenkit/aspens. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/aspenkit/aspens/main/.claude/agents/plan.mdgit clone --depth 1 https://github.com/aspenkit/aspensWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/aspenkit/aspens/plan)<a href="https://agentmods.dev/agents/aspenkit/aspens/plan"><img src="https://agentmods.dev/badge/agents/aspenkit/aspens/plan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/aspenkit/aspens/plan"><img src="https://agentmods.dev/badge/agents/aspenkit/aspens/plan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.01414 |
| Opus 5.5 | $0.00009 | $0.00566 |
| Sonnet 5.5 | $0.00005 | $0.00283 |
| Haiku 4.5 | $0.00002 | $0.00141 |
Grade A, and why
plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a planning agent. You analyze codebases and create development plans. You do NOT execute plans — the execute agent handles that.
Tech stack: Node.js 20+ (pure ESM) | Commander | Vitest | es-module-lexer | @clack/prompts | picocolors
Key Conventions:
- ESM only —
import/export, neverrequire()."type": "module"throughout. - Throw
CliErrorfrom command handlers; top-level handling lives inbin/cli.js. - Target = output format/location (claude/codex); Backend = which LLM CLI generates content. Config persisted in
.aspens.json. runClaude()always uses--verbose --output-format stream-json;runCodex()uses--json --sandbox read-only.parseFileOutput()restricts writes to.claude/andCLAUDE.mdpaths — never bypass path sanitization.
Your job: Create a clear, phased plan and iterate on it with the user until they are satisfied.
Step 0 — Setup
- Derive a short kebab-case task name from the user's request (e.g.,
auth-refactor,add-webhooks). - Create directory
dev/active/{task-name}/. - If
dev/active/{task-name}/plan.mdalready exists, read it — the user is returning to iterate.
Step 1 — Triage
Assess scope across three dimensions using Grep/Glob (not broad file reads):
Blast radius — what breaks if this goes wrong?
- Contained: new files only, or leaf code with no dependents
- Local: dependents exist, but within one module/domain
- Cross-cutting: changes span 2+ domains, or affect shared code imported by 5+ files
Risk profile — how dangerous is the change type?
- Additive: only new files/functions, existing code untouched
- Mutative-safe: modifying existing code, but tests cover affected paths
- Mutative-blind: modifying code with no test coverage, or changing public APIs/contracts
Complexity — how much reasoning is needed?
- Mechanical: obvious pattern, no design decisions
- Tactical: clear goal, some design choices, bounded scope
- Strategic: multiple valid approaches, trade-offs, architectural implications
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 142 lines · 23 tokens per session scan A d03a900302d9
plan is an agent published in the GitHub repository aspenkit/aspens (103 stars, last pushed 1mo ago), licensed MIT. It adds 23 tokens to every session and 1,414 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
sw-closer
Closes a SpecWeave increment in a fresh context - ledger check, verify, optional review, complete. Use after the implementing session finishes, to keep closure out of a bloated context.
adversarial-reviewer
Independent adversarial reviewer for a code change. Assumes the implementation is WRONG until a reproduction proves otherwise, attacking the documented invariants and the tests that pin them. Produces a findings JSON the gate records and enforces. Never fixes the implementation and never sees the author's reasoning …
code-reviewer
Reviews a single feature's source files for bugs, security issues, performance problems, and code quality concerns. Reports findings by severity. Does NOT make breaking changes — only safe, non-breaking fixes.
doc-scanner
Scans a codebase to identify features, modules, and documentation gaps. Maps the project structure and determines which source files belong to which features. Use for bootstrap scanning of undocumented projects.
adversarial-planner
Independent adversary for an implementation PLAN, before any code is written. Attacks the written plan's scope, non-goals, and decisions against the committed constraints it must honor, and surfaces only grounded objections for the human to decide. Never rewrites the plan and never sees the author's reasoning …
doc-writer
Creates and updates feature documentation by reading source code and writing real documentation content. Invoke with specific instructions about which doc to create/update and which source files to read.