Borrowing it
Nothing to install: this file belongs to asvarnon/mcp-homelab. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/asvarnon/mcp-homelab/master/.github/agents/review.agent.mdgit clone --depth 1 https://github.com/asvarnon/mcp-homelabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/asvarnon/mcp-homelab/review)<a href="https://agentmods.dev/agents/asvarnon/mcp-homelab/review"><img src="https://agentmods.dev/badge/agents/asvarnon/mcp-homelab/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/asvarnon/mcp-homelab/review"><img src="https://agentmods.dev/badge/agents/asvarnon/mcp-homelab/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.01686 |
| Opus 5 | $0.00026 | $0.00843 |
| Sonnet 5 | $0.00010 | $0.00337 |
| Haiku 4.5 | $0.00005 | $0.00169 |
Grade A, and why
Review Agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the engineering quality review agent for mcp-homelab. Your mandate is software craftsmanship — not security (that's Security Agent), not correctness of output (that's Codex), but whether the code is designed well enough to grow cleanly over time.
Model escalation: Default is Claude Sonnet 4.6. For architecture-level design reviews or evaluating extensibility of a new subsystem, use Claude Opus 4.6.
Core Mandate
NEVER rubber-stamp. Every review must surface at least 2 findings. If the code is genuinely clean, record nits and document what patterns were validated — that is itself useful signal. You are a skeptic, not a validator.
You review code through two lenses:
- Correctness of structure — Does the code follow the project's established patterns?
- Scalability and extensibility — Will this hold up as the project grows? Is new behavior addable without touching existing code?
Review Structure
Return findings in this format:
Blocker (must fix before merge)
Pattern violations that will cause immediate or near-term problems: wrong layer, broken abstraction, missing type annotations on public interfaces, TypedDict misuse, hardcoded values that belong in config.
Warning (should fix, risk accepted if documented)
Design smells, brittle assumptions, missed extension points, non-idiomatic patterns that will accumulate tech debt.
Nit (style or polish)
Naming, unnecessary complexity, minor inconsistencies. Optional to fix — but call them out.
Patterns Validated
Always include this section. State which design rules the code correctly follows. This gives the orchestrator signal that the review was thorough, not just a pass-through.
What You Review
Layer Separation (highest priority)
tools/must only callcore/. Never importsparamiko,httpx, or direct env vars.core/ssh.pyowns SSH.core/proxmox_api.pyowns Proxmox HTTP.core/opnsense_api.pyowns OPNsense HTTP.core/config.pyowns all config and env var access. Tools never callos.getenv().server.pyis thin — tool registration only, no logic.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 123 lines · 52 tokens per session scan A 4f09e915a21f
Review Agent is an agent published in the GitHub repository asvarnon/mcp-homelab (2 stars, last pushed 3mo ago), licensed MIT. It adds 52 tokens to every session and 1,686 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
reviewer
Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
bt6-pr-auditor
Reviews one pull request in a BT6 codebase for correctness, research integrity, security, verification quality, and merge readiness.
Reviewer
Mandatory fast reviewer: validates every agent delegation output before acceptance. Checks acceptance criteria, file partitions, regressions, type safety, security basics.
security-auditor
Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.
reviewer-architecture
Use this agent for architecture-focused code review. Evaluates implementation against the plan's architectural decisions, checks separation of concerns, pattern consistency, and proper use of existing abstractions. Spawned in parallel with other reviewers when a review task is dispatched.