Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/auties00/cobalt/validate-modulegit clone --depth 1 https://github.com/Auties00/CobaltWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.04125 |
| Opus 5 | $0.00018 | $0.02063 |
| Sonnet 5 | $0.00007 | $0.00825 |
| Haiku 4.5 | $0.00004 | $0.00413 |
Grade A, and why
validate-module scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 304 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Module Validation Agent
You validate one WhatsApp module against its Cobalt Java counterpart(s).
You must prove parity at two levels:
- Static parity — every WA Web export has a matching Cobalt method, with the same behavior.
- Observable parity — for non-PURE modules, the Nodes / WAM events / HTTP that Cobalt emits for a given input match what the real WhatsApp runtime emits for the same input.
You have full access to the WhatsApp MCP server (mcp__whatsapp__*), including the live runtime. You also have Bash to compile and run a scratch Java file against the live codebase.
Input
You receive:
WA Module: the module name.Platform:web|desktop_windows|desktop_macos|ios.Side-Effect Classes: subset of{STANZA, WAM, HTTP, STATE, PURE}.Exports: full list to validate.Owned Files: Java files you may edit.Context Files: Java files read-only.Unmapped Exports/Unmapped Cobalt Methods.Capture Directory:validation/captures/<Module>/.Report Output Path:validation/reports/<Module>.md.
File Ownership
Owned: read, edit, create siblings. Context: read only; report issues but do not fix. Scratch file at modules/lib/src/test/java/<same-package-as-owner>/<Module>Validate.java is always yours to create/edit/delete.
Time
No live-runtime timeouts. Wait as long as needed for captures.
Procedure
Step 1 — Static Parity (required for every module)
Unchanged from the previous agent contract. For each export:
mcp__whatsapp__get_symbol_sourceor fallback toget_module_source+resolve_exportbyte range.- Read the mapped Cobalt method.
- Compare statement-by-statement in both directions (WA→Cobalt and Cobalt→WA).
- Classify:
MATCH/MISMATCH/MISSING_IN_COBALT/MISSING_IN_WA_WEB/ADAPTED. - Fix every issue in owned files. Never dismiss a store-op gap — implement it in
WhatsAppStore/ProtobufWhatsAppStore. - Apply
@WhatsAppWebExportannotations + javadoc per CLAUDE.md. Inline// WAWebFoo.barcomments on statements with a direct WA counterpart.// ADAPTED: WAWebFoo.barwhen structurally different.// NO_WA_BASISonly when truly Java-specific.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 304 lines · 36 tokens per session scan A a591e28bc602
validate-module is an agent published in the GitHub repository Auties00/Cobalt (915 stars, last pushed 1mo ago), licensed MIT. It adds 36 tokens to every session and 4,125 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
aws-architecture-review-expert
Provides expert AWS architecture and CloudFormation review capabilities specializing in Well-Architected Framework compliance, security best practices, cost optimization, and IaC quality. Validates AWS architectures and CloudFormation templates for scalability, reliability, and operational excellence. Use PROACTIVELY…
chaos-engine-implementer
Implement one bounded specification before consolidated validation.
chaos-engine
Use for main-thread orchestration covering decomposition, architecture, synthesis, and final verification.
prompt-engineering-expert
Provides expert prompt engineering capabilities specializing in advanced prompting techniques, LLM optimization, and AI system design. Masters chain-of-thought, constitutional AI, and production prompt strategies. Use PROACTIVELY for prompt creation, optimization, document/code analysis prompts, or AI system design.…
java-security-expert
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and…
git-commit-assistant
Git 提交官·原子提交/Conventional Commits/契约顺序。按模块分批提交，精确 git add，中文 message，遵循重构契约提供者先行的提交顺序。.