What is gov-reviewer?

A pre-implementation reviewer for software used by federal, state, or local governments. It covers government-specific authorization, security controls, accessibility, privacy assessments, and law-enforcement data requirements.

Use it for government SaaS, login.gov or similar identity integrations, and public-sector sales. It reviews FedRAMP or StateRAMP scope, NIST controls, FISMA, Section 508 accessibility, privacy impact assessments, and CJIS requirements.

It helps teams avoid treating ordinary commercial security advice as sufficient for public-sector procurement and operation. It identifies requirements needed to obtain approval to operate and handle regulated government data.

gov-reviewer — Agent for Claude Code by avelikiy

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/avelikiy/great_cto

Made for: Claude Code.

Or install great-cto, the plugin that ships this one along with the rest of its 40 skills, 44 commands, 70 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/avelikiy/great_cto/gov-reviewer/github.svg)](https://agentmods.dev/agents/avelikiy/great_cto/gov-reviewer)

Your own site

<a href="https://agentmods.dev/agents/avelikiy/great_cto/gov-reviewer"><img src="https://agentmods.dev/badge/agents/avelikiy/great_cto/gov-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/avelikiy/great_cto/gov-reviewer"><img src="https://agentmods.dev/badge/agents/avelikiy/great_cto/gov-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 41 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 2,101 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00041	$0.02101
Opus 5	$0.00020	$0.01051
Sonnet 5	$0.00008	$0.00420
Haiku 4.5	$0.00004	$0.00210

Measured 5d ago against content hash 7c0481f6fb5f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

gov-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/gov-reviewer.md · 167 lines

How it starts

The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Gov-Public Reviewer

You are the Gov-Public Reviewer — specialist subagent for archetype: gov-public. You cover the federal/state/municipal government compliance surface where standard SecOps doesn't translate to government-specific obligations like Authority to Operate (ATO).

Step-0 read-inputs, the docs/sec-threats/TM-{slug}.md output convention, the severity scale, verdict rules, and the  format all come from archetype-review-base. This prompt adds ONLY the gov-public heuristics.

Domain triggers (in addition to the base "when invoked")

Selling to US federal agencies (need FedRAMP authorization) OR
Selling to US state governments (StateRAMP) OR
Integrating with login.gov / id.me / VA / IRS / SSA OR
UK gov.uk / EU public sector procurement

Compliance surface

FedRAMP — Federal Risk and Authorization Management Program

Three impact levels: Low (FIPS 199 Low), Moderate (default for SaaS to federal), High (national security data)
Authorization paths:
- Agency ATO — single agency sponsors authorization (faster, ~6mo)
- JAB P-ATO — Joint Authorization Board (DHS/DoD/GSA), most rigorous, reusable across agencies (~12-24mo)
- FedRAMP Tailored — for low-risk SaaS with minimal data, smaller control set
Cost: $500K–$2M for full Moderate ATO (3PAO assessment + ConMon + remediation)
Boundary is critical: which components are IN the ATO? Anything OUT cannot process federal data. Auth-boundary scoping is the #1 cost driver.
Continuous Monitoring (ConMon): monthly vulnerability scans, annual assessments, ongoing POA&M tracking. Not a one-time event.

NIST 800-53 Rev 5 — Security and Privacy Controls

18 control families: AC (Access Control), AT (Awareness/Training), AU (Audit/Accountability), CA (Assessment/Authorization), CM (Configuration Management), CP (Contingency Planning), IA (Identification/Authentication), IR (Incident Response), MA (Maintenance), MP (Media Protection), PE (Physical/Environmental), PL (Planning), PM (Program Management), PS (Personnel Security), PT (PII Processing/Transparency), RA (Risk Assessment), SA (System/Services Acquisition), SC (System/Communications Protection), SI (System/Information Integrity), SR (Supply Chain Risk Management).
Moderate baseline: ~325 controls. High baseline: ~421 controls.
Implementation guidance per control is non-trivial — most controls have multiple implementation options; selection matters for ATO.
Common rough patches:
- AU-2/AU-9: audit log content + immutability — must be tamper-evident
- AC-2: account management — provisioning/deprovisioning workflow
- IA-2: multi-factor authentication — phishing-resistant required (FIPS 140-3 validated)
- SC-13: cryptographic protection — FIPS 140-2/3 validated modules
- CM-3: configuration change control — formal change management process

Read the full file on GitHub · 167 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago Changed 7c0481f6fb5f
8d ago Changed · -61 tokens per session f6b51781886e
11d ago First seen · 167 lines · 102 tokens per session scan A b24ce652f49f

Subscribe to this mod's changes

gov-reviewer is an agent published in the GitHub repository avelikiy/great_cto (92 stars, last pushed yesterday), licensed MIT. It adds 41 tokens to every session and 2,101 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Legal and compliance Multi-Agent Security agentic-coding claude-code-plugin claude-code-skills claude-code-subagents

parallel-reviewer

Parallel code review using 4 specialist agents (elixir-reviewer, security-analyzer, testing-reviewer, verification-runner). Use for thorough review of significant changes.

oliver-kriska/claude-elixir-phoenix · 38 tokens

correction-editor

Review contested civic claims and prepare append-only correction records with retained provenance.

jmagly/aiwg · 18 tokens

craft-code-reviewer-deep

Deep code review on Opus 4.8 for high-stakes PRs — release branches, security-sensitive code, large architectural changes, migrations, multi-service flows. Use when extra scrutiny is worth the token cost; use craft-code-reviewer for daily review.

michtio/craftcms-claude-skills · 62 tokens

fec-code-reviewer

Senior review focusing on front-end code (React/Vue/Next/Nuxt, TypeScript, styles, client-side security). Delegate after writing or modifying the front-end; by default, only the review report will be output and placed, and the business code will not be modified directly. Press CRITICAL→LOW to check, control noise and…

bovinphang/frontend-craft · 95 tokens

fec-performance-optimizer

Front-end performance analysis and optimization specialization: Core Web Vitals, packaging volume, runtime and rendering, network and cache, memory leak troubleshooting; can cooperate with Lighthouse, Bundle analysis and Profiler. Use it when users mention page slowness, lag, first screen, package size, poor…

bovinphang/frontend-craft · 0 tokens

fec-figma-implementer

Focus on implementing the proxy of UI components accurately according to the design draft, and save the implementation report as a Markdown file. Supports six design tools: Figma, Sketch, MasterGo, Pixso, Ink Knife, and Mockup. Provide design draft links, selection screenshots or annotation data, automatically obtain…