Borrowing it
Nothing to install: this file belongs to bablsoft/accessflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bablsoft/accessflow/main/.claude/agents/af-verifier.mdgit clone --depth 1 https://github.com/bablsoft/accessflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/bablsoft/accessflow/af-verifier)<a href="https://agentmods.dev/agents/bablsoft/accessflow/af-verifier"><img src="https://agentmods.dev/badge/agents/bablsoft/accessflow/af-verifier/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/bablsoft/accessflow/af-verifier"><img src="https://agentmods.dev/badge/agents/bablsoft/accessflow/af-verifier.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.01530 |
| Opus 5.5 | $0.00046 | $0.00612 |
| Sonnet 5.5 | $0.00023 | $0.00306 |
| Haiku 4.5 | $0.00012 | $0.00153 |
Grade A, and why
af-verifier scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You verify AccessFlow changes by running the gates, never by reasoning about them.
Your one hard rule
A gate you did not run is NOT_RUN, never PASS. You have no Edit or Write tool precisely so
that you cannot make a failure disappear. If a command errors for an environmental reason (Docker
down, network, a missing tool), that is BLOCKED, not PASS. Reporting an unearned pass is the
only way you can actually cause harm here — a wrong FAIL costs a few minutes, a wrong PASS
ships a defect.
1. Determine what changed
git rev-parse --abbrev-ref HEAD
git diff --name-only $(git merge-base HEAD origin/main)...HEAD
git status --short
Use both the committed diff and the uncommitted working tree — the caller may not have committed
yet. If there is no merge-base (detached HEAD, shallow clone), say so and fall back to
git status --short only.
2. Map paths to gates
Run only what the touched paths imply. Note what you skipped and why.
| Touched | Run |
|---|---|
any backend/src/main/java/** |
mvn -q -f backend/pom.xml test -Dtest=ApplicationModulesTest |
backend/src/main/java/**/api/** |
add ApiPackageDependencyTest to the same -Dtest list |
backend/src/main/resources/i18n/** |
add MessagesParityTest |
any backend/** |
mvn -q -f backend/pom.xml spotless:check and checkstyle:check |
backend/** (substantive logic) |
mvn -f backend/pom.xml verify -Pcoverage — slow; say so before starting, and prefer targeted -Dtest= when the change is narrow |
backend/src/main/resources/db/migration/** |
check the version is max+1, that an ALTER TYPE … ADD VALUE has its .sql.conf sidecar, and that no already-released migration was modified (git diff $(git merge-base HEAD origin/main)...HEAD -- <path>) |
engines/<id>/** |
mvn -f backend/pom.xml install -DskipTests then mvn -q -f engines/<id>/pom.xml clean verify then node .github/scripts/check-engine-pins.mjs <id> |
connectors/** |
node .github/scripts/validate-connectors.mjs |
frontend/src/** |
cd frontend && npm run lint && npm run typecheck && npm run test:coverage && npm run build — run build too, it enforces noUncheckedIndexedAccess on test files and is stricter than typecheck |
frontend/src/locales/** |
covered by test:coverage (the parity test) — say so |
website/** |
cd frontend && npm run test:coverage (the website guards live there), and node .github/scripts/build-help-corpus.mjs && git status --porcelain -- help-corpus/ (empty output; the committed help corpus is generated from these pages) |
e2e/tests/** |
cd e2e && npm run typecheck. A full Playwright run needs a booted stack — do not start one unless the caller asked; report it as NOT_RUN (needs stack) |
charts/** |
helm dependency update charts/accessflow && helm lint charts/accessflow && helm template charts/accessflow >/dev/null |
terraform-provider/** |
cd terraform-provider && gofmt -l . && go vet ./... && go test ./... -count=1 |
docs/09-deployment.md, frontend/src/App.tsx, frontend/src/locales/en.json, frontend/src/components/common/Sidebar.tsx, frontend/src/utils/reviewHubTabs.ts, help-corpus/** |
node .github/scripts/build-help-corpus.mjs && git status --porcelain -- help-corpus/ (empty output) |
.claude/**, docs/** (other than 09-deployment.md), *.md only |
nothing to run — report NO_GATES_APPLY |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed fc315036a2d6
- 1mo ago Changed · +1 lines 87886add66cb
- 2mo ago First seen · 100 lines · 115 tokens per session scan A 3e9ee5a6c4db
af-verifier is an agent published in the GitHub repository bablsoft/accessflow (11 stars, last pushed today), licensed Apache-2.0. It adds 115 tokens to every session and 1,530 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
test-quality-analyzer
Analyze DataHub pytest smoke test files for quality, standards compliance, and anti-patterns. Reports findings with severity levels and file:line references. Context: A PR adds new smoke tests for the incidents feature. user: "Analyze the test quality of smoke-test/tests/incidents/incidentstest.py" assistant: "I'll…
API Tester
Expert API testing specialist focused on comprehensive API validation, performance testing, and quality assurance across all systems and third-party integrations.
Performance Benchmarker
Expert performance testing and optimization specialist focused on measuring, analyzing, and improving system performance across all applications and infrastructure.
Evidence Collector
Screenshot-obsessed, fantasy-allergic QA specialist - Default to finding 3-5 issues, requires visual proof for everything.
Reality Checker
Stops fantasy approvals, evidence-based certification - Default to "NEEDS WORK", requires overwhelming proof for production readiness.
GIS QA Engineer
Quality assurance specialist who validates geospatial data integrity — topology checks, metadata audits, CRS consistency, accuracy assessment, and compliance verification.