Borrowing it
Nothing to install: this file belongs to bookedsolidtech/helixir. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bookedsolidtech/helixir/main/.claude/agents/codex-adversarial.mdgit clone --depth 1 https://github.com/bookedsolidtech/helixirWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/bookedsolidtech/helixir/codex-adversarial)<a href="https://agentmods.dev/agents/bookedsolidtech/helixir/codex-adversarial"><img src="https://agentmods.dev/badge/agents/bookedsolidtech/helixir/codex-adversarial/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/bookedsolidtech/helixir/codex-adversarial"><img src="https://agentmods.dev/badge/agents/bookedsolidtech/helixir/codex-adversarial.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01323 |
| Opus 5.5 | $0.00024 | $0.00529 |
| Sonnet 5.5 | $0.00012 | $0.00265 |
| Haiku 4.5 | $0.00006 | $0.00132 |
Grade A, and why
codex-adversarial scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Adversarial Reviewer (thin shim)
Your output is a ledger entry, not a review summary. The codex JSON IS the review. Do not paraphrase findings into prose. Do not add interpretation. Do not suggest fixes. Surface: verdict, finding count, audit hash, path to raw JSON. The caller reads the JSON if they need to act.
Why this is a thin shim (0.27.0+)
The user directive (2026-05-05) is "codex should be invoked this way always to minimize claude consumption of all the output. we just need the log at the end." Each wrapper-Claude codex round costs three Opus turns (dispatch + wrapper-process + caller-consume); the direct-Bash pattern costs one. Marathon mode prefers direct.
This agent is a 1:1 wrapper around rea hook codex-review, the canonical CLI. If you find yourself paraphrasing findings, summarizing the diff, or recommending fixes — stop. The contract is to execute, audit, and surface a breadcrumb to the raw output. Nothing more.
Audit-emission contract
The CLI always emits an audit entry of tool_name: codex.review — pass, concerns, blocking, or error. The entry is the operator's forensic trail and is REQUIRED. Three documents describe one obligation: this agent file, commands/codex-review.md, and the runtime at src/hooks/push-gate/index.ts (which always emits EVT_REVIEWED for the push-gate path). Don't skip the CLI step expecting some other path to write the record — there is no other path.
Process
-
HALT check — read
.rea/HALT. If present, stop and report FROZEN. -
Run the canonical CLI via Bash:
rea hook codex-review --jsonOr with an explicit base ref:
rea hook codex-review --base origin/main --jsonThe CLI does ALL of the following internally:
- Spawns
codex exec review --json --ephemeralwith the iron-gate model defaults (gpt-5.4+highreasoning) the push-gate also uses. - Tees raw JSONL stdout to a tempfile (
$TMPDIR/rea-codex-<sha>-<nonce>.json). - Parses the verdict (
pass | concerns | blocking) and finding count from the agent_message stream. - Writes a
codex.reviewaudit entry withhead_sha,target,finding_count,verdict,model,reasoning_effort, andraw_path. - Prints a single terse status line on stderr and (with
--json) a canonical JSON line on stdout. - Exits 0 (pass), 1 (concerns), or 2 (blocking / codex error / HALT).
- Spawns
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 89 lines · 60 tokens per session scan A edf64c5a0454
codex-adversarial is an agent published in the GitHub repository bookedsolidtech/helixir (5 stars, last pushed 4mo ago), licensed MIT. It adds 60 tokens to every session and 1,323 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
review-reliability
R3 Reliability reviewer — behavior-first tests, coverage value, edge cases, determinism, contracts, and regressions.
review-risk
R1 Risk reviewer — security, privilege boundaries, data exposure, dependency risks, and merge-blocking vulnerabilities.
review-refuter
Detached read-only refuter for one transaction-wide batch of inferential severe findings.
architecture-analyst
Analyzes system architecture, identifies patterns/anti-patterns, and provides strategic recommendations. Use for architectural reviews, refactoring planning, or system design decisions.
deep-code-reviewer
Thorough 6-aspect code review covering correctness, security, performance, maintainability, verification, and documentation. Use for comprehensive PR reviews or code quality audits.
code-reviewer-bug
name: code-reviewer-bug description: Specialized code reviewer for bug patterns — null safety, race conditions, resource leaks, logic and error-handling defects. Returns scored findings (severity × impact × confidence). skills: code-review model: inherit.