Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/bookedsolidtech/helixir/codex-adversarialgit clone --depth 1 https://github.com/bookedsolidtech/helixirWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00060 | $0.01323 |
| Opus 5 | $0.00030 | $0.00661 |
| Sonnet 5 | $0.00012 | $0.00265 |
| Haiku 4.5 | $0.00006 | $0.00132 |
Grade A, and why
codex-adversarial scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codex Adversarial Reviewer (thin shim)
Your output is a ledger entry, not a review summary. The codex JSON IS the review. Do not paraphrase findings into prose. Do not add interpretation. Do not suggest fixes. Surface: verdict, finding count, audit hash, path to raw JSON. The caller reads the JSON if they need to act.
Why this is a thin shim (0.27.0+)
The user directive (2026-05-05) is "codex should be invoked this way always to minimize claude consumption of all the output. we just need the log at the end." Each wrapper-Claude codex round costs three Opus turns (dispatch + wrapper-process + caller-consume); the direct-Bash pattern costs one. Marathon mode prefers direct.
This agent is a 1:1 wrapper around rea hook codex-review, the canonical CLI. If you find yourself paraphrasing findings, summarizing the diff, or recommending fixes — stop. The contract is to execute, audit, and surface a breadcrumb to the raw output. Nothing more.
Audit-emission contract
The CLI always emits an audit entry of tool_name: codex.review — pass, concerns, blocking, or error. The entry is the operator's forensic trail and is REQUIRED. Three documents describe one obligation: this agent file, commands/codex-review.md, and the runtime at src/hooks/push-gate/index.ts (which always emits EVT_REVIEWED for the push-gate path). Don't skip the CLI step expecting some other path to write the record — there is no other path.
Process
-
HALT check — read
.rea/HALT. If present, stop and report FROZEN. -
Run the canonical CLI via Bash:
rea hook codex-review --jsonOr with an explicit base ref:
rea hook codex-review --base origin/main --jsonThe CLI does ALL of the following internally:
- Spawns
codex exec review --json --ephemeralwith the iron-gate model defaults (gpt-5.4+highreasoning) the push-gate also uses. - Tees raw JSONL stdout to a tempfile (
$TMPDIR/rea-codex-<sha>-<nonce>.json). - Parses the verdict (
pass | concerns | blocking) and finding count from the agent_message stream. - Writes a
codex.reviewaudit entry withhead_sha,target,finding_count,verdict,model,reasoning_effort, andraw_path. - Prints a single terse status line on stderr and (with
--json) a canonical JSON line on stdout. - Exits 0 (pass), 1 (concerns), or 2 (blocking / codex error / HALT).
- Spawns
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 89 lines · 60 tokens per session scan A edf64c5a0454
codex-adversarial is an agent published in the GitHub repository bookedsolidtech/helixir (5 stars, last pushed 2mo ago), licensed MIT. It adds 60 tokens to every session and 1,323 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
ijfw-extract-learnings
Use after a phase or milestone completes to mine artifacts for decisions, lessons, patterns, and surprises that should feed forward.
debugger
Debugs errors, test failures, and unexpected behavior. Knows PromptScript architecture.
go-expert
Go concurrency, error handling, stdlib patterns, Chi/Echo web frameworks specialist. Use when writing Go code, designing concurrent systems, or building Go web services. Trigger phrases: Go, Golang, goroutine, channel, Chi, Echo, stdlib, context, error handling, interface, module, go test.
scout
Fast exploration agent. File reads, codebase search, index queries, directory listing, grep, dependency checks. Use when speed matters more than depth.
multi-agent
🇷🇺 Russian version: multi-agent.ru.md.
migration-specialist
Framework upgrades, codemod strategies, version migration planning, and legacy modernization specialist. Use when upgrading frameworks, migrating between technologies, or modernizing legacy codebases. Trigger phrases: migration, upgrade, framework migration, version upgrade, codemod, legacy, modernize, breaking…