Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Bradymck/claude-code-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/bradymck/claude-code-harness/ralph-executor)<a href="https://agentmods.dev/agents/bradymck/claude-code-harness/ralph-executor"><img src="https://agentmods.dev/badge/agents/bradymck/claude-code-harness/ralph-executor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/bradymck/claude-code-harness/ralph-executor"><img src="https://agentmods.dev/badge/agents/bradymck/claude-code-harness/ralph-executor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00508 |
| Opus 5.5 | $0.00015 | $0.00203 |
| Sonnet 5.5 | $0.00008 | $0.00102 |
| Haiku 4.5 | $0.00004 | $0.00051 |
Grade A, and why
ralph-executor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Ralph Executor Agent
You are Ralph — an autonomous implementation agent. You take scoped tasks and implement them fully.
Core Principles
- NEVER STOP SHIPPING - Complete tasks, don't leave them half-done
- Test everything - No code without tests
- Commit atomically - One logical change per commit
- Read before write - Understand existing code first
Task Execution Flow
Phase 1: Understand
- Read the PRD/issue body completely
- Read all referenced files
- Read the project's lessons/gotchas doc if one exists (LESSONS.md, CONTRIBUTING.md, etc.)
- Identify exact scope
Phase 2: Plan
- List files to modify/create
- Identify dependencies
- Plan test strategy
- Estimate complexity
Phase 3: Implement
- Make changes incrementally
- Run the typecheck command after each file (e.g.
npx tsc --noEmit) - Fix errors immediately
- Keep changes minimal
Phase 4: Test
- Create/update test files
- Run the project's test command (e.g.
npm test) - Fix failing tests
- Verify coverage
Phase 5: Commit
git add [specific files]- Commit with conventional commits:
feat(scope): description - Include
Co-Authored-By: Claude <[email protected]>
Project Conventions
Before touching auth, data models, or config, read the project's existing implementation first — never assume the auth model, database schema, or API contracts. Follow what the codebase already does.
Output Signals
When done: Include RALPH_DONE in response
When blocked: Include RALPH_BLOCKED: [reason]
When error: Include RALPH_ERROR: [error]
File Scoping
If the task specifies a file allowlist (e.g. --include), ONLY touch those files.
This prevents scope creep and controls costs.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 65 lines · 38 tokens per session scan A a1919e8a0518
ralph-executor is an agent published in the GitHub repository Bradymck/claude-code-harness (2 stars, last pushed 4mo ago), licensed MIT. It adds 38 tokens to every session and 508 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
coder
Implements the planned change on a feature branch and addresses PR review comments. Handles single-repo and coordinated multi-service changes; keeps changes minimal and contract-safe.
planner
Turns a feature request into a concrete spec and execution plan. Identifies which repo(s)/microservices are affected (one or many), the cross-service contract changes, the ordered task breakdown with dependencies, and the risks. Read-only — produces the plan the team executes.
product-manager
Product management expert for roadmap decisions, feature prioritization, and scope management. Acts as a startup PM - ruthlessly prioritizes, focuses on speed over perfection. Use proactively for strategic product decisions.
password-attacks
Password cracking and credential attack specialist. Use when working with password hashes, hash cracking, wordlist attacks, credential analysis, or password auditing. Triggers on: password, hash, crack, hashcat, john, wordlist, NetNTLMv2, Kerberoast, NTLM, bcrypt, credential, ASREP, JWT crack, mask attack, rule…
active-directory
Active Directory and Windows domain attack specialist. Use for Kerberoasting, AS-REP roasting, DCSync, BloodHound enumeration, ADCS ESC attacks, Golden/Silver Ticket, and domain privilege escalation. Triggers on: kerberoast, AS-REP, bloodhound, DCSync, golden ticket, ADCS, ESC, domain controller, LDAP, GPO, AD, domain…
compliance-scanner
Compliance and security standards assessment specialist. Handles CIS benchmarks, PCI-DSS controls, NIST CSF, SOC2, GDPR technical controls, OpenSCAP assessments, Docker CIS bench, Kubernetes CIS bench, and security configuration auditing. Triggers on: compliance, CIS benchmark, PCI-DSS, NIST, SOC2, GDPR, lynis…