investigator

investigator is an agent for Claude Code, Codex from catlog22/Claude-Code-Workflow. It costs 0 tokens per session (3,616 once invoked), scanned A, original, MIT.

A long-running debugging agent that follows a five-phase evidence-first investigation process. It collects evidence, searches for code patterns, tests hypotheses, applies a minimal fix, and verifies the result.

In plain words
What is it for?
Use it for systematic root-cause investigations that need evidence collection, hypothesis testing, a narrowly scoped fix, verification, and a regression test.
Why use it?
It gives difficult bugs a repeatable investigation structure and requires a confirmed root cause before changing code. It also records the investigation and adds a regression test.

Agent for Claude CodeCodex

Written for Codex and Claude Code: installed under .codex/, but also a Claude Code subagent (agents/*.md). Also seen: mentions subagents; reads ~/.codex paths; mentions Codex.

Good fit Use it for systematic root-cause investigations that need evidence collection, hypothesis testing, a narrowly scoped fix, verification, and a regression test.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/catlog22/claude-code-workflow/investigator
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/catlog22/Claude-Code-Workflow

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for investigator

README.md
[![agentmods](https://agentmods.dev/badge/agents/catlog22/claude-code-workflow/investigator/github.svg)](https://agentmods.dev/agents/catlog22/claude-code-workflow/investigator)
Your own site
<a href="https://agentmods.dev/agents/catlog22/claude-code-workflow/investigator"><img src="https://agentmods.dev/badge/agents/catlog22/claude-code-workflow/investigator/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for investigator

Your own site · 80×15
<a href="https://agentmods.dev/agents/catlog22/claude-code-workflow/investigator"><img src="https://agentmods.dev/badge/agents/catlog22/claude-code-workflow/investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,616 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.03616
Opus 5.5 $0.00000 $0.01446
Sonnet 5.5 $0.00000 $0.00723
Haiku 4.5 $0.00000 $0.00362

Measured 1mo ago against content hash 979ecaca17f8, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

investigator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.codex/skills/investigate/agents/investigator.md · 393 lines

How it starts

The opening of the file, as written. The whole thing — 393 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Investigator Agent

Executes all 5 phases of the systematic debugging investigation under the Iron Law methodology. Single long-running agent driven through phases by orchestrator followup_task calls.

Identity

  • Type: investigation
  • Role File: ~/.codex/skills/investigate/agents/investigator.md
  • task_name: investigator
  • Responsibility: Full 5-phase investigation execution — evidence collection, pattern search, hypothesis testing, minimal fix, verification
  • fork_turns: "none"
  • Reasoning Effort: high

Boundaries

MUST

  • Load role definition via MANDATORY FIRST STEPS pattern before any phase execution
  • Read the phase file at the start of each phase before executing that phase's steps
  • Collect concrete evidence before forming any theories (evidence-first)
  • Check confirmed_root_cause exists before executing Phase 4 (Iron Law gate)
  • Track 3-strike counter accurately in Phase 3
  • Implement only minimal fix — change only what addresses the confirmed root cause
  • Add a regression test that fails without the fix and passes with it
  • Write the final debug report to .workflow/.debug/ using the schema in ~/.codex/skills/investigate/specs/debug-report-format.md
  • Produce structured output after each phase, then await next followup_task

MUST NOT

  • Skip MANDATORY FIRST STEPS role loading
  • Proceed to Phase 4 without confirmed_root_cause (Iron Law violation)
  • Modify production code during Phases 1-3 (read-only investigation)
  • Count a rejected hypothesis as a strike if it yielded new actionable insight
  • Refactor, add features, or change formatting beyond the minimal fix
  • Change more than 3 files without written justification
  • Proceed past Phase 3 BLOCKED status

Toolbox

Available Tools

Tool Type Purpose
Bash Shell execution Run tests, reproduce bug, detect test framework, run full test suite
Read File read Read source files, test files, phase docs, role files
Write File write Write debug report to .workflow/.debug/
Edit File edit Apply minimal fix in Phase 4
Glob Pattern search Find test files, affected module files
Grep Content search Find error patterns, antipatterns, similar code
spawn_agent Agent spawn Spawn inline CLI analysis subagent
wait_agent Agent wait Wait for inline subagent results
close_agent Agent close Close inline subagent after use

Read the full file on GitHub · 393 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 393 lines · 0 tokens per session scan A 979ecaca17f8

Subscribe to this mod's changes

investigator is an agent published in the GitHub repository catlog22/Claude-Code-Workflow (2,125 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 3,616 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other agents, from other repositories

tester

Testing specialist for unit tests, integration tests, test coverage analysis, and TDD workflows. Use when the task requires writing test suites, improving coverage, setting up test infrastructure, or validating behavior. For example: writing unit tests for a service class, setting up integration test fixtures, or…

josstei/maestro-orchestrate · 66 tokens

testing-bug-fixer

A bug-fixing agent that reproduces problems, traces them to their underlying cause, applies a small targeted change, and adds a regression test.

CronusL-1141/AI-company · 43 tokens

ast-pe

A software engineering delivery agent for turning an approved design into working, maintainable software. It handles cross-module implementation, integration, testing, code review, debugging, and delivery that can be rolled back.

aAAaqwq/AGI-Super-Team · 87 tokens

evolve-bug-reproduction

Bug reproduction agent for the Evolve Loop (Evaluate archetype). The advisor INSERTS this phase on bugfix cycles before build (after fault localization) to write a test or script that fails on the current buggy code.

mickeyyaya/evolve-loop · 51 tokens

debugger

Root-cause debugging: reproduce, confirm the cause with evidence, apply a minimal fix and prove it with a regression test. Use for bugs, flaky tests or errors of unknown cause.

KevinZai/commander · 40 tokens

kingdee-qa-engineer

QA & Test Engineer for the kingdee-mcp project. Authors evals/ and tests/ cases, reproduces bugs against the live K3Cloud environment, and runs regression scans via bin/kmcp test.

WaHaiLong/KingdeeMCP · 49 tokens