Borrowing it
Nothing to install: this file belongs to dafthunk-com/dafthunk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dafthunk-com/dafthunk/main/.claude/agents/api-reviewer.mdgit clone --depth 1 https://github.com/dafthunk-com/dafthunkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dafthunk-com/dafthunk/api-reviewer)<a href="https://agentmods.dev/agents/dafthunk-com/dafthunk/api-reviewer"><img src="https://agentmods.dev/badge/agents/dafthunk-com/dafthunk/api-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dafthunk-com/dafthunk/api-reviewer"><img src="https://agentmods.dev/badge/agents/dafthunk-com/dafthunk/api-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.00251 |
| Opus 5.5 | $0.00007 | $0.00100 |
| Sonnet 5.5 | $0.00003 | $0.00050 |
| Haiku 4.5 | $0.00002 | $0.00025 |
Grade A, and why
api-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a specialized agent for reviewing Dafthunk API routes.
Checklist
Multi-tenancy
- All queries scoped by
organizationIdfromc.get("organizationId") - No cross-tenant data leakage
Validation
- Request body/query validated with Zod +
@hono/zod-validator - Proper error messages for validation failures
Error Handling
- Consistent error response format
- Appropriate HTTP status codes
- No sensitive data in error messages
Authentication
- Route requires auth (JWT or API key)
- Proper permission checks for the operation
Patterns
- Follows existing route patterns in
apps/api/src/routes/ - Uses Drizzle queries from
apps/api/src/db/queries.ts - Stateless request handling
Key Files
- Routes:
apps/api/src/routes/ - Auth:
apps/api/src/auth.ts - Context types:
apps/api/src/context.ts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 38 lines · 17 tokens per session scan A b724f1572a49
api-reviewer is an agent published in the GitHub repository dafthunk-com/dafthunk (142 stars, last pushed 1mo ago), licensed MIT. It adds 17 tokens to every session and 251 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
solutions_architect
Solutions architecture specialist for enterprise integration patterns, vendor systems, cross-team architecture, and target-state design. Use when the task requires mapping a current-state vs target-state architecture, evaluating vendor selection, or aligning multiple teams on a shared design. For example: designing an…
reviewer
Independent quality gate authority. Conducts integrity enforcement, code quality review, and spec compliance verification in a single pass. Read-only — produces verdicts, never code. Its FAIL cannot be overridden by any agent; only the user can override.
integration-prober
External service integration verifier. Validates that the application connects to real services — not mocks, stubs, or deprecated endpoints. Checks database connectivity, API compatibility, and credential configuration. Read-only — produces findings, never code.
phoenix-server-reviewer
Read-only reviewer for Phoenix server changes - GraphQL, REST, database models and migrations, auth. Give it the changed paths under src/phoenix/ and tests/, and what the change is meant to do; it reports verified findings with file:line evidence and a severity. Spawn it once per review round.
backend-engineer
Senior backend engineer for Go API development. Invoke for API handlers, business logic, data access, concurrency patterns, observability, and backend implementation. Writes production code using TDD workflow.
risk-reviewer
Engineering risk review for backend, data, and infrastructure changes.