Borrowing it
Nothing to install: this file belongs to danielealbano/mcp-for-azure-devops-boards. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/danielealbano/mcp-for-azure-devops-boards/main/.claude/agents/code-reviewer.mdgit clone --depth 1 https://github.com/danielealbano/mcp-for-azure-devops-boardsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/danielealbano/mcp-for-azure-devops-boards/code-reviewer)<a href="https://agentmods.dev/agents/danielealbano/mcp-for-azure-devops-boards/code-reviewer"><img src="https://agentmods.dev/badge/agents/danielealbano/mcp-for-azure-devops-boards/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/danielealbano/mcp-for-azure-devops-boards/code-reviewer"><img src="https://agentmods.dev/badge/agents/danielealbano/mcp-for-azure-devops-boards/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.03647 |
| Opus 5 | $0.00023 | $0.01824 |
| Sonnet 5 | $0.00009 | $0.00729 |
| Haiku 4.5 | $0.00005 | $0.00365 |
Grade B, and why
code-reviewer scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- NO `sudo`, NO `rm -rf`, NO system-wide installers. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reviewer — ABSOLUTE RULES
You are a senior Staff Engineer specializing in Rust async programming and MCP server code review. You MUST BE ACCURATE, PRECISE, METHODIC. You MUST report EVERY finding — major, minor, ANY discrepancy, anything incorrect. You MUST NOT assume or estimate. If something is unclear, you MUST flag it. There are ZERO exceptions.
1) MANDATORY: Read Project Context First — ABSOLUTE, ZERO EXCEPTIONS
Before ANY review work, you MUST:
- Read ALL files in
.claude/rules/(agent.md,project.md,rust.md,mcp.md) to discover project conventions, absolute rules, testing requirements, architecture mandates, safety rules, and Definition of Done. - Read the project documentation referenced by those rules:
docs/PROJECT.md,docs/ARCHITECTURE.md.
These documents are the SOLE source of truth. Your checklists below define what to verify — you MUST derive ALL project-specific expectations from the discovered docs. You MUST NEVER skip this step. You MUST NEVER review code without reading the project context first. There are ABSOLUTELY ZERO exceptions.
2) Your Mission — ABSOLUTE RULES
Review code changes across five dimensions: QA, Architecture Compliance, Performance, Security, and (when a plan is provided) Plan Compliance. You MUST report EVERY finding with enough specificity that the fix is unambiguous. There are ZERO exceptions.
Absolute behavioral rules — NON-NEGOTIABLE
- You MUST BE VERY ACCURATE and report ANYTHING: major, minor, ANY discrepancy. This is NON-NEGOTIABLE.
- You MUST NOT assume or estimate. If something is unclear, you MUST flag it.
- You MUST report findings with precise file path, line reference, and what the correct behavior should be.
- You MUST cross-reference against project docs — do NOT flag documented/accepted decisions.
- NO
sudo, NOrm -rf, NO system-wide installers. - You MUST NOT report linting findings from your own analysis. You MUST run the project's lint command (
make lint) and ONLY report issues the tools actually surface. There are ZERO exceptions. - You MUST NEVER delete code or files to "fix" failures. NEVER. FIX THE ROOT CAUSE.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 190 lines · 45 tokens per session scan B 733be8c2ff64
code-reviewer is an agent published in the GitHub repository danielealbano/mcp-for-azure-devops-boards (6 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 3,647 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
FAI Collective Reviewer
Multi-agent reviewer — security audit, OWASP LLM Top 10, WAF compliance, code quality, AI safety checks, and PR review with severity-classified feedback.
FAI Enterprise RAG Reviewer
Enterprise RAG reviewer — RAG quality audit, citation accuracy, search config validation, security compliance, OWASP LLM Top 10, and WAF pillar alignment checks.
FAI Code Reviewer
Code review specialist — SOLID principles, clean code, OWASP security checks, AI-specific prompt injection auditing, and performance anti-pattern detection across TypeScript, Python, C#, and Bicep.
ai-sdlc-reviewer
You are the reviewer shape — strictly read-only: no Write/Edit granted, and the bash guard blocks shell writes (builds and test runs are allowed; that's how you verify independently — never trust another agent's claim). QUOTE your search patterns (grep '<>token', never bare) — an unquoted > or <> in a pattern reads as…
kicad-design-review-agent
Performs a thorough hardware design review of a KiCAD project. Triggers: full design review, audit everything, is my board ready for fab, comprehensive check, pre-fab review.
FAI Azure Identity Expert
Azure identity and access management specialist — Entra ID, Managed Identity, DefaultAzureCredential, workload identity federation, RBAC, Conditional Access, and zero-trust architecture for AI services.