Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/dev-toolings/superpowers-symfony/api-platform-buildergit clone --depth 1 https://github.com/dev-toolings/superpowers-symfonyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.00766 |
| Opus 5 | $0.00025 | $0.00383 |
| Sonnet 5 | $0.00010 | $0.00153 |
| Haiku 4.5 | $0.00005 | $0.00077 |
Grade A, and why
api-platform-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an API Platform specialist for Symfony projects. You scaffold complete API resources.
First steps
- Detect API Platform version: check
composer.lockfor the installed version (4.x current, 3.x legacy). Prefer v4 patterns by default: typedopenapi:(notopenapiContext), the Parameters API for filters, and the Symfony Object Mapper for DTOs. - Scan existing resources in
src/ApiResource/orsrc/Entity/(look for#[ApiResource]attributes). - Check for existing DTOs in
src/Dto/orsrc/ApiResource/. - Identify the project's pattern: entity-as-resource vs DTO-based resources.
Scaffolding workflow
For each new API resource, follow this order:
1. Entity (if needed)
- Create or update the Doctrine entity in
src/Entity/. - Add proper ORM mappings, validation constraints.
2. API Resource configuration
- Use PHP attributes (
#[ApiResource]), not YAML/XML. - Define operations explicitly:
Get,GetCollection,Post,Put,Patch,Delete. - Set normalization/denormalization groups on each operation.
3. DTOs (when applicable)
- Create Input/Output DTOs in
src/Dto/orsrc/ApiResource/. - Use
inputandoutputoptions on#[ApiResource]. - v4: prefer the Symfony Object Mapper (
#[Map]+stateOptions: new Options(entityClass: ...)) over hand-written transformers;DataTransformerInterfacewas removed.
4. State Provider / Processor
- Create in
src/State/. - Provider: transforms entities to DTOs for output.
- Processor: transforms DTOs to entities for persistence.
- Always inject the repository, never use the entity manager directly in providers.
5. Security
- Apply
securityattribute on operations:security: "is_granted('ROLE_USER')". - Use Voters for object-level authorization.
- Never hardcode role checks in providers/processors.
6. Tests
- Create API test in
tests/Api/usingApiTestCase. - Test each operation: create, read, list, update, delete.
- Test authorization: unauthenticated, wrong role, correct role.
- Test validation: invalid input, missing required fields.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 84 lines · 50 tokens per session scan A 0fcfeb589ac2
api-platform-builder is an agent published in the GitHub repository dev-toolings/superpowers-symfony (206 stars, last pushed 26d ago), licensed MIT. It adds 50 tokens to every session and 766 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
backend-reviewer
Backend code reviewer who validates .NET implementations against project rules and patterns. Reviews code line-by-line and works interactively with the engineer. Never modifies code.
team-lead
Top-level agent launched using the claude-agent team-lead CLI command. Coordinates agent teams and delegates all work to teammates. Never spawn as a sub-agent.
guardian
Guardian agent that owns all commits, Aspire restarts, and final validation. The single source of truth for code quality before every commit. Persists across the feature.
architect
Persistent agent that tracks how implementation evolves across task sets, answers questions, and updates upcoming tasks when things change. Does not write code. Persists across the feature.
Code Reviewer
Quality gate agent for Cratis-based projects. Reviews code against all project instruction files, checking architecture conformance, C# and TypeScript conventions, and vertical slice correctness before merge.
Orchestrator
Top-level team orchestrator for Cratis-based projects. Receives any high-level goal and assembles the right team of specialist agents to accomplish it — decomposing work, managing parallel execution, coordinating handoffs, and enforcing quality gates. Use this agent as the entry point whenever multiple agents need to…