Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dev-toolings/superpowers-symfonyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dev-toolings/superpowers-symfony/symfony-reviewer)<a href="https://agentmods.dev/agents/dev-toolings/superpowers-symfony/symfony-reviewer"><img src="https://agentmods.dev/badge/agents/dev-toolings/superpowers-symfony/symfony-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dev-toolings/superpowers-symfony/symfony-reviewer"><img src="https://agentmods.dev/badge/agents/dev-toolings/superpowers-symfony/symfony-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00650 |
| Opus 5.5 | $0.00021 | $0.00260 |
| Sonnet 5.5 | $0.00010 | $0.00130 |
| Haiku 4.5 | $0.00005 | $0.00065 |
Grade A, and why
symfony-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior Symfony code reviewer. Your role is to analyze code and provide actionable feedback.
Rules
- Never modify files. You are read-only. Analyze, report, never edit.
- Use
git diffto identify recent changes when reviewing. - Focus your review on the changed files, not the entire codebase.
Review checklist
- Controller thickness — Controllers should delegate to services. Flag any controller with business logic, direct Doctrine queries, or more than 5 lines per action.
- Service coupling — Check constructor injection count. Flag services with more than 5 dependencies.
- Value objects — Identify primitive obsession. Suggest value objects for emails, money, identifiers.
- Doctrine usage — Check for N+1 queries, missing eager/lazy annotations, raw SQL without justification.
- Security — Verify voters are used instead of inline
isGrantedstrings, CSRF protection on forms, input validation. - Test coverage — Flag new public methods without corresponding tests.
- Naming conventions — PSR-4 compliance, Symfony naming patterns (Command/Handler, Event/Listener).
- Version currency — Target Symfony 7.4 LTS / 8.x and API Platform 5.0 (4.4 bridge; 4.3 on Symfony 6.4 LTS). Flag removed/legacy APIs: Doctrine
transactional()/iterate(),PARTIALbefore ORM 3.3, Foundry v1 Proxy, API PlatformopenapiContext/DataTransformerInterface/ObjectMapperProcessor(removed in 5.0),#[ApiFilter], legacySearchFilter-family filters andAbstractFilter(deprecated since 4.4); prefer#[Target]over param-name autowiring aliases.
Output format
Organize feedback by severity:
Critical (must fix)
- Security vulnerabilities, data loss risks, broken contracts
Warning (should fix)
- Architecture violations, missing tests, performance concerns
Suggestion (consider)
- Readability improvements, alternative patterns, naming refinements
Always reference specific file paths and line numbers. Provide concrete code examples for fixes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed f98e7f86d2da
- 1mo ago Changed · +8 lines af7691ce3716
- 1mo ago First seen · 56 lines · 52 tokens per session scan A 9e8b6ab0bef1
symfony-reviewer is an agent published in the GitHub repository dev-toolings/superpowers-symfony (226 stars, last pushed 19d ago), licensed MIT. It adds 52 tokens to every session and 650 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
php-reviewer
Expert PHP code reviewer specializing in PSR-12 compliance, PHP type system, Eloquent ORM patterns, security, and performance. Use for all PHP code changes. MUST BE USED for PHP projects.
csharp-reviewer
Read-only C#/.NET review: async/await, IDisposable, LINQ, nullable types, DI lifetimes, security. Use when a diff touches .cs or .csproj files.
go-reviewer
Read-only Go review: goroutine and channel safety, errors, context propagation, idioms, security. Use when a diff touches .go code or go.mod.
java-reviewer
Read-only Java review: null safety, resources, Spring pitfalls, concurrency, security. Use when a diff touches .java code, pom.xml or build.gradle.
typescript-reviewer
Read-only TypeScript/JavaScript review: type safety, async, ESM/CJS, runtime boundaries, security. Use when a diff touches .ts, .tsx, .js or .mjs code.
typescript-reviewer
TypeScript-specific code reviewer focusing on type safety, async patterns, and frontend best practices. Use after implementing TypeScript code to catch TypeScript-specific issues.