mcp-server-polarion: Agent for Claude Code

.claude/agents/spec-researcher.md

spec-researcher is an agent for Claude Code from devemberx/mcp-server-polarion. It costs 73 tokens per session (498 once invoked), scanned A, original, MIT.

A research agent that verifies facts about an outside service's API, such as URLs, parameters, response fields, and identifier formats. An API is a defined way for software to communicate with another service.

In plain words
What is it for?
Use it before specifying features that depend on exact vendor API behavior, especially when official documentation and repository-specific rules need checking.
Why use it?
It reduces the risk of designing a feature around guessed or outdated API details.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: model in frontmatter; mentions CLAUDE.md; mentions subagents.

This is devemberx/mcp-server-polarion's own configuration. It tells Claude Code how to work on mcp-server-polarion itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything mcp-server-polarion configures →

Reuse

Borrowing it

Nothing to install: this file belongs to devemberx/mcp-server-polarion. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/devemberx/mcp-server-polarion/main/.claude/agents/spec-researcher.md
Clone the repo
git clone --depth 1 https://github.com/devemberx/mcp-server-polarion

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for spec-researcher

README.md
[![agentmods](https://agentmods.dev/badge/agents/devemberx/mcp-server-polarion/spec-researcher/github.svg)](https://agentmods.dev/agents/devemberx/mcp-server-polarion/spec-researcher)
Your own site
<a href="https://agentmods.dev/agents/devemberx/mcp-server-polarion/spec-researcher"><img src="https://agentmods.dev/badge/agents/devemberx/mcp-server-polarion/spec-researcher/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for spec-researcher

Your own site · 80×15
<a href="https://agentmods.dev/agents/devemberx/mcp-server-polarion/spec-researcher"><img src="https://agentmods.dev/badge/agents/devemberx/mcp-server-polarion/spec-researcher.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 73 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 498 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00073 $0.00498
Opus 5 $0.00036 $0.00249
Sonnet 5 $0.00015 $0.00100
Haiku 4.5 $0.00007 $0.00050

Measured 10d ago against content hash 263c991dc209, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

spec-researcher scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

page is too large to fetch whole, `curl` it to the scratchpad and extract
.claude/agents/spec-researcher.md · 49 lines

What it actually says

Spec Researcher

You collect contract facts, not designs. The main session turns your facts into a spec; your job is to make sure every fact it uses is real.

Method

  1. Fetch official sources first — vendor REST/SDK docs, OpenAPI dumps. If a doc page is too large to fetch whole, curl it to the scratchpad and extract the relevant section with a script. Never answer from memory: version drift and plausible-sounding attribute names are exactly what you exist to catch.
  2. Cross-check against this repo's recorded gotchas — CLAUDE.md "Polarion API Gotchas" for the cross-cutting rules, and the matching docs/polarion-api/ domain doc for the per-resource contract. Flag where the vendor doc contradicts or extends a recorded fact.
  3. When the prompt names sibling tools, read them for the conventions the new contract must fit (id shapes, pagination, sparse-fieldset behavior).

Report format (your final message — the only thing the caller sees)

## CONTRACT FACTS
- endpoint, method, path params
- query params (name, type, required)
- resource attributes + relationships (exact names, types, id formats)

## QUIRKS
- anything surprising: missing meta, non-standard ids, unindexed fields

## UNVERIFIED
- every fact you could not confirm from a fetched source, stated as a question

Cite where each fact came from (URL or file:line). A short report of verified facts beats a long report of maybes. An empty UNVERIFIED section from a partial fetch is a failure — if you didn't see it, it goes in UNVERIFIED.

Composition

  • Invoke directly for contract questions; via dev-pipeline Stage 1 otherwise.
  • Do not invoke from another subagent.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 49 lines · 73 tokens per session scan A 263c991dc209

Subscribe to this mod's changes

spec-researcher is an agent published in the GitHub repository devemberx/mcp-server-polarion (13 stars, last pushed yesterday), licensed MIT. It adds 73 tokens to every session and 498 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

kicad-design-review-agent

Performs a thorough hardware design review of a KiCAD project. Triggers: full design review, audit everything, is my board ready for fab, comprehensive check, pre-fab review.

mixelpixx/Konnect · 45 tokens

timps_ai_workflow_orchestrator

Turn a plain-English multi-step workflow into executable code for LangGraph, Temporal, or Claude-Flow — plus a Mermaid diagram and tests. Use the timpsaiworkfloworchestrator MCP tool to perform this task. Do not answer directly — delegate to this sub-agent.

Sandeeprdy1729/timps-swarm · 67 tokens

timps_cli_tool_agent

Generate Click/Cobra/Commander CLI tools with shell completions and release workflows. Use the timpsclitoolagent MCP tool to perform this task. Do not answer directly — delegate to this sub-agent.

Sandeeprdy1729/timps-swarm · 49 tokens

timps_competitor_tracker

Monitor competitors for pricing changes, new features, job postings, and public sentiment. Returns a competitive intelligence brief. Use the timpscompetitortracker MCP tool to perform this task. Do not answer directly — delegate to this sub-agent.

Sandeeprdy1729/timps-swarm · 57 tokens

timps_dependency_agent

Dependency Agent — runs pip-audit / npm audit / cargo audit after code generation. Produces: a CVE severity report, a license compliance check, a version pinning strategy, and a safe upgrade script. Security-conscious devs' favourite agent. Use the timpsdependencyagent MCP tool to perform this task. Do not answer…

Sandeeprdy1729/timps-swarm · 82 tokens

timps_dependency_sentinel

Scan a dependency manifest (requirements.txt, package.json, go.mod, Cargo.toml) for CVEs and severely outdated packages. Returns a severity-ranked report with upgrade commands. Use the timpsdependencysentinel MCP tool to perform this task. Do not answer directly — delegate to this sub-agent.

Sandeeprdy1729/timps-swarm · 68 tokens