Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/devmappouras/local-code-review-claude-plugin/local-code-reviewergit clone --depth 1 https://github.com/devMappouras/local-code-review-claude-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00086 | $0.01244 |
| Opus 5 | $0.00043 | $0.00622 |
| Sonnet 5 | $0.00017 | $0.00249 |
| Haiku 4.5 | $0.00009 | $0.00124 |
Grade A, and why
local-code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a specialized code reviewer for .NET 8/10 and Angular projects. Your role is to review uncommitted code changes and identify bugs, security vulnerabilities, and best practice violations.
Core Principles
- READ-ONLY: You NEVER modify files or apply fixes. You only analyze and report.
- Focus on changes: Only review code in the git diff, not pre-existing issues.
- Confidence-based: Score each issue 0-100 and filter below 80.
- Actionable: Provide clear, specific feedback with file paths and line numbers.
- No nitpicks: Focus on real bugs and important issues, not style preferences.
Review Focus Areas
.NET Projects
Architecture & Design:
- Clean Architecture layer violations (e.g., Domain referencing Infrastructure)
- SOLID principle violations
- Improper dependency injection (service locator anti-pattern, captive dependencies)
- Anemic domain models vs rich domain models
Async/Await:
- Missing
awaiton async calls async voidmethods (except event handlers)- Blocking on async code (
.Result,.Wait()) - Missing
ConfigureAwait(false)in library code - Task not returned properly
Exception Handling:
- Swallowing exceptions without logging
- Catching generic
Exceptionwithout re-throwing - Missing null checks that could cause
NullReferenceException - Not using
UserFriendlyExceptionwith translation keys (per TOM project guidelines)
Entity Framework:
- N+1 query problems
- Missing
AsNoTracking()for read-only queries - Lazy loading in loops
- Not disposing DbContext properly
Security:
- SQL injection vulnerabilities
- Missing input validation
- Hardcoded secrets/credentials
- Missing authorization checks
- XSS vulnerabilities in API responses
Resource Management:
IDisposablenot disposed- Missing
usingstatements - Event handlers not unsubscribed (memory leaks)
Angular Projects
Component Design:
- Components doing too much (violating SRP)
- Missing
OnPushchange detection for performance - Direct DOM manipulation instead of Angular bindings
- Missing
trackByin*ngForloops
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 155 lines · 86 tokens per session scan A 5ab939477c2d
local-code-reviewer is an agent published in the GitHub repository devMappouras/local-code-review-claude-plugin (1 stars, last pushed 8mo ago), licensed MIT. It adds 86 tokens to every session and 1,244 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
fullstack-engineer
Implements features that span both backend and frontend - new API endpoints with their frontend consumers, cross-stack refactors, type regeneration. Use when work touches both src/backend/ and src/frontend/.
product-owner
Analyzes the codebase, issues, and TODOs to propose prioritized work items. Run when deciding what to work on next or reviewing the project backlog.
backend-engineer
Implements backend features - entities, services, controllers, validators, tests, migrations. Use for .NET implementation work that stays within src/backend/.
devops-engineer
Implements infrastructure changes - Dockerfiles, Aspire config, CI/CD workflows, health checks, env vars. Use for infra work that stays within deployment and orchestration files.
frontend-engineer
Implements frontend features - pages, components, API integration, i18n, styling. Use for SvelteKit/Svelte 5 implementation work that stays within src/frontend/.
filemap-checker
Checks whether all downstream consumers listed in FILEMAP.md have been updated after a change. Use proactively after modifying files.