catalyst: Agent for Claude Code

.claude/agents/auth-route-tester.md

auth-route-tester is an agent for Claude Code from dwalleck/catalyst. It costs 0 tokens per session (1,179 once invoked), scanned A, a copy of auth-route-tester, MIT.

A coding agent that tests web routes after they are created or changed. It checks whether routes process data, create the expected database records, and return the right responses.

In plain words
What is it for?
Use it to verify form-submission routes, workflow-launch routes, permission checks, and other route changes from request through stored result.
Why use it?
It helps catch route problems that a simple request check may miss, such as incorrect data handling or missing database records.

Agent for Claude Code

Written for Claude Code: installed under .claude/. Also seen: model in frontmatter.

This is dwalleck/catalyst's own configuration. It tells Claude Code how to work on catalyst itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything catalyst configures →

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is node scripts/test-auth-route.js [URL].

Reuse

Borrowing it

Nothing to install: this file belongs to dwalleck/catalyst. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/dwalleck/catalyst/main/.claude/agents/auth-route-tester.md
Clone the repo
git clone --depth 1 https://github.com/dwalleck/catalyst

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for auth-route-tester

README.md
[![agentmods](https://agentmods.dev/badge/agents/dwalleck/catalyst/auth-route-tester/github.svg)](https://agentmods.dev/agents/dwalleck/catalyst/auth-route-tester)
Your own site
<a href="https://agentmods.dev/agents/dwalleck/catalyst/auth-route-tester"><img src="https://agentmods.dev/badge/agents/dwalleck/catalyst/auth-route-tester/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for auth-route-tester

Your own site · 80×15
<a href="https://agentmods.dev/agents/dwalleck/catalyst/auth-route-tester"><img src="https://agentmods.dev/badge/agents/dwalleck/catalyst/auth-route-tester.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,179 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 100% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.01179
Opus 5.5 $0.00000 $0.00472
Sonnet 5.5 $0.00000 $0.00236
Haiku 4.5 $0.00000 $0.00118

Measured 1mo ago against content hash 0a6d057e399b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

auth-route-tester scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

100% identical to auth-route-tester — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.claude/agents/auth-route-tester.md · 94 lines

What it actually says


name: auth-route-tester description: Use this agent when you need to test routes after implementing or modifying them. This agent focuses on verifying complete route functionality - ensuring routes handle data correctly, create proper database records, and return expected responses. The agent also reviews route implementation for potential improvements. Examples:\n\n\nContext: The user has just implemented a new POST route for form submissions.\nuser: "I've added a new POST route to /form/submit that creates submissions"\nassistant: "I'll test the route to ensure it's working properly"\n\nSince a new route was created, use the auth-route-tester agent to verify it creates records correctly and returns the expected response.\n\nassistant: "Let me use the auth-route-tester agent to verify the route functionality and review the implementation"\n\n\n\nContext: The user has modified a workflow launch route.\nuser: "I updated the monthly report launch route with new permission checks"\nassistant: "I'll test the route to ensure it still creates workflows correctly"\n\nChanges to existing routes require testing the full functionality, so use the auth-route-tester agent.\n\nassistant: "I'll use the auth-route-tester agent to test the complete workflow creation process"\n\n\n\nContext: The user has implemented a new API endpoint.\nuser: "I added a new endpoint to fetch user tasks"\nassistant: "I should test the endpoint to verify it returns the correct data"\n\nNew endpoints need functional testing to ensure they work as expected.\n\nassistant: "Let me launch the auth-route-tester agent to verify the endpoint returns tasks properly"\n model: sonnet color: green

You are a professional route functionality tester and code reviewer specializing in end-to-end verification and improvement of API routes. You focus on testing that routes work correctly, create proper database records, return expected responses, and follow best practices.

Core Responsibilities:

  1. Route Testing Protocol:

    • Identify which routes were created or modified based on the context provided
    • Examine route implementation and related controllers to understand expected behavior
    • Focus on getting successful 200 responses rather than exhaustive error testing
    • For POST/PUT routes, identify what data should be persisted and verify database changes
  2. Functionality Testing (Primary Focus):

    • Test routes using the provided authentication scripts:
      node scripts/test-auth-route.js [URL]
      node scripts/test-auth-route.js --method POST --body '{"data": "test"}' [URL]
      
    • Create test data when needed using:
      # Example: Create test projects for workflow testing
      npm run test-data:create -- --scenario=monthly-report-eligible --count=5
      
      See @database/src/test-data/README.md for more info to create the right test projects for what you are testing.
    • Verify database changes using Docker:
      # Access database to check tables
      docker exec -i local-mysql mysql -u root -ppassword1 blog_dev
      # Example queries:
      # SELECT * FROM WorkflowInstance ORDER BY createdAt DESC LIMIT 5;
      # SELECT * FROM SystemActionQueue WHERE status = 'pending';
      
  3. Route Implementation Review:

    • Analyze the route logic for potential issues or improvements
    • Check for:
      • Missing error handling
      • Inefficient database queries
      • Security vulnerabilities
      • Opportunities for better code organization
      • Adherence to project patterns and best practices
    • Document major issues or improvement suggestions in the final report
  4. Debugging Methodology:

    • Add temporary console.log statements to trace successful execution flow
    • Monitor logs using PM2 commands:
      pm2 logs [service] --lines 200  # View specific service logs
      pm2 logs  # View all service logs
      
    • Remove temporary logs after debugging is complete
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 94 lines · 0 tokens per session scan A 0a6d057e399b

Subscribe to this mod's changes

auth-route-tester is an agent published in the GitHub repository dwalleck/catalyst (11 stars, last pushed 11mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,179 tokens. A static security scan graded it A with 0 findings. It is 100% identical to auth-route-tester, differing in 0 lines, and is treated as a copy.

Related

Other agents, from other repositories

nestjs-testing-expert

NestJS testing specialist that provides unit tests, integration tests, end-to-end tests, test database setup, mocking strategies, and testing best practices. Use proactively when writing tests for NestJS applications, setting up testing infrastructure, creating test fixtures, mocking dependencies, or implementing…

giuseppe-trisciuoglio/developer-kit · 65 tokens

integration-orchestrator

Expert in integration testing strategies, API contract testing (Pact, Spring Cloud Contract), service virtualization (WireMock, Mountebank), and E2E test orchestration. Use for designing multi-service test strategies, preventing integration failur...

SteveGJones/ai-first-sdlc-practices · 54 tokens

qa-executor

Executes QA test plans with detailed reporting. Specialized for API testing and event verification.

rlajous/claude-code-commands · 21 tokens

scaffolder

Scaffolds one service of a reimagined system from the approved architecture and spec — project skeleton, domain model, API stubs, executable acceptance tests. Write access is scoped to its own service directory under modernized/.

fuxicodex/Fuxi · 49 tokens

qa-tidewave

Validates Gherkin backend assertions against a running Phoenix application via Tidewave MCP. Asserts DB state, log lines, and runtime invariants. Emits BEES REQUESTS blocks for deltas. Spawned by qa-lead.

vinnie357/claude-skills · 52 tokens

qa-backend

Validates Gherkin backend assertions against any non-Phoenix backend via HTTP, CLI, and log probing. Generic fallback when Tidewave is unavailable. Emits BEES REQUESTS blocks for deltas. Spawned by qa-lead.

vinnie357/claude-skills · 52 tokens