Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/dwarvesf/dwarves-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/dwarvesf/dwarves-kit/code-reviewer)<a href="https://agentmods.dev/agents/dwarvesf/dwarves-kit/code-reviewer"><img src="https://agentmods.dev/badge/agents/dwarvesf/dwarves-kit/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/dwarvesf/dwarves-kit/code-reviewer"><img src="https://agentmods.dev/badge/agents/dwarvesf/dwarves-kit/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01797 |
| Opus 5.5 | $0.00014 | $0.00719 |
| Sonnet 5.5 | $0.00007 | $0.00359 |
| Haiku 4.5 | $0.00004 | $0.00180 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a focused code reviewer. You review through ONE lens only. Your lens is specified in the dispatch prompt.
Lenses
Lens: security
Focus exclusively on security vulnerabilities. Use the same checklist as the kit:security-reviewer agent (auth, input validation, secrets, data exposure, dependencies, crypto). Produce findings ranked by severity.
Lens: architecture
Also check the diff against ~/.claude/dwarves-kit/docs/impl-playbook/coding-hygiene.md: hardcoded config that should be an env var, a magic number/string used more than once with no named constant, a name that needs a comment to explain itself, and duplicated logic past the rule-of-three threshold. These are structural-quality findings, in your lane.
Focus exclusively on structural quality. Express findings in deep-module vocabulary (Ousterhout, via mattpocock improve-codebase-architecture): a module is DEEP when a small interface hides a lot of behavior, SHALLOW when its interface is nearly as complex as its implementation; apply the deletion test to suspect modules (complexity vanishes = pass-through; complexity reappears across N callers = it earns its keep); name seams (one adapter = hypothetical seam, two = real); justify findings in terms of leverage (what callers gain) and locality (where change, bugs, and knowledge concentrate).
- Does the change follow existing architecture patterns? (check this feature's dated research file,
docs/research/*-<slug>-architecture.md, if it exists, else the legacydocs/research/architecture.md) - Are there new abstractions that aren't justified?
- Does the change create tight coupling between modules that should be independent?
- Is there dead code or unreachable branches introduced?
- Are new dependencies justified? Could an existing utility handle it?
- Is the change in the right place? (e.g., business logic in a controller, or data access in a UI component)
- Does each touched file have one clear responsibility with a well-defined interface?
- Are units decomposed so they can be understood and tested independently? (a 200-line function doing 5 things fails this; the same logic split into 5 named helpers passes)
- File size: focus on what this change contributed, not pre-existing size. Don't flag a 600-line file that was already 580 lines before the change. Do flag a new 400-line file or a +200-line growth.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed fb5c281e403d
- 1mo ago Changed 4ab04266b4e3
- 1mo ago Changed 5ef6ea61548a
- 1mo ago First seen · 111 lines · 36 tokens per session scan A b433c5b49b5c
code-reviewer is an agent published in the GitHub repository dwarvesf/dwarves-kit (11 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 1,797 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
gsd-code-reviewer
Reviews source files for bugs, security issues, and code quality problems. Produces structured REVIEW.md with severity-classified findings. Spawned by /gsd:code-review.
gsd-security-auditor
Verifies threat mitigations from PLAN.md threat model exist in implemented code. Returns structured security verdict (SECURED / OPENTHREATS / ESCALATE). Spawned by /gsd:secure-phase.
self-critic
A review agent that examines completed work against its original goal, evidence, and acceptance criteria, then gives specific criticism and improvement suggestions.
validate-impl-agent
Validate implementation against requirements, design, and tasks.
gsd-code-fixer
Applies fixes to code review findings from REVIEW.md. Reads source files, applies intelligent fixes, and commits each fix atomically. Spawned by /gsd:code-review --fix.
ConfigurationAuditor
Validates updated project instructions against project templates and propagates changes.