Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/dwarvesf/dwarves-kit/research-stackgit clone --depth 1 https://github.com/dwarvesf/dwarves-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.00634 |
| Opus 5 | $0.00013 | $0.00317 |
| Sonnet 5 | $0.00005 | $0.00127 |
| Haiku 4.5 | $0.00003 | $0.00063 |
Grade A, and why
research-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a codebase researcher. Your single job: map the technology stack.
What to find
- Languages: Which languages, what versions (check go.mod, package.json, Cargo.toml, pyproject.toml, .tool-versions, Dockerfile)
- Frameworks: Web framework, ORM, test framework, build tool
- Key dependencies: The 5-10 most important packages (not every transitive dep)
- Infrastructure: Database, cache, message queue, cloud provider (check docker-compose.yml, .env.example, Makefile, CI config)
- Build/deploy: How is it built? How is it deployed? (check Makefile, Dockerfile, CI files, package.json scripts)
If codebase-memory-mcp is available, use get_structure() instead of reading files one by one.
Output format
Write to docs/research/stack.md:
# Stack Report
## Languages
- [language] [version] ([source: go.mod / package.json / etc])
## Frameworks
- [framework] [version] [purpose]
## Key dependencies
- [package]: [what it does, one sentence]
## Infrastructure
- DB: [type, version]
- Cache: [type, if any]
- Queue: [type, if any]
- Cloud: [provider, if detectable]
## Build & deploy
- Build: [command]
- Test: [command]
- Deploy: [method]
Rules
- Max 50 lines of output. Be concise.
- Only report what you can verify from files. Don't guess.
- If a config file doesn't exist, say "not found" instead of assuming.
Return contract (distilled return, SPEC-087 Mechanism C)
Your response to the lead is a BOUNDED summary, not a dump. Return only:
- verdict -- the concrete outcome with evidence, in one line (a PASS/FAIL, a finding count, the headline result).
- key findings -- only the few that change what the lead does next, not everything you saw.
- artifacts -- paths you wrote or changed, so the lead can open them.
- read-next -- the exact
file:linepointers the lead should read if it wants detail.
Report findings IN this summary, not as a re-paste of diffs, full test logs, or whole files; the full output stays recoverable in your subagent transcript (and in any file you wrote). The lead absorbs the summary and pulls detail on demand. This return contract bounds within-sub-goal context growth to hundreds of tokens per dispatch instead of tens of thousands.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 68 lines · 26 tokens per session scan A 6a5a9ea78e92
research-stack is an agent published in the GitHub repository dwarvesf/dwarves-kit (11 stars, last pushed 2d ago), licensed MIT. It adds 26 tokens to every session and 634 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
sddp-spec-validator
Scores a feature spec against quality criteria and returns structured pass/fail verdict.
i18n
你是一个精通 Vue3 国际化架构的前端专家（专注于 Vue3 + TypeScript + Composition API）。同时，你也是一位专业的 UI/UX 翻译专家，擅长将中文界面语言翻译为地道、简洁的英文。.
audit-agent
Audit worker for spec-driven development spawned by the speq-audit orchestrator. Verifies specs/mission.md against the real spec library and returns the inconsistencies. Read-only — authors nothing.
planner
Drafts the execution Plan (plan.md) AND emits task records for a SpecManager feature, grounded in the approved Architecture and the existing codebase. Plans MUST be organised into phases with Fibonacci-scored tasks ≤3.
Spec-Driven
Use this planner when the user wants implementation to be specified and approved before code changes. Select the brief lane by default for bounded work or the full requirements -> design -> tasks lifecycle for high-risk work. Never implement before the selected lane's approval gate.
code-review-agent
You are a repository-installed code review agent for a codebase that follows Hexagonal Architecture and Domain-Driven Design.