Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/effortlessmetrics/xchecker/boltgit clone --depth 1 https://github.com/EffortlessMetrics/xcheckerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00314 |
| Opus 5 | $0.00000 | $0.00157 |
| Sonnet 5 | $0.00000 | $0.00063 |
| Haiku 4.5 | $0.00000 | $0.00031 |
Grade A, and why
bolt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Bolt's Journal
2026-01-23 - [GlobSet Optimization]
Learning: Checking a file path against multiple GlobSets sequentially is less efficient than combining them into a single GlobSet and checking match indices. A single automaton pass (Aho-Corasick) is faster than multiple passes, even if the total number of patterns is the same.
Action: When classifying strings against multiple disjoint sets of patterns, combine them into one GlobSet (or RegexSet) and use the match index to map back to the classification.
2024-05-22 - [Dependency Policy Violation]
Learning: Adding new dependencies (even dev-dependencies or transient ones like rayon) requires explicit approval.
Action: Always check Cargo.toml constraints and ask before adding deps. Use std::thread::scope for simple parallelism instead.
2024-05-22 - [Optimized File Reading]
Learning: In high-throughput file processing (like packet assembly), using fs::metadata(path) followed by fs::read_to_string(path) introduces a TOCTOU race condition and redundant syscalls (resolving the path twice).
Action: Use fs::File::open(path) to get a handle, then file.metadata() (fstat) and file.read_to_string() to read content. This is faster and safer. Also pre-allocate buffers using String::with_capacity(metadata.len()).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 15 lines · 0 tokens per session scan A 47d6be08ac3a
bolt is an agent published in the GitHub repository EffortlessMetrics/xchecker (1 stars, last pushed 3mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 314 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
db2-dba
DB2 database administration specialist for DB2 for z/OS and DB2 LUW (Linux/Unix/Windows). Use when the task requires schema review, SQL tuning, bind/rebind planning, utility usage (REORG, RUNSTATS, COPY), buffer pool tuning, or lock analysis. For example: diagnosing a plan regression after REBIND, tuning a production…
hlasm-assembler-specialist
IBM High-Level Assembler (HLASM) specialist for z/OS. Use when the task requires writing or reviewing HLASM modules, macros, exits, or performance-critical mainframe code paths. For example: authoring a user SVC, reviewing a system exit, writing a macro for a shared copybook convention, or diagnosing an S0Cx abend…
performance_engineer
Performance engineering specialist for bottleneck identification, profiling, and optimization. Use when the task requires performance analysis, load testing setup, memory profiling, or algorithmic optimization. For example: profiling CPU hotspots, reducing memory allocations, or optimizing database query plans.
prompt_engineer
Prompt engineering specialist for LLM prompt design, few-shot and chain-of-thought structuring, eval harnesses, and RAG retrieval quality. Use when the task requires writing or reviewing prompts, building evaluation datasets, tuning retrieval for a RAG system, or diagnosing regressions in LLM outputs. For example…
code_reviewer
Code review specialist for identifying bugs, security vulnerabilities, and code quality issues. Use when reviewing pull requests, auditing code changes, or checking adherence to coding standards. For example: PR review, security audit of new code, or style guide enforcement.
wtfp-plan-checker
Determine whether proposed section plans are likely to produce the intended academic outcome. Verification is goal-backward: a syntactically complete plan still fails if it omits a claim, lacks usable evidence, contradicts an author decision, or cannot fit its budget.