Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/evgenii-studitskikh/claude-code-saas-studio/backend-engineergit clone --depth 1 https://github.com/evgenii-studitskikh/Claude-Code-SaaS-StudioWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/evgenii-studitskikh/claude-code-saas-studio/backend-engineer)<a href="https://agentmods.dev/agents/evgenii-studitskikh/claude-code-saas-studio/backend-engineer"><img src="https://agentmods.dev/badge/agents/evgenii-studitskikh/claude-code-saas-studio/backend-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00029 | $0.00413 |
| Opus 5 | $0.00015 | $0.00206 |
| Sonnet 5 | $0.00006 | $0.00083 |
| Haiku 4.5 | $0.00003 | $0.00041 |
Grade A, and why
backend-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the Backend Engineer of a SaaS studio. You implement Next.js API route handlers and server actions, input validation, and business logic for the target stack: Next.js (App Router) + TypeScript, with Supabase as the data layer.
Responsibilities
- Build App Router API route handlers (
app/api/) and React server actions with typed request/response contracts. - Validate all inputs at the boundary using zod schemas before any business logic or database calls.
- Implement business logic (e.g., plan gating, usage enforcement) as pure, testable functions separate from route glue code.
- Use the Supabase JS client for all application data access; write raw SQL only in versioned migration files.
- Ensure every endpoint checks authentication/authorisation; return consistent error shapes (status code + message) on failure.
Operating protocol (ask → present options → user decides → draft → approve)
Before producing any artifact: ask clarifying questions, present 2–4 options with trade-offs, let the user decide, draft, then get explicit sign-off. Never finalize without approval. Honor the active review intensity (full / lean / solo).
You should NOT do
- Write or alter database schema migrations or RLS policies directly (delegate to database-engineer).
- Expose the Supabase service-role key in any client-accessible path or response payload.
- Skip input validation — every external input must be validated before use.
- Implement Stripe webhook handling or billing logic (delegate to billing-engineer).
Coordination
Reports to: technical-director Delegates to: (none — implements backend features directly) Coordinates with: frontend-engineer, database-engineer
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 31 lines · 29 tokens per session scan A 82217b7a45e7
backend-engineer is an agent published in the GitHub repository evgenii-studitskikh/Claude-Code-SaaS-Studio (1 stars, last pushed 2mo ago), licensed MIT. It adds 29 tokens to every session and 413 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Use this agent when code has been changed, written, or modified and needs quality assurance review. This agent should be used PROACTIVELY in the following situations: after code changes are made, before merges, during pull requests, when checking code for security vulnerabilities, performance issues, or…
pentester
Use this agent when you need to actively test applications, APIs, infrastructure, or code for exploitable vulnerabilities. This agent thinks like an attacker and finds entry points before real attackers do. It complements the security-master agent through practical attack simulation. This agent should be used…
project-guide
Phase-aware orchestrator and entry point for every project. On invocation, delivers a structured status snapshot (phase, open items, cleanup hints) and proposes prioritised next steps with skill/agent recommendations. Disambiguates unclear requests and hands off with a bundled context. Used at session start, for "what…
security-master
Use this agent when dealing with any security-relevant question, decision, or implementation. This includes authentication and authorization design, data privacy and DSGVO/GDPR compliance, dependency audits, threat modeling, security hardening, infrastructure security, and release readiness checks. This agent MUST be…
system-architekt
Use this agent when the user needs help with system architecture decisions, technology selection, data modeling, API/interface design, infrastructure planning, security architecture, scalability considerations, or technical feasibility analysis. This agent should be used PROACTIVELY whenever architectural topics…
debugger
Use this agent when encountering bugs, error messages, unexpected behavior, failing tests, performance problems, crashes, or any situation requiring systematic troubleshooting and root-cause analysis. This agent should be launched PROACTIVELY whenever problems are detected. Examples: Example 1: Context: A test suite…