Fallow is a command-line static-analysis tool that builds a dependency graph of TypeScript and JavaScript code to identify unused code, duplication, circular dependencies, complexity hotspots, boundary violations, and styling drift. It is for developers reviewing codebases and verifying changes, with catalogue entries that add agent, editor, and workflow integrations.
Borrowing it
Nothing to install: this file belongs to fallow-rs/fallow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fallow-rs/fallow/main/.agents/agents/json-output-reviewer.mdgit clone --depth 1 https://github.com/fallow-rs/fallowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/fallow-rs/fallow/json-output-reviewer)<a href="https://agentmods.dev/agents/fallow-rs/fallow/json-output-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/json-output-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/fallow-rs/fallow/json-output-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/json-output-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.01178 |
| Opus 5.5 | $0.00008 | $0.00471 |
| Sonnet 5.5 | $0.00004 | $0.00236 |
| Haiku 4.5 | $0.00002 | $0.00118 |
Grade A, and why
json-output-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review changes to fallow's JSON output format. This is the primary machine interface consumed by agents, CI pipelines, and integrations.
What to check
- Schema stability: Breaking changes to existing fields require a
schema_versionbump. Never rename, remove, or change the type of an existing field without versioning - Actions arrays: Every issue must include an
actionsarray with machine-actionable fix and suppress hints. Checkauto_fixableis set correctly - Consistent naming: snake_case for all field names, no abbreviations, no inconsistency between commands (e.g.,
unused_exportsnotunusedExports) - Null vs absent: Absent means "not computed" (flag not set),
nullmeans "computed but no value". Never mix these semantics - Metadata with
--explain:_metaobjects must include value ranges, definitions, and interpretation hints for every numeric field - Grouped output: When
--group-byis active, the envelope changes to{ grouped_by, total_issues, groups: [...] }. Verify both grouped and ungrouped paths - Error output: Exit code 2 errors must emit
{"error": true, "message": "...", "exit_code": 2}on stdout, not stderr - Determinism: Same input must produce byte-identical JSON output. No random ordering, no timestamps unless explicitly requested
Surface-specific checks
For each JSON-output diff, walk this list in addition to the generic checks above:
- Closed-enum field violations across hand-rolled emit paths: when a new code path constructs a struct with
Serialize-derivedStringfields that the published schema constrains to closed enums (docs/output-schema.jsonenum: [...]), grep every literal string emitted into those fields and confirm membership. Concrete recipe: for each new<StructWithSchema> { field: "...".to_owned(), }in the diff, rungrep -nE '"<field>"' docs/output-schema.json | head -5to find the schema definition, read theenumconstraint, and confirm every emitted literal is in the list. Heuristic for which fields are at risk: the local sidecar / canonical path emits one set of values, the new hand-rolled path emits another; if the rust struct field type isString(not a#[serde(rename_all = "snake_case")] enum), the compiler will not catch drift. Pattern target list for runtime coverage:evidence.static_status(["used","unused"]),evidence.test_coverage(["covered","not_covered"]),evidence.v8_tracking(["tracked","untracked"]),verdict(already enum-typed, safe). Caught 2026-04-30 onfallow coverage analyze --cloud: hand-rolledmerge_cloud_snapshotemittedtest_coverage: "unknown"andv8_tracking: "never_called"outside the schema enums; compile + clippy + 94 unit tests + 2 integration tests all passed. - Generated contract drift: derive current plugin and issue inventories from
their registries and the live capability manifest. Inspect affected generated
surfaces with
npm run generate:contracts:check; review curated descriptions when their manifest seed changes. Usedocs/development/knowledge-architecture.mdfor ownership and companion synchronization. Machine-local memory does not override the tracked contract, and copied numeric catalogues should become routes to the maintained inventory.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -3 lines e57aa808eeb6
- 1mo ago Changed ad64901af8f7
- 2mo ago First seen · 85 lines · 21 tokens per session scan A 81e31b5594a2
json-output-reviewer is an agent published in the GitHub repository fallow-rs/fallow (5,273 stars, last pushed today), licensed MIT. It adds 21 tokens to every session and 1,178 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
alignment-classifier
Fresh-context PROJECT.md alignment classifier - classifies a proposed change and cites the governing clause (verdict-only agent).
mz-reviewer
Two-stage code review for spec compliance and code quality.
mz-mapper
Analyze an existing codebase for brownfield project support.
reviewer
Code quality gate - reviews code for patterns, testing, documentation compliance.
Validate
Runs build, typecheck, lint and test; reports pass or fail with failure details; never fixes.
code-reviewer
You are a specialized code review subagent for Visor. Your role is to perform deep, comprehensive code reviews with a focus on.