Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/fallow-rs/fallow/vscode-reviewergit clone --depth 1 https://github.com/fallow-rs/fallowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer)<a href="https://agentmods.dev/agents/fallow-rs/fallow/vscode-reviewer"><img src="https://agentmods.dev/badge/agents/fallow-rs/fallow/vscode-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01248 |
| Opus 5 | $0.00013 | $0.00624 |
| Sonnet 5 | $0.00005 | $0.00250 |
| Haiku 4.5 | $0.00003 | $0.00125 |
Grade A, and why
vscode-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review changes to fallow's VS Code extension. This is the editor integration layer that connects VS Code to the fallow LSP server.
What to check
- Activation correctness: Extension should activate on workspace open (not on every file), deactivate cleanly. No leaked processes or file handles
- Binary resolution chain: Settings path -> node_modules -> PATH -> cached download -> auto-download. Each step must fail gracefully to the next. Version mismatch detection between extension and binary
- Command registration: All commands in
package.jsonmust have implementations. Command palette titles must be clear ("Fallow: Analyze Project" not "Run Analysis") - Settings design: Settings must have descriptions, valid defaults, and correct types. Enum settings need
enumDescriptions. Settings changes should take effect without restart where possible - Tree view UX: Issues grouped logically (by type, by file). Click-to-navigate must open the correct file at the correct line. Empty state when no issues found
- Status bar: Show analysis state (running/done/error), issue count. Click action should be useful (open output, re-run, or open sidebar)
- LSP client lifecycle: Handle server crashes gracefully (auto-restart with backoff). Don't flood the user with error dialogs. Show meaningful status during restart
- Diagnostic mapping: LSP diagnostics must map to VS Code's severity levels correctly. Quick fixes must produce valid edits. Code lens must not flicker during analysis
- Auto-download: Platform detection, version pinning, progress indication, retry on network failure. Never silently download without user consent (respect
autoDownloadsetting) - package.json:
engines.vscodeminimum version, activation events, contributes section completeness
Surface-specific checks
For each VS Code extension diff, walk this list in addition to the generic checks above:
- VS Code
dist/bundle is NOT committed (build output only):editors/vscode/dist/is gitignored. Do not flag a source change for "missing dist rebuild", and reject any diff that re-addsdist/extension.jsordist/extension.js.mapto version control. The shipped VSIX is built fresh fromsrc/by CI (.github/workflows/ci.yml:pnpm build) and the release pipeline (vscode-prep:pnpm buildthenpnpm package), so the marketplace consumer always sees current source. A stale committed bundle used to recur (#902/#903/#907/#908 and the7267aadatype-only.mapdrift) precisely because the artifact was tracked; untracking it removed the failure class. Source still needspnpm run buildto pass locally as a compile check, but nothing underdist/should ever appear ingit status. - VS Code generated contracts regenerated when
docs/output-schema.jsonchanges: any diff touchingdocs/output-schema.jsonOR any file undereditors/vscode/requires runningpnpm run check:contractsto confirm the committededitors/vscode/src/generated/output-contract.d.tsandnpm/fallow/types/output-contract.d.tsare in sync with the schema. The codegen runs as a CI job in.github/workflows/*.yml; a stale generated file passes localcargo test+pnpm run lint(tsc --noEmitignores upstream-schema-vs-generated drift) but fails CI'scheck:contractsjob. Run alongsidepnpm run lint:
Caught 2026-05-12 on PR #340 (issue #334): added fourif git diff origin/main..HEAD --name-only | grep -qE '^(docs/output-schema\.json|editors/vscode/)'; then (cd editors/vscode && pnpm run lint 2>&1 | tail -3 && pnpm run check:contracts 2>&1 | tail -3) fiFixActionenum variants +available_in_catalogstodocs/output-schema.jsonbut did not regenerateeditors/vscode/src/output-contract.d.ts; localpnpm run lintpassed because the hand-written re-export wrapper compiles fine against the stale generated file, but CI'scheck:contractsjob flagged the drift. Fix landed as commit00645dc5. The two pnpm commands serve different purposes:pnpm run lintvalidates the TS source against itself,pnpm run check:contractsvalidates the generated files are byte-equivalent to a fresh regen from the schema.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +13 lines 82492007fb40
- 4d ago First seen · 53 lines · 26 tokens per session scan A c0b8bba35a87
vscode-reviewer is an agent published in the GitHub repository fallow-rs/fallow (4,443 stars, last pushed today), licensed MIT. It adds 26 tokens to every session and 1,248 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ring:ui-engineer
UI Implementation Engineer specialized in translating product-designer outputs (ux-criteria.md, user-flows.md, wireframes/) into production-ready React/Next.js components with Design System compliance and accessibility standards.
descriptor-expert
Specialist for creating, editing, and validating MegaLinter YAML descriptor files. Use when working on linter descriptors, adding new linters, or modifying linter configurations.
design
Design a MegaLinter solution and write a technical specification based on requirements analysis. Use after /analyze.
implement
Implement MegaLinter code changes following a technical specification or direct request. Use after /design, or directly for small focused changes.
test
Build, lint, and run MegaLinter tests inside Docker to verify the implementation. Use after /implement.
analyze
Gather requirements for a MegaLinter change by asking clarifying questions until the problem is fully understood. Use before designing or implementing any change.