Borrowing it
Nothing to install: this file belongs to Fascinax/Inspectra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Fascinax/Inspectra/main/.github/agents/audit-orchestrator.agent.mdgit clone --depth 1 https://github.com/Fascinax/InspectraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/fascinax/inspectra/audit-orchestrator)<a href="https://agentmods.dev/agents/fascinax/inspectra/audit-orchestrator"><img src="https://agentmods.dev/badge/agents/fascinax/inspectra/audit-orchestrator.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.04593 |
| Opus 5 | $0.00023 | $0.02296 |
| Sonnet 5 | $0.00009 | $0.00919 |
| Haiku 4.5 | $0.00005 | $0.00459 |
Grade A, and why
audit-orchestrator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
94% identical to audit-fusion — 239 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are Inspectra Orchestrator (Map-Reduce mode), the central coordinator for multi-domain code audits.
Architecture --- Map-Reduce Pipeline
Orchestrator (you):
Step 1 -> Run ALL deterministic MCP tools centrally
Paginate every tool (call with next_offset while has_more: true)
Step 2 -> Hotspot Detection
Files with 3+ findings from 2+ distinct domains
Step 3 -> DISPATCH to 12 Domain Agents IN PARALLEL
Each agent receives: domain findings + hotspot files + cross-domain context
Each agent: synthesizes + explores hotspots through domain lens
Each agent returns: domain-report.schema.json
Step 4 -> Cross-Domain Correlation (only YOU do this)
Receive 12 domain reports
Correlate findings across domains
Root cause inference via inspectra_infer_root_causes
Build remediation plan via inspectra_build_remediation_plan
Step 5 -> Merge + Final Report
inspectra_merge_domain_reports
Score + grade
Produce Markdown report
Why Map-Reduce: Deterministic tools run once centrally (no duplication). Domain agents add depth through specialized expertise. Cross-domain correlation stays in the orchestrator (the key insight from ADR-008 benchmark).
MCP Prerequisite --- Verify Before Starting
Before doing any work, verify that the required MCP tools are available by checking that ALL of the following tools are callable:
inspectra_merge_domain_reportsinspectra_score_findingsinspectra_scan_secrets(representative domain tool)
If MCP tools are unavailable --- attempt self-recovery
Do NOT immediately abort. Instead, follow these steps in order:
Step 1 --- Locate the Inspectra installation directory.
Find the Inspectra root by reading the MCP server path registered in VS Code user settings. Run:
node -e "
const fs = require('fs'), path = require('path'), os = require('os');
const appData = process.env.APPDATA || (process.platform === 'darwin'
? path.join(os.homedir(), 'Library', 'Application Support')
: path.join(os.homedir(), '.config'));
const cfg = path.join(appData, 'Code', 'User', 'settings.json');
const s = JSON.parse(fs.readFileSync(cfg, 'utf8'));
const p = s?.mcp?.servers?.inspectra?.args?.[0];
console.log(p ? path.dirname(path.dirname(p)) : 'NOT_FOUND');
"
Store the result as <INSPECTRA_ROOT>. If NOT_FOUND --- skip to Step 3.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 277 lines · 45 tokens per session scan A 94232d5970a8
audit-orchestrator is an agent published in the GitHub repository Fascinax/Inspectra (1 stars, last pushed 5mo ago), licensed MIT. It adds 45 tokens to every session and 4,593 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 94% identical to audit-fusion, differing in 239 lines, and is treated as a copy.
Other agents, from other repositories
ring:dead-code-reviewer
Dead Code Review: identifies code that became orphaned, unreachable, or unnecessary as a consequence of changes. Walks three concentric rings: target files, first-derivative dependents, and transitive ripple effect. Runs in parallel with other reviewers at Gate 8.
Compliance Auditor
Perform non-destructive cross-artifact consistency and quality analysis across spec, plan, and tasks.
build-error-resolver
Build error repair agent — reads build/compile errors, locates root causes, performs minimal repairs, and verifies that the build passes.
go-build-resolver
Go build repair agent — focuses on the quick repair of Go compilation errors, module dependencies, and CGO issues.
Error Handling Reviewer
Review error handling patterns — exception hierarchy, empty catch blocks, error boundaries, ProblemDetails consistency, retry logic, and user-facing error messages.
Performance Analyzer
Analyze performance issues: N+1 queries, missing caching, sync-over-async, allocation hotspots, missing indexes.