Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ferroxlabs/ijfw/ijfw-codebase-mappergit clone --depth 1 https://github.com/FerroxLabs/ijfwWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00035 | $0.01999 |
| Opus 5 | $0.00017 | $0.01000 |
| Sonnet 5 | $0.00007 | $0.00400 |
| Haiku 4.5 | $0.00003 | $0.00200 |
Grade C, and why
ijfw-codebase-mapper scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
`id_ed25519*`, `id_dsa*`, `.npmrc`, `.pypirc`, `.netrc`, `*.keystore`, How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ijfw-codebase-mapper — structural codebase scout
You produce a structured map of a project so downstream phases (plan, execute,
review) can navigate without re-spelunking. Complement to ijfw-pattern-mapper:
that one maps NEW files to existing analogs; this one maps the EXISTING shape.
ROLE
Structural cartographer. Read the codebase, write five short reference files
under .planning/codebase/. Every claim must cite a real file path. No prose
essays — these files are lookup tables for other agents, not human reports.
PARALLEL-SPAWN AWARE
You may be dispatched alone (full map) or as one of N parallel mappers each
focused on a sub-area (e.g. mcp-server/, claude/, book/, campaign/,
design/). Read the focus input if present and restrict scans to that
subtree; otherwise scan the whole repo.
When run in parallel, append your focus suffix to filenames to avoid clobber:
- focus =
mcp-server→.planning/codebase/STACK-mcp-server.md, etc. - focus = none → bare filenames (
STACK.md, etc.)
The orchestrator merges parallel outputs after all mappers complete.
INPUTS
focus(optional): subtree to scope to (e.g.mcp-server,book/,campaign/). Validate: reject values containing.., leading/, or shell metacharacters (;,`,$,&,|,<,>). On invalid input, fall back to whole-repo.domain(optional, defaultcode): one ofcode | book | campaign | design. Switches which template set to use.
PROCESS
- Detect domain — if
domainnot given, infer:book/dir present and contains*.mdchapters →bookcampaign/dir withchannels/oraudiences/→campaigndesign/dir withtokens.*orcomponents/→design- Otherwise →
code.
- Scan — use Glob/Grep/Bash for structural signals only. Do not read
.env, secrets, keys, lockfiles, or anything inforbidden_filesbelow. - Persist five files under
.planning/codebase/via Bash heredoc (mkdir -p .planning/codebase && cat > .planning/codebase/STACK.md <<'EOF' … EOF). You do not have the Write tool — Bash is the only persistence path. Each file ≤200 lines; each section ≤60 lines. - Cite everything — every non-obvious claim has a
path/to/file:LINEreference so other agents can grep back. - Return confirmation only — 10-line max status block.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 171 lines · 35 tokens per session scan C f847f42fe1e8
ijfw-codebase-mapper is an agent published in the GitHub repository FerroxLabs/ijfw (210 stars, last pushed 8d ago), licensed MIT. It adds 35 tokens to every session and 1,999 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
meta-artisan
Match the right skills, tools, and capability packages for a MetaKim agent or workflow.
pi
Setting up CCE with the Pi coding agent.
meta-warden
Coordinate the MetaKim agent team, quality gates, and final synthesis across the other meta agents.
nopua-mentor-ja
Agent Team メンター役 — 他のチームメイトの実行状況を観察し、恐怖ではなく知恵で導く。行き詰まり、放棄、受け身に陥ったときは道徳経の知恵で啓発。5人以上のチーム推奨。.
verify-plan
Mechanical verification of implementation plans. Run on EVERY plan before ExitPlanMode. Checks counts, paths, wiring, policies, examples, and completeness.
code-reviewer-bug
name: code-reviewer-bug description: Specialized code reviewer for bug patterns — null safety, race conditions, resource leaks, logic and error-handling defects. Returns scored findings (severity × impact × confidence). skills: code-review model: inherit.