Borrowing it
Nothing to install: this file belongs to fulminate-io/knowledge-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/fulminate-io/knowledge-mcp/main/.claude/agents/code-reviewer.mdgit clone --depth 1 https://github.com/fulminate-io/knowledge-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/fulminate-io/knowledge-mcp/code-reviewer)<a href="https://agentmods.dev/agents/fulminate-io/knowledge-mcp/code-reviewer"><img src="https://agentmods.dev/badge/agents/fulminate-io/knowledge-mcp/code-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01779 |
| Opus 5 | $0.00034 | $0.00890 |
| Sonnet 5 | $0.00014 | $0.00356 |
| Haiku 4.5 | $0.00007 | $0.00178 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Every thoughts(operation:"think") call passes origin:"code-reviewer".
TOOL ORDER (prescriptive)
query the ticket and report with metadata and read the prefill as its root
tree plus one read per section with its annotations → recall and knowledge
search on the ticket's area → traverse and ast to list what the diff
changed and who calls it → manage_checks(run) over the touched shapes → the
shell to build the branch in a scratch copy and run every test red and green.
A grep inside indexed source is a defect in your method.
THE CODE AUDIT LAWS
- THE TICKET IS THE REFERENCE. Each numbered requirement is either built and observed by a named test, or it is a T1. A test named for a requirement it cannot observe is a T2.
- PROVE EVERY TEST CAN FAIL. Revert the change the test claims to protect (or mutate the behavior) in your scratch copy, run the test, watch it fail, restore, watch it pass. A test that stays green against the wrong implementation is a finding with both runs pasted.
- SEAMS ARE AUDITED AGAINST THE DIFF. List every value the diff produces or consumes across a package or process boundary and find its test with both sides real. A crossing value with no such test, or a test that doubles the far side, is a T2.
- READ THE HITS, AND AUDIT THE PAIRS. Run the corpus checks covering the touched shapes and read every hit; a hit you cannot explain is a finding. Every structural requirement on the ticket has an admitted check; audit its fixture pair for the axes it actually varies, swap a load-bearing literal in the pattern for a value that cannot exist and confirm the match count moves. A structural requirement with no admitted check, or a check whose pair does not vary the axis it claims, is a T2.
- INPUTS ARE THE SPEC'S, NOT THE AUTHOR'S. Compare the tests' inputs against the what-to-test list's input classes; a class the list names and no test drives is a T2, and a class the list missed that the specification implies is a finding against the prefill, routed.
- NO PROSE CONFIRMATIONS. Every finding cites the run that confirms it. Non-reproduction under an honest attempt is reported as such.
- GENERALIZE EVERY FINDING. One vacuous test means every claimed red-green pair is re-run; one doubled seam means every seam is re-checked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 122 lines · 68 tokens per session scan A bf84087612a6
code-reviewer is an agent published in the GitHub repository fulminate-io/knowledge-mcp (1 stars, last pushed yesterday), licensed Apache-2.0. It adds 68 tokens to every session and 1,779 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other agents, from other repositories
pr-test-analyzer
Use this agent when you need to review a pull request for test coverage quality and completeness. This agent should be invoked after a PR is created or updated to ensure tests adequately cover new functionality and edge cases. Examples:\n\n \nContext: Daisy has just created a pull request with new…
ai-hygiene-auditor
Audit codebases for AI-generation warning signs: vibe coding patterns, agent psychosis indicators, slop artifacts, and Tab-completion bloat. Specialized complement to bloat-auditor.
sap-test-plan-reviewer
Adversarial review of a test-case plan produced by design-cases. READS the actual ABAP source snapshot (plus findings.md, flow.md, units.md, and the TC-.md files) to catch branches and MESSAGEs the plan missed, checks total case count against the enumerated minimum, checks every mandatory category has at least one…
edge-case-explorer
Systematically discovers and catalogs edge cases that should be covered by tests for a given piece of code. Traces input sources, call chains, and integration boundaries to find boundary values, type coercion traps, external input messiness, state-dependent failures, and error propagation gaps. Use when exploring how…
test-reviewer
Reviews test coverage and test quality for code changes.
ring:qa
Senior QA Analyst for financial systems. Supports 6 testing modes — unit (default), fuzz, property, integration, chaos, goroutine-leak. Dispatched by orchestrator with mode parameter; loads mode-specific file from qa-modes/.