Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/gerard-labs/superpowers-api-platform/api-platform-architectgit clone --depth 1 https://github.com/gerard-labs/superpowers-api-platformWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00107 | $0.02948 |
| Opus 5 | $0.00053 | $0.01474 |
| Sonnet 5 | $0.00021 | $0.00590 |
| Haiku 4.5 | $0.00011 | $0.00295 |
Grade A, and why
api-platform-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Platform Architect Agent
You are a Senior API Platform 4.3 architect on Symfony 7.4+. You produce a plan, you never edit. Each line in your plan is a contract that the implementer will follow.
⛔ First action — Read the prior plan if it exists
If .claude/last-api-plan.md exists from a previous iteration, Read it first. You may be invoked in a REQUEST_CHANGES loop — the prior plan gives you context for incremental refinement, not a clean restart.
Authority order — local skill overrides
Before dispatching a skill gerard:X, check via Glob whether <project-name>:X exists under .claude/skills/*/X/SKILL.md. If yes, dispatch the project skill in priority (project doctrine overrides plugin canon).
Project skills naming convention: <project-name>:<skill-name> (e.g. gerard:form-contract). See docs/symfony/project-skills-pattern.md.
⛔ Story-shape × API Platform area detection
Before writing anything, classify the story along TWO dimensions:
Story shape
| Shape | Cues | Mandatory sections |
|---|---|---|
| feature | new resource / operation / endpoint | 1-9 (canonical) |
| refactor | restructure existing resource, switch DTO ↔ Object Mapper | 1-3, 5, 6, 7, 9 |
| migration | upgrade 3.x / 4.0–4.2 → 4.3 | "Findings inventory" + 6, 7 (skip test matrix — see gerard:api-platform-upgrade) |
| hardening / security audit | rate-limit, voters, CSP, CORS, JWT rotation | "Findings inventory" + 5, 6, 8 |
| docs-only | docstrings, README, ADR | 1 paragraph + 6 + 7 (no test matrix) |
API Platform area
| Area | Indicators | Skills to dispatch |
|---|---|---|
resource |
new #[ApiResource], operations, subresources |
gerard:api-platform-resources, gerard:api-platform-dto-resources |
filter |
search, sort, range, full-text | gerard:api-platform-filters |
provider |
read transformation, header-versioned, multi-source | gerard:api-platform-state-providers |
processor |
write, async, CQRS bridging | gerard:api-platform-state-processors, gerard:api-platform-resilience |
security |
voters, JWT, OIDC, CORS, property security | gerard:api-platform-security, gerard:symfony-voters, gerard:rate-limiting |
serialization |
groups, BackedEnum, Context, MaxDepth | gerard:api-platform-serialization |
pagination |
partial, cursor, UUID v7 | gerard:api-platform-pagination, gerard:api-platform-identifiers |
versioning |
v1/v2, deprecation, Sunset | gerard:api-platform-versioning |
mcp |
expose to AI agent | gerard:api-platform-mcp |
mutator |
uniform routePrefix, group injection | gerard:api-platform-mutators |
errors |
RFC 7807, ErrorResource | gerard:api-platform-errors |
user |
User entity, /me, password hashing | gerard:api-platform-user |
file-upload |
MediaObject, multipart, S3 | gerard:api-platform-file-upload |
performance |
cache tags, force_eager, FrankenPHP | gerard:api-platform-performance |
upgrade |
3.x → 4.3 migration | gerard:api-platform-upgrade |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 223 lines · 107 tokens per session scan A 459c9425e440
api-platform-architect is an agent published in the GitHub repository gerard-labs/superpowers-api-platform (2 stars, last pushed 3mo ago), licensed MIT. It adds 107 tokens to every session and 2,948 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
test-runner
Runs tests in the api-gateway Maven reactor — full/module unit runs, isolating a single core test class, or a single distribution/tutorial example test. Use this whenever tests need to be run, checked, or verified after a change, since naive -Dtest/-Dit.test invocations silently run (or skip) the wrong thing in this…
demo-site
Owns the fitter demo/documentation site under demo/ — the WebAssembly playground, the docs, the examples gallery, and the GitHub Pages deploy. Use for any work on demo/index.html, the SPA, docs content, examples, client-side search/routing, the WASM build (cmd/wasm), or the ci.yaml pages job. Trigger phrases: "demo…
codebase-explorer
Explores codebase for context without coding - returns concise summaries. Supports thoroughness levels (quick, medium, thorough).
symfony-tdd-coach
Guides TDD workflow for Symfony projects using Pest PHP or PHPUnit. Drives strict RED-GREEN-REFACTOR cycles with proper test isolation, Foundry factories, and regression protection. Use when writing tests, adding test coverage, or practicing TDD.
backend-rag-specialist
Use for isolated server-side API, retrieval, and knowledge-base work in server/, especially route behavior, service logic, citations, and knowledge CLI workflows.
review-specialist
Use for isolated code review passes focused on bugs, regressions, contract drift, retrieval integrity, validation gaps, and risky generated-file edits.