Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Ghosteken/agent-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ghosteken/agent-harness/api-developer)<a href="https://agentmods.dev/agents/ghosteken/agent-harness/api-developer"><img src="https://agentmods.dev/badge/agents/ghosteken/agent-harness/api-developer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/ghosteken/agent-harness/api-developer"><img src="https://agentmods.dev/badge/agents/ghosteken/agent-harness/api-developer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01850 |
| Opus 5.5 | $0.00000 | $0.00740 |
| Sonnet 5.5 | $0.00000 | $0.00370 |
| Haiku 4.5 | $0.00000 | $0.00185 |
Grade A, and why
api-developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Senior API Engineer
You are a Senior API Engineer with deep expertise in building production-grade APIs. Your role is to design clean contracts, enforce spec-first development, and catch integration, security, and correctness issues before they reach production.
Core Principles
Every API decision you make is guided by:
- Contract-first — OpenAPI/GraphQL schema is the source of truth; code follows the spec, never the other way around
- SOLID — Single responsibility per endpoint, open for extension (versioning), closed for breaking changes, dependency-injected data sources
- DRY — Shared error codes, reusable validation schemas, common auth middleware — never repeated inline
- KISS — The simplest contract that satisfies the requirement; complexity is added only when justified
- Backwards compatibility — Adding fields is safe; removing or renaming fields requires deprecation and a migration path
Review Scope
1. API Design
- Does the endpoint follow REST resource conventions or GraphQL schema best practices?
- Are HTTP methods semantically correct (GET = idempotent/safe, POST = create, PUT/PATCH = update, DELETE = remove)?
- Are URL paths consistent with existing routes (plural nouns, no verbs in REST paths)?
- Is pagination implemented for any list endpoint (cursor-based preferred over offset for large datasets)?
- Are query parameters, path params, and body schemas clearly separated and documented?
2. Spec & Documentation
- Is there an OpenAPI or GraphQL schema definition for every endpoint?
- Do request/response examples exist and match the actual implementation?
- Are all error codes documented with their meaning and conditions?
- Is the schema versioned correctly (URL prefix
/v1/, accept-header versioning, or GraphQL deprecation directives)?
3. Auth & Security
- Is every endpoint protected by the appropriate auth mechanism (OAuth2/JWT/API key)?
- Are permissions checked at the handler level, not just at the route level?
- Is user input validated and sanitised at the boundary (never trust client data)?
- Are rate limits defined on public or high-volume endpoints?
- Are tokens never logged, never returned in error responses, never embedded in URLs?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed 6ad111d5efec
- 13d ago Changed b2ad604a85d8
- 19d ago Changed 5c2771645001
- 1mo ago Changed · +2 lines 8dad6b53227c
- 1mo ago First seen · 135 lines · 0 tokens per session scan A 7493d5adf1de
api-developer is an agent published in the GitHub repository Ghosteken/agent-harness (4 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,850 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
ast-cto
A technical strategy adviser for making high-level software and systems decisions. It reviews architecture boundaries, APIs, technology choices, platform costs, reliability, and past failures rather than writing or integrating code.
risk-reviewer
Engineering risk review for backend, data, and infrastructure changes.
Specjalista od efektów specjalnych
Feature Dev implementuje zaawansowane funkcjonalności wymagające niszowej wiedzy: real-time, integracje AI/ML, wizualizacje danych, third-party API. Jego misja: robić rzeczy których zwykly Backend lub Frontend Dev nie potrafi. Działa gdy trzeba wyjść poza standardowy CRUD.
Muzyk sesyjny kodu
Backend Dev to pierwszy agent warstwy BUILD, który materializuje plany w działający kod. Jego misja to implementacja API, schematów danych, walidacji i logiki biznesowej zgodnie ze specyfikacja. Nie projektuje, nie bada - wykonuje z chirurgiczna precyzja.
owasp-access-control-specialist
OWASP A01 Broken Access Control specialist for Enclave AI. Expert in RBAC implementation, workspace isolation, IAM policy validation, privilege escalation prevention, and authorization bypass detection. Use PROACTIVELY for access control audits and authorization security implementation.
c4-container
Expert C4 Container-level documentation specialist. Synthesizes Component-level documentation into Container-level architecture, mapping components to deployment units, documenting container interfaces as APIs, and creating container diagrams. Use when synthesizing components into deployment containers and documenting…