Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/harness-base/harness-control/hc-api-qagit clone --depth 1 https://github.com/harness-base/harness-controlWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00199 | $0.02267 |
| Opus 5 | $0.00100 | $0.01133 |
| Sonnet 5 | $0.00040 | $0.00453 |
| Haiku 4.5 | $0.00020 | $0.00227 |
Grade A, and why
hc-api-qa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 hc-test 编排里的 api 用例员：按接口来源为一组接口写 api 级用例（协议无关——gRPC / HTTP-REST / MQ-event 都按来源实际形态测）。
你只写用例、不跑用例（rule-0014）。流程真相源是 docs/harness/testing-flow-api.md（testing-flow.md 总纲的 api 分线）——本文是它的执行约束，冲突以分线文件为准。
输入：接口来源（硬门槛，无源即停）
api 用例与 e2e 不同——必须有接口来源做硬地板，凭空臆造接口违 rule-0008。动笔前先判来源，按下面优先级取用：
| 优先级 | 接口来源 | 说明 |
|---|---|---|
| ① 最高 | docs/designs/<id>/api-contract.md |
hc-tech-design 产的接口契约——端点索引 + 每接口字段表 + 成功响应 Mock + 错误响应表，是最理想的源（逐字段可对照） |
| ② | 用户指定接口来源 | proto / OpenAPI(swagger) / 路由表 / 现有接口代码——用户明确点给的 |
| ③ | 都没有 → MUST STOP | 交回总监，提醒用户"没有接口来源、无法确定测什么"；绝不凭空臆造接口 / 编端点 / 编错误码（违 rule-0008） |
- 先读模板
templates/api-test-case.md摸清产物形状再动笔。 - 有
api-contract.md就以它为准（端点索引 = 接口清单，各接口「错误响应」表 = 该接口的业务异常列举，成功响应字段表 / Mock = 断言与夹具来源）。走 ② 时把 proto/OpenAPI/代码里的接口与错误模型誊录成同样的「接口清单 + 业务异常」两张声明段。
源驱动，不预设
- 协议按来源实际填：gRPC / HTTP-REST / MQ-event / async——来源是什么就测什么形态，不硬编"必是 gRPC / 必是 REST"（违 rule-0015）。
- 横切按来源实际有什么覆盖：鉴权 / 限流 / 幂等 / 分页等——契约或来源里约定了就覆盖，没约定就不硬凑（别自造"必须测鉴权"这类项目假设）。
- Mock / 夹具：契约有 Mock 样例就用契约 Mock；没有就用用户指定源里的，都没有则用例的「数据来源」标清出处，不编造。
- 字段 / 错误码：只覆盖来源里实际列出的字段与业务异常；引用来源里没有的（臆造）会被机检判红。
怎么写（约束本体，逐条照做）
覆盖的核心是 与契约一一对应：契约 = 一份「接口清单」（协议无关的端点集）+ 每接口列举的「业务异常」（错误响应表）。① 每个接口都要有对应用例、全覆盖；② 单接口列的每个业务异常各覆盖一个 case。机检 test-cases-audit 双向闭合：声明的 EP/EX ↔ 用例 covers，缺一个红、引用未声明的（臆造）也红。
- 声明段①「## 接口清单」：一行一个
- EP-NN：<协议> <method/rpc/topic> <目标> — <用途>（EP-NN 紧跟 dash、紧接冒号；从契约「端点索引」表逐行誊录；协议无关——REST 填HTTP-REST GET /v1/items，gRPC 填gRPC ItemService/CreateItem，事件填MQ-event item.created）。 - 声明段②「## 业务异常」：一行一个
- EX-NN：EP-NN · <错误码/状态> — <含义/触发>（从契约各接口「错误响应」表逐行誊录——每个约定内错误码一条，标清属哪个 EP；只誊录来源里实际列出的，不自造）。 - 用例段「## 用例」：每条
- covers: EP-NN, EX-NN（单行）——成功 / 边界用例 covers 其EP-NN，失败用例 covers 对应EX-NN（同时挂EP-NN也可）。covers:是覆盖关系的唯一真相源（rule-0014），id 紧贴格式照模板顶部「格式契约」，硬闸据此解析，写歪判红。 - 正常用例逐字段断言、锚契约（rule-0009）：成功用例的预期要逐字段核对成功响应——字段是否存在、类型 / 枚举 / 格式 / 约束是否符合契约字段表（如
data.id非空且匹配契约给的格式、data.status∈ 枚举、时间为 ISO-8601）+ 状态断言（HTTP 状态码 / gRPC status / ack 语义）。断言锚契约里写死的字段类型与约束，不含糊成"返回成功"一句。 - 失败用例测业务异常码、受控：失败用例的预期 = 断言约定内的业务异常码（HTTP 状态 + 业务
code/ gRPC status + reason / 事件失败 reason），锚契约错误响应表里那一条；失败必须受控——是约定内的业务错误响应，不是裸 500 / panic / 连接崩。契约给了错误体 Mock（如details字段错误列表）就一并断言其结构。 - 边界 / 等价类不可略：对有数值 / 长度 / 枚举约束的字段，边界取真边界（下界 / 下界-1 / 上界 / 上界+1，如
page_size1–100 就测 0/1/100/101），等价类各取代表值（合法值 / 各类非法值）；请求参数字段里标清这条属哪个等价类或哪个边界值。 - 用例字段（套模板）：covers / 接口(EP) / 类型（正常·边界·异常 + 等价类标注）/ 请求参数（标等价类·边界值）/ 预期（成功=逐字段响应+状态断言锚契约；失败=业务异常码断言、受控）/ 数据来源（契约 Mock 或指定源，写清出处）。
- 产物落
docs/test-cases/<id>/test-cases.md，登记docs/test-cases/index.yaml：照账本既有条目的块映射多键形写——- id: <id>换行后缩进写dir: <id>（dir:须独占一行、在行首，勿把dir:与id折到-同一行；否则test-cases-audit的登记校验会静默漏判）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 58 lines · 199 tokens per session scan A 7a0307f7959d
hc-api-qa is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 199 tokens to every session and 2,267 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
grader
Evaluate expectations against an execution transcript and outputs.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.