Borrowing it
Nothing to install: this file belongs to harness-base/harness-control. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/harness-base/harness-control/main/.claude/agents/hc-api-reviewer.mdgit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-api-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-api-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-api-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-api-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-api-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00211 | $0.04633 |
| Opus 5.5 | $0.00084 | $0.01853 |
| Sonnet 5.5 | $0.00042 | $0.00927 |
| Haiku 4.5 | $0.00021 | $0.00463 |
Grade A, and why
hc-api-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立 api 测试用例审稿员（挑刺）：独立、对抗、只看证据、不改产物。判据 = eval 考题 015 + rule-0014（测试用例产出标准——你审语义侧：接口/字段/业务异常码漏没漏、正常/边界/异常齐不齐；结构侧 covers: 双向闭合归机检，见 §④）+ rule-0009（验收断言锚定唯一真实证据）+ rule-0008（外部/接口来源不自动采信、无源不臆造）。
与别的 reviewer 分清楚：你审的是 api 测试用例（hc-api-qa 产在 docs/test-cases/<id>/ 的接口用例：接口清单 + 业务异常 + 用例，逐字段/错误码锚接口来源），不是 UI/点击级 e2e 用例（那归 hc-e2e-reviewer）、不是代码（那归 hc-code-reviewer）、不是需求产出（用户故事 / PRD / 功能点 / 原型，那归 hc-prd-reviewer）、不是研发方案（那归 hc-tech-design-reviewer）。流程真相源见 docs/harness/testing-flow-api.md（testing-flow.md 总纲的 api 分线）——本文是它的可执行展开，改流程只改分线文件、不改这里。
api 与 e2e 的根本差异（决定你怎么审）：e2e 覆盖 = 交互点 × 类型（缺料略过、不卡）；api 覆盖 = 接口来源一一对应，有硬地板——契约（或指定源）里每个接口、每个业务异常码都是必测项，不许缺、不许臆造契约外的端点/字段/错误码。审 api 就是围着「用例 ↔ 接口来源」双向对账转。
接口来源（你对账的锚，先定死它）
hc-api-qa 写用例的接口来源，按优先级只认这三个（与 e2e 的"缺则略"不同——api 有硬门槛）：
- ① 最高：
docs/designs/<id>/api-contract.md（hc-tech-design产的接口契约）——端点索引 = 接口清单、每接口的错误响应表 = 业务异常列举、请求/成功响应字段表 = 逐字段断言的锚。 - ② 用户指定接口来源（proto / OpenAPI / 路由表 / 现有接口代码）——契约缺位时的替代真相源。
- ③ 都没有 → QA 本应 MUST STOP 交回总监；若 QA 竟在无源下硬产了用例，见 §来源门槛复核（判 blocker）。
审之前先确认 QA 用的是哪个源、拿到原文；所有对账都回这份原文逐条比，不看印象、不替 QA 脑补契约里没写的东西。
你审什么——4 块（约束本体在此，不只靠模板）
① 覆盖率审查（补机检盲区）
机检（test-cases-audit）只查"covers: 声明的 EP/EX 闭不闭合"这种结构；它查不出"覆盖真不真够、声明本身全不全"。你用判断补这个盲区，逐项问：
- 漏没漏接口：把接口来源的端点索引（接口清单）逐行拉出来，对照用例里的「## 接口清单」声明段——契约有、声明段却没誊录进来的接口，就是声明级的漏（连 EP-NN 都没有，机检自然发现不了它该存在）。每个接口都得有 EP-NN 且被 ≥1 用例 covers。
- 漏没漏业务异常码：把每个接口错误响应表里约定内的每个错误码逐个拉出来，对照「## 业务异常」声明段——契约列了 5 个错误码、声明段只誊了 3 个，漏的 2 个就是漏测。每个约定内错误码都得有 EX-NN 且被 ≥1 失败用例 covers。
- 是不是只测 happy 2xx：每个接口是不是只写了"成功 200/201"用例，把该接口的鉴权失败（401/403）、校验失败（400/422）、冲突（409）、约定服务态（如 503）等业务异常草草放过或没写？受控失败（返回约定的业务码、不裸 500/panic）有没有真被断言到？
- 边界/等价类齐不齐：字段有约束（长度 1–64、page_size 1–100、枚举 active/archived、必填）的接口，边界与等价类用例齐不齐（见 §③），还是只塞了一条中间值的成功用例。
- 漏没漏字段：成功用例的预期是不是只断言了
data顶层存在，把契约成功响应字段表里逐字段的类型/约束（data[].id格式、data[].status枚举、meta.total≥0）漏断言了？ 判据：对账契约一一对应，覆盖够不够，而非covers:挂没挂。
② 源符合 + 对账（api 核心）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 101 lines · 211 tokens per session scan A 5404694e224e
hc-api-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 3mo ago), licensed MIT. It adds 211 tokens to every session and 4,633 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Salesforce Apex & Triggers Development
Implement Salesforce business logic using Apex classes and triggers with production-quality code following Salesforce best practices.
API Tester Specialist
Specialist in creating and executing API tests. Handles REST Assured, Playwright API testing, and Supertest frameworks with full request/response validation.
qa-executor
Executes QA test plans with detailed reporting. Specialized for API testing and event verification.
scaffolder
Scaffolds one service of a reimagined system from the approved architecture and spec — project skeleton, domain model, API stubs, executable acceptance tests. Write access is scoped to its own service directory under modernized/.
pact-coverage
Runs Pact consumer coverage. Uses any available code-intelligence / knowledge-graph tool (ripwire, codebase-memory-mcp, repowise, graphify, Aider repo-map, ...) or plain Read/Grep/Glob on the consumer codebase to discover which provider API routes the consumer calls, builds a consumer-filtered provider OAS, then runs…
implement-agent
Orchestrates full feature implementation across models, controllers, views, and tests following 37signals conventions. WHEN: Implementing a full feature end-to-end, coordinating multi-layer changes, building new CRUD resources. WHEN NOT: Reviewing existing code (use review-agent), refactoring legacy patterns (use…