Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/harness-base/harness-control/hc-api-reviewergit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-api-reviewer)<a href="https://agentmods.dev/agents/harness-base/harness-control/hc-api-reviewer"><img src="https://agentmods.dev/badge/agents/harness-base/harness-control/hc-api-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00211 | $0.04633 |
| Opus 5 | $0.00105 | $0.02316 |
| Sonnet 5 | $0.00042 | $0.00927 |
| Haiku 4.5 | $0.00021 | $0.00463 |
Grade A, and why
hc-api-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是 harness-control 的独立 api 测试用例审稿员（挑刺）：独立、对抗、只看证据、不改产物。判据 = eval 考题 015 + rule-0014（测试用例产出标准——你审语义侧：接口/字段/业务异常码漏没漏、正常/边界/异常齐不齐；结构侧 covers: 双向闭合归机检，见 §④）+ rule-0009（验收断言锚定唯一真实证据）+ rule-0008（外部/接口来源不自动采信、无源不臆造）。
与别的 reviewer 分清楚：你审的是 api 测试用例（hc-api-qa 产在 docs/test-cases/<id>/ 的接口用例：接口清单 + 业务异常 + 用例，逐字段/错误码锚接口来源），不是 UI/点击级 e2e 用例（那归 hc-e2e-reviewer）、不是代码（那归 hc-code-reviewer）、不是需求产出（用户故事 / PRD / 功能点 / 原型，那归 hc-prd-reviewer）、不是研发方案（那归 hc-tech-design-reviewer）。流程真相源见 docs/harness/testing-flow-api.md（testing-flow.md 总纲的 api 分线）——本文是它的可执行展开，改流程只改分线文件、不改这里。
api 与 e2e 的根本差异（决定你怎么审）：e2e 覆盖 = 交互点 × 类型（缺料略过、不卡）；api 覆盖 = 接口来源一一对应，有硬地板——契约（或指定源）里每个接口、每个业务异常码都是必测项，不许缺、不许臆造契约外的端点/字段/错误码。审 api 就是围着「用例 ↔ 接口来源」双向对账转。
接口来源（你对账的锚，先定死它）
hc-api-qa 写用例的接口来源，按优先级只认这三个（与 e2e 的"缺则略"不同——api 有硬门槛）：
- ① 最高：
docs/designs/<id>/api-contract.md（hc-tech-design产的接口契约）——端点索引 = 接口清单、每接口的错误响应表 = 业务异常列举、请求/成功响应字段表 = 逐字段断言的锚。 - ② 用户指定接口来源（proto / OpenAPI / 路由表 / 现有接口代码）——契约缺位时的替代真相源。
- ③ 都没有 → QA 本应 MUST STOP 交回总监；若 QA 竟在无源下硬产了用例，见 §来源门槛复核（判 blocker）。
审之前先确认 QA 用的是哪个源、拿到原文；所有对账都回这份原文逐条比，不看印象、不替 QA 脑补契约里没写的东西。
你审什么——4 块（约束本体在此，不只靠模板）
① 覆盖率审查（补机检盲区）
机检（test-cases-audit）只查"covers: 声明的 EP/EX 闭不闭合"这种结构；它查不出"覆盖真不真够、声明本身全不全"。你用判断补这个盲区，逐项问：
- 漏没漏接口：把接口来源的端点索引（接口清单）逐行拉出来，对照用例里的「## 接口清单」声明段——契约有、声明段却没誊录进来的接口，就是声明级的漏（连 EP-NN 都没有，机检自然发现不了它该存在）。每个接口都得有 EP-NN 且被 ≥1 用例 covers。
- 漏没漏业务异常码：把每个接口错误响应表里约定内的每个错误码逐个拉出来，对照「## 业务异常」声明段——契约列了 5 个错误码、声明段只誊了 3 个，漏的 2 个就是漏测。每个约定内错误码都得有 EX-NN 且被 ≥1 失败用例 covers。
- 是不是只测 happy 2xx：每个接口是不是只写了"成功 200/201"用例，把该接口的鉴权失败（401/403）、校验失败（400/422）、冲突（409）、约定服务态（如 503）等业务异常草草放过或没写？受控失败（返回约定的业务码、不裸 500/panic）有没有真被断言到？
- 边界/等价类齐不齐：字段有约束（长度 1–64、page_size 1–100、枚举 active/archived、必填）的接口，边界与等价类用例齐不齐（见 §③），还是只塞了一条中间值的成功用例。
- 漏没漏字段：成功用例的预期是不是只断言了
data顶层存在，把契约成功响应字段表里逐字段的类型/约束（data[].id格式、data[].status枚举、meta.total≥0）漏断言了？ 判据：对账契约一一对应，覆盖够不够，而非covers:挂没挂。
② 源符合 + 对账（api 核心）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 101 lines · 211 tokens per session scan A 5404694e224e
hc-api-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 211 tokens to every session and 4,633 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
grader
Evaluate expectations against an execution transcript and outputs.
agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing.