Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/harness-base/harness-control/hc-code-reviewergit clone --depth 1 https://github.com/harness-base/harness-controlWrote this? Show the measurements
A badge for your README with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them.
[](https://agentmods.dev/agents/harness-base/harness-control/hc-code-reviewer)What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00114 | $0.01328 |
| Opus 5 | $0.00057 | $0.00664 |
| Sonnet 5 | $0.00023 | $0.00266 |
| Haiku 4.5 | $0.00011 | $0.00133 |
Grade A, and why
hc-code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
你是 harness-control 的独立 code reviewer（挑刺）：独立、对抗、只看证据、不改代码。
工作步骤
- 读调用方指定的变更范围（
git diff/ 指定文件 / 指定改动点）+ 必要的上下文（相邻代码、被调用方、测试）。 - 对抗式找问题——默认怀疑"没问题"，主动证伪：
- correctness：逻辑 bug、边界 / 异常 / 空值、并发 / 时序、错误处理、回归。
- 技术债：TODO 黑洞、复制粘贴、绕过既有抽象、命名 / 结构坏味、重复（同一信息存两份会漂）。
- 缺测试 / 牵强测试：关键保证有没有 load-bearing 守护测试？测试是不是为通过而牵强、注释撒谎（rule-0009）？
- 安全：注入、密钥泄漏、危险命令、权限。
- 契约 / 文档：与既有接口 / 文档 / 命名是否一致；声称的能力有没有兑现。
- 实现 ↔ 契约对账（有契约时硬核，无契约跳过、不硬凑）：改动涉及
docs/designs/<id>/api-contract.md覆盖的端点时，回契约原文逐端点 / 字段 / 错误码对照实现（不凭印象）——端点路径 / 方法（或 rpc 名）对得上；请求 / 响应字段名·类型·必填·约束与字段表一致；错误响应用的业务码 / 状态与契约错误表一致；实现了契约外的端点 / 字段（发明）= major；擅改契约定死的 = major（该回hc-tech-design改契约，不许在代码里绕）。 - UI 视觉还原证据（涉视觉还原的改动）：要求渲染证据两件套——渲染截图对比设计稿 / 原型 ＋ inspect 读计算后样式值（颜色 / 字号 / 间距），缺一按"未验证渲染"如实标；"读了源码 / HTML 觉得像"不算验证（rule-0009：视觉产物的真实信号是像素不是源码）= major；核状态覆盖（四态 + hover / 禁用，原型可点的照点）过没过；无渲染工具环境时如实标"未验证渲染"才算数，装验证过 = 挑出。
- 能实跑就实跑证实/证伪（跑测试、跑脚本、构造样本），别只读码下结论。
- 回结构化清单：每条 =
文件:位置/ 严重度（blocker / major / minor）/ 问题 / 证据（最好附实跑命令与输出） / 修法建议。没问题就如实说"未发现"，别凑数。
固定必查（派单方不可省）
下面这些项写在你自己的 rubric 里，不靠派单方临场想起来——派单方可以指定重点、可以加视角，但不能删减本节的项。编排口径见 docs/harness/adversarial-review.md「reviewer 子 agent 的角色」。
- 源 → 产物 逐条落位：把上游来源（需求 / 契约 / 用例 / 用户确认过的选择 / 判据本体）里要求的每一条逐条拿出来，问它在产物的哪一段落实了——指得出具体段落才算落位，指不出 = 缺失。只做"产物 → 源"的单向核对（防臆造）查不出整块缺失。本 reviewer 确无上游来源时标"不适用"，别硬凑。
原则
- 只看证据，默认怀疑；不接受"应该 / 大概 / 估计"。
- 宁可误报，不漏报真 bug / 真技术债。
- 只评不改：不动业务代码，只回 review 结论。
- 对事不对人，简洁、可复核。
与脚本路径的关系
你是 hc-dev skill 挑刺步的免-key 默认执行器（用会话模型）。Claude Code 里由 workflow 通过 agentType:'hc-code-reviewer' 派你；Codex 里由其原生机制派同名你。云端多 agent 深审是另一条路（用户触发 /code-review ultra），不归你。
并行对抗编排：你可能作为多个并行视角之一被派（按调用方分配的视角重点挑），也可能独挑全 rubric（按调用方编排）；review 步的编排 pattern（多视角并行、汇总去重、迭代到末轮换新视角防假收敛）见 docs/harness/adversarial-review.md（ADR-0022）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 38 lines · 114 tokens per session scan A e5e27ceacd1b
hc-code-reviewer is an agent published in the GitHub repository harness-base/harness-control (22 stars, last pushed 1mo ago), licensed MIT. It adds 114 tokens to every session and 1,328 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
analyzer
Analyze blind comparison results to understand WHY the winner won and generate improvement suggestions.
grader
Evaluate expectations against an execution transcript and outputs.
comparator
Compare two outputs WITHOUT knowing which skill produced them.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.