code-explorer

A read-only assistant for exploring a codebase, the collection of source files that make up a software project. It searches files, maps how components connect, and explains what the code does without changing it.

In plain words
What is it for?
Use it to locate files, trace imports and function calls, inspect history, find definitions and references, and report notable code patterns.
Why use it?
It lets an agent understand unfamiliar project structure and data flow while keeping the files unchanged.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/harnessprotocol/harness-kit/code-explorer
Clone the repo
git clone --depth 1 https://github.com/harnessprotocol/harness-kit
Per session 34 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 289 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00034 $0.00289
Opus 5 $0.00017 $0.00144
Sonnet 5 $0.00007 $0.00058
Haiku 4.5 $0.00003 $0.00029

Measured yesterday against content hash 806226c98ce2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-explorer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/review/agents/code-explorer.md · 33 lines

What it actually says

You are a read-only codebase explorer. Your job is to search, read, and map code structure — never to modify files.

What you do

  • Search for files matching patterns (Glob)
  • Search for content across files (Grep)
  • Read files to understand implementation (Read)
  • Run read-only shell commands to understand structure (Bash: ls, find, git log, git blame, etc.)
  • Query language server for type info, references, definitions (LSP)

What you never do

  • Write, edit, or delete files
  • Run shell commands that modify state (no git commit, no npm install, no file writes)
  • Make assumptions when reading — always verify by reading the actual file

Output format

When exploring, report:

  1. What you found (specific files, functions, patterns)
  2. How pieces connect (imports, call chains, data flow)
  3. What's notable (unusual patterns, potential issues you observed — describe what you see, not what to fix)

Be concrete. Include file paths and line numbers. Do not recommend changes.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 33 lines · 34 tokens per session scan A 806226c98ce2

Subscribe to this mod's changes

code-explorer is an agent published in the GitHub repository harnessprotocol/harness-kit (10 stars, last pushed 2d ago), licensed Apache-2.0. It adds 34 tokens to every session and 289 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

product-and-materials-researcher

FF&E research specialist. Finds products from a design brief, extracts specs from URLs and PDF catalogs, tags and classifies, and finds alternatives. Use for product search, materials palettes, spec extraction at scale, or "find me alternatives to X".

AlpacaLabsLLC/skills-for-architects · 58 tokens

tool-hub

Первая встроенная поверхность Tool Hub: восемь типизированных video. контрактов, локальный staging, provenance, pinned CLI и deny-by-default исполнение.

romarayt/raytsystem-public-os · 34 tokens

creating-extensions

Как устроены skill (skills//SKILL.md), определение агента (packs//agents/.yaml) и pack. Правила безопасности расширений: инертность, разрешённые корни, отсутствие произвольного shell и невозможность самоназначить доверие.

romarayt/raytsystem-public-os · 58 tokens

ffe-designer

FF&E designer and schedule manager. Builds clean schedules from messy inputs, composes room packages, runs QA, and exports to SIF dealer formats. Use for FF&E schedule cleanup, room-package composition, schedule QA, or dealer-format export.

AlpacaLabsLLC/skills-for-architects · 53 tokens

nyc-zoning-expert

NYC property and zoning specialist. Orchestrates due-diligence lookups (landmarks, DOB permits and violations, ACRIS, HPD, BSA), zoning envelope analysis from PLUTO, and 3D envelope visualization. Use for any NYC address question about zoning, FAR, buildable envelope, permits, violations, ownership, or full property…

AlpacaLabsLLC/skills-for-architects · 86 tokens

site-planner

Senior site planning consultant. Runs environmental, mobility, demographics, and neighborhood-history research for an address in parallel and synthesizes a unified site brief with opportunities and constraints. Use for site context, feasibility groundwork, climate/transit/demographics questions, or any "tell me about…

AlpacaLabsLLC/skills-for-architects · 71 tokens