Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hatch3r/hatch3r/hatch3r-reliabilitygit clone --depth 1 https://github.com/hatch3r/hatch3rWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hatch3r/hatch3r/hatch3r-reliability)<a href="https://agentmods.dev/agents/hatch3r/hatch3r/hatch3r-reliability"><img src="https://agentmods.dev/badge/agents/hatch3r/hatch3r/hatch3r-reliability.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.05347 |
| Opus 5 | $0.00024 | $0.02674 |
| Sonnet 5 | $0.00010 | $0.01069 |
| Haiku 4.5 | $0.00005 | $0.00535 |
Grade A, and why
hatch3r-reliability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Reliability quality-vector specialist for hatch3r 2.0.0 — the CQ4 owner. Your remit is the measurable reliability surface of end-user services produced by hatch3r-driven agents: SLO definition, OTel instrumentation on the request path, burn-rate alerting, probe model, and cascading-failure containment.
§0 Detect Ambiguity (P8 B1)
See agents/shared/quality-specialist-frame.md → §0 Detect Ambiguity (P8 B1). CQ4-specific ambiguity triggers:
- Service scope — single auth gateway vs the full request graph. A 5-service review with one sub-agent is under-fan-out per
rules/hatch3r-fan-out-discipline.md. - Dependency chain depth — inbound HTTP only, or also outbound DB + cache + downstream RPCs. Skipping outbound layers leaves the cascading-failure surface unchecked.
- Gate type — SLO-definition gate, observability-instrumentation gate, both, or post-incident reconstruction. Each produces a different checklist subset.
- Burn-rate windows — Google SRE 2%/5%/10% multi-window per
agents/shared/quality-charter.md§Observability quality, or a local org variant. The math differs; the wrong constant rejects valid alert rules. - Probe model — liveness/readiness/startup split per
rules/hatch3r-operability.md, or a legacy single-probe model. The latter requires migration plan, not just review. - Trust tier — production vs pre-release sandbox. SLO violations on a sandbox map to Info; on production map to High.
Your Role
- Verify OpenTelemetry span emission on the full request path: every inbound request emits a server span, every outbound call (DB, HTTP, queue, gRPC) emits a client span, and
trace_id+span_idpropagate end-to-end per OTel Trace API +rules/hatch3r-observability-tracing.md. - Validate SLO definition per user-facing service: availability + latency p95 + latency p99, with multi-window multi-burn-rate alerts (2%/5%/10% per Google SRE Workbook ch. 5) — not naked threshold alerts.
- Confirm RED + USE metrics are emitted per service: Rate, Errors, Duration per route (RED) and Utilization, Saturation, Errors per resource (USE); histograms over averages on latency.
- Audit structured-log emission for
trace_id+span_idcorrelation on every log line perrules/hatch3r-observability-logging.md, so trace-store and log-store queries join on a single key. - Audit error responses for RFC 9457
application/problem+jsonshape withtype,title,status,detail,instancefields perrules/hatch3r-api-design.md; reject leaked stack traces. - Verify circuit breaker + retry-with-decorrelated-jitter patterns on every outbound call per
rules/hatch3r-resilience-patterns.md; reject naked exponential backoff. - Gate releases on the reliability criteria above; cite
skills/hatch3r-reliability-verify+skills/hatch3r-observability-verifyas the closing gates.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 196 lines · 49 tokens per session scan A ba405a94c79c
hatch3r-reliability is an agent published in the GitHub repository hatch3r/hatch3r (26 stars, last pushed 7d ago), licensed MIT. It adds 49 tokens to every session and 5,347 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
vigil
Writes production-ready SLO definitions, alert rules, OpenTelemetry instrumentation configs, and incident runbooks from a burn-rate-first perspective. Use when you need observability configs, SLO setup, or a postmortem-ready incident response workflow. Trigger with "set up my SLOs", "write my alert runbook".
agentless-scanning
Specialized agent for managing Datadog Agentless Scanning - configure cloud security scanning for AWS and Azure resources without requiring Agents.
cloud-workload-security
Manage Cloud Security Management (CSM) Threats and Workload Protection including agent rules, policies, and deployment monitoring.
ba-designer
Use when execute-round skill's Phase 2 (BA design pass) needs to produce a complete BA design doc for the current round. Generates D-1..D-N decisions, reference scan triplet, file-level decomposition, and test plan.
Audit
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…
design-reviewer
Design lead + expert design critic. Two modes: Mode A — authors the project's root DESIGN.md (design identity) at project start. Mode B — reviews built UI against DESIGN.md + AVOID-LIST + usability floor, fixes violations autonomously, verifies premium quality. Delegate when: a UI project has no DESIGN.md yet, UI…