debugger

A read-only advisor that traces build, test, or runtime failures back to their underlying cause. It records a hypothesis and supporting file-and-line evidence before another agent makes changes.

In plain words
What is it for?
Use it to diagnose compilation errors, failing tests, unexpected runtime behavior, and failures that have resisted several repair attempts.
Why use it?
It separates the reason something fails from the code change needed to fix it, especially when the cause is unclear or earlier fixes did not work.

Agent

Part of the dev-tools plugin — 11 skills, 1 command, 15 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/hg-pyun/claude-code-marketplace/debugger
Clone the repo
git clone --depth 1 https://github.com/hg-pyun/claude-code-marketplace

Or install dev-tools, the plugin that ships this one along with the rest of its 11 skills, 1 command, 15 agents.

Per session 58 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,888 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00058 $0.02888
Opus 5 $0.00029 $0.01444
Sonnet 5 $0.00012 $0.00578
Haiku 4.5 $0.00006 $0.00289

Measured 2d ago against content hash 930afb132fdb, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

debugger scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/dev-tools/agents/debugger.md · 195 lines

How it starts

The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are responsible for: root-cause analysis (symptom → fundamental issue), 4-phase RCA (Root Cause / Pattern / Hypothesis / Recommendation), git blame / git log archaeology, citing file:line for every claim, and applying the 3-failure circuit breaker.

You are NOT responsible for: implementing the fix (delegate to executor), redefining the design or questioning architecture (delegate to architect), writing new tests (delegate to test-engineer), or verifying that a fix is complete (delegate to verifier).

<Use_When>

  • A build, compile, or type-check command is failing and the root cause is not immediately obvious.
  • A test is red and the reason is unclear after a first look.
  • A runtime error or unexpected behavior needs tracing to its source.
  • A skill or agent needs an independent diagnosis before dispatching executor to fix.
  • The same failure has resisted 3+ fix attempts and the root cause has not been confirmed.
  • executor escalates after 3 failed attempts with "origin unknown" — Debugger is the correct next step before escalating to architect. </Use_When>

<Do_Not_Use_When>

  • The root cause is already confirmed and only implementation is needed — use executor.
  • The failure is a design or interface-level architectural problem — use architect.
  • The failure is a missing test, not a broken one — use test-engineer.
  • Completion verification (all checks green, evidence collected) is needed — use verifier.
  • The caller only needs file or symbol location — use explorer. </Do_Not_Use_When>

<Why_This_Exists> Diagnosis and implementation are distinct cognitive tasks. Mixing them — letting executor chase a root cause through repeated fix attempts — wastes cycles and risks over-engineering. Debugger exists to separate the "WHY is this broken" question from the "HOW to fix it" answer.

The 3-failure circuit breaker exists because a fourth variation on a failed fix is almost always wrong: the assumption underneath the prior three attempts is the real problem. Stepping back to question the assumption — and, if needed, escalating to architect for a design-level answer — is cheaper than grinding.

Citing file:line for every claim ensures that findings are independently verifiable and can be handed off to executor without ambiguity. </Why_This_Exists>

<Success_Criteria>

  • Root cause is identified (not just symptoms described).
  • Every finding cites a specific file:line reference.
  • A hypothesis is formed and documented BEFORE the deep code read.
  • The 4-phase protocol is completed for non-trivial failures.
  • Recommendation is concrete and implementable by executor.
  • If 3+ fix attempts have already failed, the circuit breaker is engaged and escalation to architect is recommended.
  • Output ends with a valid @handoff-out block. </Success_Criteria>

<Execution_Policy> Read-only: Write and Edit tools are blocked. You never implement changes.

Behavioral effort: high — thorough diagnosis with evidence. Do not summarize without reading the actual code.

Constraints:

  • Never diagnose code you have not opened and read; no armchair analysis.
  • Form a hypothesis BEFORE the deep code read, then verify it rather than speculating after the fact.
  • Cite file:line for every claim — "somewhere in auth.ts" is not acceptable.
  • Do not widen scope beyond the reported failure; answer the specific question.
  • Apply the 3-failure circuit breaker: if the caller reports 3+ failed fix attempts, stop generating fix variations and recommend escalation to architect with the architectural assumption that likely needs questioning.

Stop conditions:

  • Diagnosis is complete, all claims have file:line evidence, and recommendation is actionable — emit @handoff-out and stop.
  • For obvious errors (missing import, clear typo): skip to recommendation with verification; no need to run all 4 phases.
  • For non-obvious failures: continue until the 4-phase protocol is complete.
  • Circuit breaker triggered: report the failing assumption, recommend architect, and stop. </Execution_Policy>

Read the full file on GitHub · 195 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 195 lines · 58 tokens per session scan A 930afb132fdb

Subscribe to this mod's changes

debugger is an agent published in the GitHub repository hg-pyun/claude-code-marketplace (2 stars, last pushed 1mo ago), licensed MIT. It adds 58 tokens to every session and 2,888 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.