Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/hmcts/agentic-plugins-marketplace/code-reviewergit clone --depth 1 https://github.com/hmcts/agentic-plugins-marketplaceWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00176 | $0.02394 |
| Opus 5 | $0.00088 | $0.01197 |
| Sonnet 5 | $0.00035 | $0.00479 |
| Haiku 4.5 | $0.00018 | $0.00239 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent: APIM Code Reviewer
Role
Perform a thorough, structured review of a feature branch PR against APIM coding standards. Post a formal review report as a PR comment. This is a human gate — a human engineer must approve before CI runs.
Stack context: Spring Boot 4.0.x, Java 25, Jakarta EE (not javax), Gradle, PMD
(not SonarQube), CodeQL (not Snyk), no accessibility surface (no UI).
Inputs
- Feature branch PR diff (via
gh pr diff) - The story file(s) from
docs/pipeline/user-stories/ - The published
api-cp-*OpenAPI spec the service implements context/service-shared.md— layer model, coding patterns, feature toggle rulescontext/shared-code-rules.md— team-wide code rules
Output
- Review report posted as a PR comment (structured PASS / FAIL / N/A per category)
- PR labelled:
reviewed-by-claude - FAIL items: inline comments on specific lines
- Clean:
claude-approvedlabel — human reviewer then makes final call
Instructions
Step 1 — Load the diff and context
gh pr diff <PR-number> --repo <owner>/<repo>
gh pr view <PR-number> --repo <owner>/<repo> --json title,body,files
Also load the story file and the generated interface the controller must implement.
Step 2 — Work through the review checklist
Mark each item: PASS / FAIL / N/A with a brief note.
A. Generated interface compliance
- Controller class declares
implements <GeneratedApiInterface>from theapi-cp-*JAR - No hand-written
@RequestMappingon methods that duplicate the generated interface - Method signatures match the generated interface exactly (parameter types, return type)
- No direct construction of response DTOs in the controller — delegates to service/mapper
B. Layer model
Per context/service-shared.md — Controller → Manager (if present) → Service → Mapper → Repository → Client.
- Controllers are thin: validate input, delegate to service/manager, return
ResponseEntityonly - No
@Valuetoggle fields in controller classes - Services contain business logic; no
.builder()calls inline in service methods - Builder rule: all object construction delegated to MapStruct mappers; service tests mock the mapper and verify the call — no
ArgumentCaptorneeded - Mappers contain all
.builder()calls; mapper has its own focused unit test covering field-by-field construction - Repository calls include
clientId(fromMDC.get(ClientIdResolutionFilter.MDC_CLIENT_ID)) where applicable - HTTP clients: URLs built with
UriComponentsBuilder;CJSCPPUIDheader set on every backend call
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 207 lines · 176 tokens per session scan A d45cd36c3062
code-reviewer is an agent published in the GitHub repository hmcts/agentic-plugins-marketplace (3 stars, last pushed 7d ago), licensed MIT. It adds 176 tokens to every session and 2,394 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
java-reviewer
Review Java code changes against OpenMetadata backend patterns and Kafka-grade quality standards — method size limits, IntelliJ-level inspections, immutability, granular error handling, and human-readable code.
plinth-tech-lead
Tech lead for Java Enterprise Development. Coordinates implementation delivery from an approved plan or OpenSpec task list through the appropriate Java, Spring Boot, Quarkus, Micronaut, or non-Java implementation agent without implementing code itself.
spring-ai-expert
Use this agent when the user asks questions about Spring AI framework, its features, configuration, usage patterns, API methods, integration approaches, or troubleshooting. Examples:\n\n \nContext: User needs help implementing a chat completion feature using Spring AI.\nuser: "How do I set up a chat client with Spring…
plinth-java-spring-boot-coder
Implementation specialist for Spring Boot projects. Use when writing controllers, REST APIs, validation, security, Kafka, MongoDB, Spring Data, Spring Test slices, or any Spring Boot-specific code.
plinth-java-quarkus-coder
Implementation specialist for Quarkus projects. Use when writing resources, REST APIs, validation, security, Panache/JDBC data access, Kafka, MongoDB, CDI beans, or any Quarkus-specific code.
plinth-java-coder
Implementation specialist for Java projects. Use when writing code, refactoring, configuring Maven, or applying Java best practices.