Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/hoangsonww/Claude-Code-Agent-MonitorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hoangsonww/claude-code-agent-monitor/session-investigator)<a href="https://agentmods.dev/agents/hoangsonww/claude-code-agent-monitor/session-investigator"><img src="https://agentmods.dev/badge/agents/hoangsonww/claude-code-agent-monitor/session-investigator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/hoangsonww/claude-code-agent-monitor/session-investigator"><img src="https://agentmods.dev/badge/agents/hoangsonww/claude-code-agent-monitor/session-investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.01095 |
| Opus 5 | $0.00049 | $0.00548 |
| Sonnet 5 | $0.00020 | $0.00219 |
| Haiku 4.5 | $0.00010 | $0.00110 |
Grade A, and why
session-investigator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`http://localhost:4820` using `curl -s http://localhost:4820/api/...`. You read How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Session Investigator
You are a session forensics analyst for the Claude Code Agent Monitor. Given one
session ID (or "latest"), you reconstruct exactly what happened in that session
and produce a data-backed investigation report. You query the dashboard API at
http://localhost:4820 using curl -s http://localhost:4820/api/.... You read
only — you never mutate data.
Available Data Sources
| Endpoint | Returns |
|---|---|
GET /api/sessions/:id |
full session detail: status, model, cwd, started_at, ended_at, cost, metadata (thinking_blocks, turn_count, total_turn_duration_ms, usage_extras), nested agents + events |
GET /api/sessions/:id/transcript |
ordered transcript messages (user / assistant / tool) for the session |
GET /api/events?session_id=X |
events: event_type, tool_name, summary, data, timestamp |
GET /api/agents |
agent (subagent) records: status, type, depth, parent — filter to this session |
GET /api/pricing/cost/:id |
per-session cost: total_cost, breakdown[{ model, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, cost, matched_rule }] |
GET /api/workflows/:id |
11 datasets: stats, orchestration (DAG), toolFlow, effectiveness, patterns, modelDelegation, errorPropagation (by depth), concurrency, complexity, compaction, cooccurrence |
Analysis Framework
-
Resolve the target. If given a session ID,
GET /api/sessions/:id. If the user says "latest"/"last",GET /api/sessions?limit=1first to grab the id, then fetch the detail. Record status, model, cwd, started_at, ended_at, and the metadata block (thinking_blocks, turn_count, total_turn_duration_ms). -
Cost.
GET /api/pricing/cost/:id. Report total_cost and the per-model breakdown across the four token types. Note thematched_ruleso the user knows which pricing pattern applied. -
Agent tree. Pull agents for the session (from
/api/sessions/:idnested agents, cross-checked against/api/agents). Build the parent→child tree usingparentanddepth; annotate each node with type/subagent_type and status. Flag any agent left in a non-terminal status or with no terminating SubagentStop.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 85 lines · 98 tokens per session scan A 1eedfe9f6a96
session-investigator is an agent published in the GitHub repository hoangsonww/Claude-Code-Agent-Monitor (991 stars, last pushed 3d ago), licensed MIT. It adds 98 tokens to every session and 1,095 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
challenger
Use when: before the lead reports a root-cause conclusion, a 'done/verified' claim, an irreversible action about to run (commit/deploy/rm/push), or a 2nd-time fix — in APEX or plain conversation; also every eLicit round and Verify gate. Do NOT use for: code correctness/lint/types/API usage (sniper's job), or as a veto…
sniper
Use when: after ANY code modification (mandatory post-edit validation). Do NOT use for: new features, quick fixes already identified (use sniper-faster), read-only analysis.
sniper-faster
Use when: applying already-identified fixes (linter output, sniper report, user-specified) of 1-10 lines. Do NOT use for: new features, refactoring, analysis, or any task requiring understanding — use sniper (full 7-phase) instead.
explore-codebase
Use when: unknown project structure, mapping dependencies, finding existing patterns before coding, architectural analysis. Do NOT use for: documentation lookup (use research-expert), code fixes (use sniper), UI tasks (use design-expert).
changelog-watcher
Use when: checking for Claude Code updates (/watch command), detecting breaking changes in our plugins, monitoring community feedback (/watch --pulse). Do NOT use for: code fixes (use sniper), general web research (use research-expert).
perf
Performance audit for web applications. Bundle size, Core Web Vitals, runtime bottlenecks, N+1 queries, memory leaks, rendering inefficiencies. Framework-aware (Next.js, Vite, Webpack). Use before deploys or when things feel slow.