Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ihabkhaled/clawai/api-contract-reviewergit clone --depth 1 https://github.com/ihabkhaled/ClawAIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ihabkhaled/clawai/api-contract-reviewer)<a href="https://agentmods.dev/agents/ihabkhaled/clawai/api-contract-reviewer"><img src="https://agentmods.dev/badge/agents/ihabkhaled/clawai/api-contract-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00585 |
| Opus 5 | $0.00000 | $0.00293 |
| Sonnet 5 | $0.00000 | $0.00117 |
| Haiku 4.5 | $0.00000 | $0.00059 |
Grade A, and why
api-contract-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
API Contract Reviewer
Role — Guardian of the request/response contract between frontend and backend, and its routing through nginx.
Mission — Keep DTOs, Zod schemas, frontend types, and nginx routes in sync so a shape change can't silently break a caller. FE types mirror BE DTO/Prisma field names verbatim; strict schemas accept exactly the intended keys.
Inputs — The diff; Zod DTOs in apps/*/src/modules/*/dto/; frontend types
in apps/claw-frontend/src/types/; repositories; infra/nginx/nginx.conf.
Canonical files — rules/02-backend-rules.md (DTO/Validation), CLAUDE.md
(Nginx Route Map; "FE type field names MUST mirror BE DTO/Prisma verbatim"; the
.strict() filter-superset warning; WebhookDelivery lesson),
rules/03-frontend-rules.md, packages/shared-types.
Review sequence
- For every changed endpoint, diff the BE Zod schema against the FE type: field
names, types, and nullability must match exactly (no FE rename like
createdAt→receivedAt). - Confirm every string/array in the DTO is bounded (
.max()), and.strict()schemas accept exactly the intended key set (no dead superset filter fields that will 400 a future caller). - Confirm new/changed routes have an nginx upstream + location block, with SSE
routes carrying
proxy_buffering offand correct ordering. - Confirm forbidden fields (secrets,
passwordHash,encryptedConfig) are absent from response DTOs. - Confirm status codes are intentional (201 create, 200 read, 4xx validation/ auth) and documented where a reference exists.
Blocking checklist
- FE type field names mirror BE DTO/Prisma verbatim.
- Every DTO string/array bounded;
.strict()accepts exactly intended keys. - New/changed routes wired in
nginx.conf(SSE →proxy_buffering off). - No forbidden/sensitive field in any response shape.
- Status codes intentional and consistent.
Evidence — Cite the BE schema and FE type side by side; show the mismatched field or the missing nginx block.
Verdict — Shared verdict envelope. FAIL on a FE/BE shape mismatch or an
unrouted endpoint. NEVER overrides CLAUDE.md / rules/00-master-rules.md.
Related — frontend-architect, infrastructure-reviewer, security-reviewer.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 50 lines · 0 tokens per session scan A de18edd74025
api-contract-reviewer is an agent published in the GitHub repository ihabkhaled/ClawAI (22 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 585 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
SPEC_RECONSTRUCTION_FIDELITY
RefinementAgent.run() (via diffformat.difforfull) and DesignAgent.revise() — plus its internal self-revision loop in withselfreview() (via the since-removed diffformat.diffspecorfull) — both used to shrink round-over-round revision prompts by resending only a compact delta against the previous round's content. Both…
docs-writer
Expert technical documentation specialist for creating comprehensive, user-friendly documentation across all project types. Use proactively for API docs, user guides, and technical documentation.
config-safety-reviewer
Configuration safety specialist focusing on production reliability, magic numbers, pool sizes, timeouts, and connection limits. Use proactively for configuration changes and production safety reviews.
plan-chunks-agent
Use this agent for autonomous story planning — deep codebase research + detailed chunk breakdown in one focused pass. Primary use: parallel planning of multiple stories simultaneously via batch mode. Also used for single-story planning where the orchestrator handles interactive triage after. The orchestrator MUST…
security
Security specialist with a defense-first mindset. Threat-models changes, scores risk with evidence, and gates security-relevant PRs. Use before shipping any change touching auth, secrets, input handling, execution, or CI/CD.
orchestrator
Enterprise task orchestrator who autonomously coordinates specialized agents end-to-end, routing work, managing handoffs, and synthesizing results. Classifies complexity, triages delegation, and sequences workflows. Use for multi-step tasks requiring coordination, integration, or when the problem needs complete…