Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ihudak/ihudak-claude-plugins/code-scannergit clone --depth 1 https://github.com/ihudak/ihudak-claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00151 | $0.02693 |
| Opus 5 | $0.00076 | $0.01347 |
| Sonnet 5 | $0.00030 | $0.00539 |
| Haiku 4.5 | $0.00015 | $0.00269 |
Grade A, and why
code-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Read ${CLAUDE_PLUGIN_ROOT}/references/handoff/code-scanner.md for the exact input/output document format.
Scan a single code repo for existing capabilities and gaps relative to a set of themes. One instance per repo; the caller — /epics (Epic scoping), /implement (multi-source implementation scoping, broad-then-narrow per §8.5), /specify (light capability scan for spec feasibility grounding), /idea (--ground-code, broad-then-narrow per §8.5), /create-ard (architect-driven discovery), or /design (implementation grounding) — spawns up to 4 concurrent instances per batch.
Distinction from diff-summarizer. That agent reads merged PR diffs for features already implemented; this agent reads present-day code for features being scoped. There are no PRs to diff — just filesystem search to understand what exists and what needs to be built.
Inputs
repo_path: <absolute path to a local clone, e.g. /workspace/<repo-name>>
repo_url_slug: <repo slug from the source URL, e.g. "cluster"; optional>
capability_themes:
- <short phrase, e.g. "Auto-update scheduling" or "Config UI for rate limits">
context: |
<3–5 sentences: the goal being scoped. For Epic writing, the PRD goal and what
the Epic-set must achieve. For /implement, the implementation goal from the
spec and what the change must accomplish.>
search_hints:
symbols: [<class / function names>]
paths: [<directory globs, e.g. "**/autoupdate/**">]
keywords: [<grep keywords>]
refresh:
switch_to_default_branch: true
pull: true # default true — capability scans target present-day code and want the
# default-branch tip. (Asymmetry with diff-summarizer, which keeps
# pull: false because it targets historical merged commits.)
Refuse to run without repo_path, at least one entry in capability_themes, and a context.
When repo_url_slug is provided, before scanning run
git -C <repo_path> remote get-url origin, strip a trailing .git, and compare
the URL's last path segment to repo_url_slug. On mismatch, return
status: REPO_MISSING with a note naming both slugs. When repo_url_slug is
absent, trust repo_path as given.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 121 lines · 151 tokens per session scan A 40dbd2a6c77e
code-scanner is an agent published in the GitHub repository ihudak/ihudak-claude-plugins (2 stars, last pushed 2d ago), licensed MIT. It adds 151 tokens to every session and 2,693 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
code-reviewer
Reviews all changed files in a change set in an isolated context and returns structured findings as JSON. Spawned by the /review-gate:review orchestrator. Not for general questions.
code-filter
Independent falsify pass for review-gate findings. Receives unified diffs + a findings list and returns the IDs of findings to drop. Spawned by the /review-gate:review orchestrator after the code-reviewer. Not for general questions.
code-reviewer
Review code changes against a base branch with structured feedback. Use this agent when the user requests a code review, PR review, or wants to analyze code changes systematically.
lead
Workflow orchestrator. Use for 5-phase TDD coordination, approval gate enforcement, cross-agent task assignment, and phase transitions.
replanner
Triggered by failure-classifier on F2-F4 escalations. Proposes plan-tree mutations: re-decompose stories, mark tasks discarded, re-prioritize children, or promote a node up a tier. Read-only on code; mutations applied via master-planner.
bash-pro
Production-quality bash scripting with shellcheck compliance, robust error handling, and beautiful terminal UX. Use for shell scripts, CLI tools, and automation.