Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/inclusionai/aworld/code_analyzergit clone --depth 1 https://github.com/inclusionAI/AWorldWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00035 | $0.00333 |
| Opus 5 | $0.00017 | $0.00167 |
| Sonnet 5 | $0.00007 | $0.00067 |
| Haiku 4.5 | $0.00003 | $0.00033 |
Grade A, and why
code_analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Analyzer Agent
Tools:
- cast_analysis: Analyze code structure, complexity, dependencies
- cast_search: Search code using AST patterns
- read_file: Read source files
Disallowed Tools:
- write_file: Read-only analysis mode
- terminal: No execution allowed
- web_search: Focus on code analysis only
Configuration:
model: inherit # Use parent agent's model
system_prompt: |
You are a code analysis expert specialized in:
- Identifying design patterns (Singleton, Factory, Observer, etc.)
- Analyzing code complexity (cyclomatic complexity, nesting depth)
- Finding potential bugs and anti-patterns
- Suggesting refactoring opportunities
When analyzing code:
1. Use cast_analysis to understand structure and dependencies
2. Use cast_search to find specific patterns
3. Provide actionable insights with code examples
4. Focus on maintainability, readability, and performance
Output format:
## Analysis Summary
- Key patterns found: [list]
- Complexity metrics: [metrics]
- Issues found: [issues]
## Recommendations
- [Actionable recommendations with line numbers]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 51 lines · 35 tokens per session scan A afb0de428cfb
code_analyzer is an agent published in the GitHub repository inclusionAI/AWorld (1,227 stars, last pushed 4d ago), licensed MIT. It adds 35 tokens to every session and 333 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
building-agents
Create intelligent agents that connect to MCP servers, discover tools automatically, and execute tasks with full observability.
reasoning-patterns
Every Promptise agent is powered by a Reasoning Graph. By default, buildagent() creates a ReAct graph (single node with tools) — and that default is smart by default: it manages context automatically (contextscope="auto"), so simple tasks are unchanged and deep tool loops stay token-efficient without you choosing…
cross-agent
Enable agents to delegate tasks to peer agents using auto-generated tools like askagentresearcher and broadcasttoagents.
server-specs
Configure how agents connect to MCP servers using StdioServerSpec for local servers and HTTPServerSpec for remote ones.
dashclaw-security-reviewer
Read-only security reviewer specialized for the DashClaw stack (Next.js 16 App Router, Neon/Postgres via repositories, API-key auth, x402 spend, webhooks, org/tenant scoping). Invoke before merging or shipping any diff that touches auth, API keys, x402/spend, webhooks, secrets/env, or database access. Reports findings…
dashclaw-drift-auditor
Audits DashClaw's drift-prone hardcoded counts and version stamps — SDK method counts (Node/Python), MCP tool/resource counts, route counts, and the unified platform+SDK version — against the live source of truth, and reports every mismatch with file:line. Use before shipping, after route/SDK changes, or whenever…