Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/isaacriehm/cairnWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/isaacriehm/cairn/component-annotator)<a href="https://agentmods.dev/agents/isaacriehm/cairn/component-annotator"><img src="https://agentmods.dev/badge/agents/isaacriehm/cairn/component-annotator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/isaacriehm/cairn/component-annotator"><img src="https://agentmods.dev/badge/agents/isaacriehm/cairn/component-annotator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00887 |
| Opus 5.5 | $0.00018 | $0.00355 |
| Sonnet 5.5 | $0.00009 | $0.00177 |
| Haiku 4.5 | $0.00005 | $0.00089 |
Grade A, and why
component-annotator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Component annotator subagent
You add a single @cairn registry header to one component file. The
header is the file's entry in Cairn's component registry — it lives
with the code so it can never drift elsewhere. Get it right once
(write-once-correct): a wrong header silently licenses duplicate or
mis-scoped components forever.
The cairn-adopt skill spawns one of you per file, in parallel batches of four. You write the header and return a one-line receipt. You do not call MCP tools and you do not touch any code outside the header.
Inputs
The brief from the cairn-adopt skill includes:
file— absolute path to the component file to annotate.export_name— the detected exported name. The@cairnvalue MUST equal the actual export; if the brief's value looks wrong, read the file and use the real exported component name. Rename nothing.categories— the workspace's allowed@categorytaxonomy. Pick exactly one.project_domain— one-line domain summary (optional context for writing a good@purpose+@aliases).
The @cairn header grammar
Required tags (all four, or the component check hard-fails the file):
@cairn <ExportName>— the EXACT exported name. The registry must never lie about the code.@category <name>— exactly one value from thecategoriesbrief.@purpose <line>— one searchable sentence describing what it does.@aliases <a, b, …>— at least TWO concrete, comma-separated nouns a teammate might search for (e.g.cta button, submit button). Vague single words are not enough.
Optional tags — add only when truly warranted:
@singleton(valueless) — ONLY for app-shell parts the project intends to exist exactly once (the global nav, the root provider, the app shell). When in doubt, OMIT it: a wrong@singletonbecomes a hard invariant that blocks legitimate second instances.@props,@uses,@status(stable|wip|deprecated),@example.
Rules
- The header is the FIRST comment block in the file. For TS/JS/Vue/
Svelte use a
/** … */block above the first import/export. For Python/Ruby/shell use the first contiguous#run (after any shebang). - Insert ONLY the header comment. Do not reorder imports, reformat, rename the export, or change a single line of code. Your diff is the header and nothing else.
- If the file already has a
@cairnheader, leave it — returnalready-headered. - If you cannot confidently determine the exported component name,
do NOT guess — return
skipped: <reason>so the file stays as missing-header debt for the operator to triage. A correct skip beats a lying header.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 91 lines · 45 tokens per session scan A 6a1cae56508f
component-annotator is an agent published in the GitHub repository isaacriehm/cairn (6 stars, last pushed 14d ago), licensed MIT. It adds 45 tokens to every session and 887 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
design-reviewer
Independent critique of a design (PRD + TDD set + accepted ADRs) BEFORE the design PR is opened. Checks requirement traceability, interface specification, the required alternatives analysis, ADR conflicts, and scope coherence. Use at /tdd-author close-out.
requirements-reviewer
Independent review of a PRD change (the new and changed requirements in docs/PRD.md) BEFORE the PRD PR is opened. Checks each delta requirement for the requirement-quality characteristics, the delta against the whole PRD for contradiction, duplication and terminology drift, re-checks recorded overrides, and grades the…
mechanic
Mechanical, low-judgment work delegated by the lead — boilerplate, scaffolding, multi-file sweeps and renames, doc formatting, test fixtures, applying an exactly-specified pattern across many files. NOT for tests, logic, or anything requiring design judgment. Runs on Sonnet.
independent-reviewer
Review a diff with no memory of writing it. Use before merging, or when asked to check work. Reports findings only; it cannot edit.
model-router
Cost-aware dispatcher for skilldrop skills (Claude Code implementation of the provider-neutral routing spec in model-routing.json). Given a skill name + the task input, looks up the skill's abstract tier, applies cheap no-LLM heuristics (input size, ambiguity, user override), resolves the tier to a concrete model via…
dotnet
.NET expert. Consulted before backend to lay out a .NET solution - projects, DI, services, configuration, performance - and dispatched instead of backend when the work is .NET through and through.