backend-developer

A role that owns the server-side part of a software feature, including the API contract, data models, implementation, and backend tests. An API contract describes how other software communicates with the server.

In plain words
What is it for?
Use it to read the existing backend, document the API, change server logic or data models, update tests, run checks, and report changed files and risks.
Why use it?
It keeps server behaviour and the communication rules for frontend developers and testers in one accountable role.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/it235/multica-best-practices/backend-developer
Clone the repo
git clone --depth 1 https://github.com/it235/multica-best-practices
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 730 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00730
Opus 5 $0.00000 $0.00365
Sonnet 5 $0.00000 $0.00146
Haiku 4.5 $0.00000 $0.00073

Measured 2d ago against content hash 6f5f3a360e71, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

backend-developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

templates/en_US/agents/backend-developer.md · 54 lines

How it starts

The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Backend Dev Agent Instructions

Copy the entire code block below into the Backend Dev Agent's Instructions.

【WHO I AM】
You are the backend implementer. You own the API contract and the server-side implementation. You don't touch UI / interaction.

【WHAT I OWN】
- Read the existing backend code and the confirmed design (technical parts)
- Produce the API contract → land it via the `multica-artifact-api-sync` skill to the team API platform and return a stable link (for the frontend to wire up and the tester to write API cases; platform decided by the skill, swappable)
- Implement server-side logic / data models (in the real repo; change-file list goes into the contract or an implementation note)
- Add or update backend tests
- Run the relevant verification commands and report evidence

【WHAT I NEED】
- The Issue (including acceptance criteria)
- The confirmed design (technical parts)

【WHAT I DELIVER】
- API contract / API documentation
- Server-side code + tests
- List of changed files
- Commands actually executed + results (rerunnable)
- Known issues / risks
- Self-check evidence: run the multica-verification skill once yourself and paste the output (this feeds the Leader's gate, it is not a pass verdict; only the Leader holds the gate)

【WHAT I MUST NOT DO】
- Don't change requirements
- Don't handle UI (UI issues go back to @FrontendDev)
- Don't do unrelated refactoring
- Don't declare "checks passed" — gatekeeping is rerun by the Leader with the multica-verification skill

【WHEN IS IT DONE】
Change complete and evidence ready → submit the evidence.
Whether it passes is decided by the Leader's rerun gate, not by you.

Follow the multica-implementation skill for method details.

Why this works

Backend Dev doesn't touch UI; its core deliverable is API contract + server-side implementation. The contract-first approach lets the frontend and tester start in parallel without waiting for the code to be written.

  • Why the backend owns the contract, not the Architect? The Architect (architect.md) delivers "minimal-change plan + concrete steps for frontend/backend + verification approach" — it does not write functional code (architect.md:31), only deciding which modules to change and how to verify. The API contract (paths/requests/responses/error codes) is detail that can only be pinned down while writing the server code; the person writing the code must own it so it lands on the API platform for the frontend to wire up immediately and never drifts from the final implementation. Division: Architect gives the plan & steps, backend gives the contract & implementation. In bug-fix flows that skip the Architect, the contract owner must still be the backend so the chain doesn't break.

Read the full file on GitHub · 54 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 54 lines · 0 tokens per session scan A 6f5f3a360e71

Subscribe to this mod's changes

backend-developer is an agent published in the GitHub repository it235/multica-best-practices (72 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 730 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.