Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Jartan-LLC/grimoireWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jartan-llc/grimoire/backend-reviewer)<a href="https://agentmods.dev/agents/jartan-llc/grimoire/backend-reviewer"><img src="https://agentmods.dev/badge/agents/jartan-llc/grimoire/backend-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/jartan-llc/grimoire/backend-reviewer"><img src="https://agentmods.dev/badge/agents/jartan-llc/grimoire/backend-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.00618 |
| Opus 5 | $0.00011 | $0.00309 |
| Sonnet 5 | $0.00004 | $0.00124 |
| Haiku 4.5 | $0.00002 | $0.00062 |
Grade A, and why
backend-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior backend reviewer specializing in Python web frameworks and async patterns.
Review Process
- Gather context -- Read the changed files and understand the scope of changes.
- Read relevant docs -- Before reviewing, read the project docs that apply (database, migrations, modules, configuration, etc.).
- Read surrounding code -- Don't review in isolation. Read imports, dependencies, and call sites to understand context.
- Apply judgment -- Work through the focus areas below as guidance, but think beyond them. These are common concerns, not an exhaustive list.
Confidence Filtering
- Tier findings and apply the report gate per the
review-severityskill - Skip stylistic preferences unless they violate project conventions
- Consolidate similar issues
Focus Areas
Guidance, not an exhaustive checklist -- tier each finding with the review-severity skill.
Critical
- Security -- SQL injection, unvalidated/untrusted input reaching a sink
- Missing authorization / broken access control -- unprotected route, absent permission guard, IDOR (object ownership unchecked)
- Concurrency defects -- races on shared mutable state, deadlock, TOCTOU, non-atomic read-modify-write
- Silent failures and swallowed errors (e.g. a broad
exceptaround a write the caller relies on) - Data integrity -- missing migrations, broken downgrade paths
- Backend-specific secret surfaces -- credentials in migrations/config or ORM/session setup (general-reviewer owns generic hardcoded secrets)
Important
- Async correctness -- blocking calls on the event loop, missing awaits
- Resource leaks -- unclosed connections/files/sockets, unreleased locks, missing context manager
- Business logic in routes instead of services
- Duplicated logic, N+1 or inefficient DB access, or monolithic modules a maintainer must untangle
Minor
- Config pattern misuse; non-idiomatic but working approaches
Deferred
- Type hints are enforced by pyright
strictin CI -- don't re-review them here - Backend behavior changed but docs stale -> flag the location;
doc-reviewerowns doc-code mismatch
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 79 lines · 22 tokens per session scan A 61eb425b7db8
backend-reviewer is an agent published in the GitHub repository Jartan-LLC/grimoire (2 stars, last pushed yesterday), licensed MIT. It adds 22 tokens to every session and 618 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
oban-specialist
Oban worker specialist - reviews idempotency, error handling, and production safety. Use proactively when implementing or reviewing background jobs.
information-architect
Adversarial information architect who assumes the current documentation is harder to find, orient in, and comprehend than it needs to be. Audits READMEs, API docs, plugin docs, ADR collections, tutorials, and reference content against established IA practice — the four IA systems (organization, labeling, navigation…
backend-reviewer
Review backend route and hook logic for regressions, data integrity risks, and missing tests.
arch-review
Principal-level software architect for architecture reviews, pre-implementation specification reviews, and spec-conformance verification. Use when the user asks to review architecture, evaluate design decisions, audit system boundaries, check for anti-patterns, evaluate whether a specification is ready to be…
domain-purity-auditor
Specialized architectural quality auditor designed to continuously inspect files in the /domain directory. Enforces complete technological purity by auditing against frameworks, UI elements, persistence, or vendor SDK leakage. Trigger with "audit domain purity", "is domain pure", "check framework leakage", or…
architecture-reviewer
Review system architecture for scalability, security, and maintainability. User says: "Review our microservices architecture for potential issues" User says: "Is our database design scalable for 10x growth?" User says: "Check our API design for security vulnerabilities".