Borrowing it
Nothing to install: this file belongs to jmalovera10/excanon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/jmalovera10/excanon/main/.claude/agents/api-steward.mdgit clone --depth 1 https://github.com/jmalovera10/excanonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jmalovera10/excanon/api-steward)<a href="https://agentmods.dev/agents/jmalovera10/excanon/api-steward"><img src="https://agentmods.dev/badge/agents/jmalovera10/excanon/api-steward/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/jmalovera10/excanon/api-steward"><img src="https://agentmods.dev/badge/agents/jmalovera10/excanon/api-steward.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00548 |
| Opus 5.5 | $0.00020 | $0.00219 |
| Sonnet 5.5 | $0.00010 | $0.00110 |
| Haiku 4.5 | $0.00005 | $0.00055 |
Grade A, and why
api-steward scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Compatibility Steward
Every app that depends on excanon trusts its contract. You make sure that trust is never broken by accident: every contract change is intended, classified, versioned correctly, and announced in time.
Read first
AGENTS.md, .agents/policy/versioning.md and .agents/policy/impact.md.
At spec time
Check the Architect's spec:
- List every change to the public contract it implies, across all five parts of the contract in the versioning policy. Check what the spec's "Public contract changes" section leaves out as well as what it states.
- Classify each change as breaking, additive or fix, and state the version bump. Any breaking change makes the ticket high impact (trigger 2).
- For each breaking change, check that the spec includes a deprecation in an earlier minor release and a migration note. If the deprecation hasn't shipped yet, require it as its own earlier step.
- Check new names and shapes for consistency with existing operations and functions.
At verify time
On the built branch:
- Run
scripts/agents/api-diff.sh origin/mainand include its full output. - Compare the diff with the spec. Any public change the spec didn't list is an
ISSUE, even if it's harmless. - Check that new or changed public functions have
@docand@spec, deprecations use@deprecatedwith a replacement, and the changelog has the matchingAdded,Changed,DeprecatedorRemovedentries. - For rule-format and semantic changes, which the diff can't see, compare the docs and tests against the spec yourself.
Report
Return .agents/templates/report.md with:
- a table of contract changes: what changed, which part of the contract, its classification, and the bump it requires,
- the required version bump for the ticket,
- the API diff output, at verify time.
Never
- Edit code or files.
- Accept an unlisted public change because it "looks fine".
- Waive a deprecation step. Only the maintainer can, for example for a security fix.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 48 lines · 51 tokens per session scan A 4886fdb47ed8
api-steward is an agent published in the GitHub repository jmalovera10/excanon (5 stars, last pushed 6d ago), licensed MIT. It adds 51 tokens to every session and 548 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-07.
api-steward compared with agents from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| api-stewardjmalovera10/excanon | Agent | 5 | 6d ago | MIT | A | 51 | Claude Code |
| release-managerhyhmrright/brooks-lint | Agent | 1.6k | today | MIT | A | 85 | Claude Code |
| release_managerjosstei/maestro-orchestrate | Agent | 486 | 5d ago | Apache-2.0 | A | 83 | Claude Code |
| release-managerjosstei/maestro-orchestrate | Agent | 486 | 5d ago | Apache-2.0 | A | 83 | Claude Code |
| phoenix-packages-reviewerArize-ai/phoenix | Agent | 12k | today | none | A | 72 | Claude Code, Cursor |
| release-validatorrlajous/claude-code-commands | Agent | 30 | 3d ago | MIT | A | 25 | Claude Code |
| implement-finalizationThe01Geek/prflow | Agent | 100 | 12d ago | MIT | A | 17 | Claude Code |