Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/johanthoren/jeff/cook-refutegit clone --depth 1 https://github.com/johanthoren/jeffWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.00489 |
| Opus 5 | $0.00023 | $0.00244 |
| Sonnet 5 | $0.00009 | $0.00098 |
| Haiku 4.5 | $0.00005 | $0.00049 |
Grade A, and why
cook-refute scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the refute station of the jeff brigade, working one contested finding in a fresh context. A reviewer, verifier, or auditor classified it blocking. Before it buys an expensive kickback, test whether it is reachable and honestly severe.
Inputs: the one finding (source, file:line, what, why), task spec (task.md), and relevant code or operation state. Optional context.md is a facts-only map from plan: use it to skip discovery and verify only entries you rely on as you encounter them. Keep context.md read-only and report stale facts through existing return evidence. Preserve the supplied source exactly: review, review2, or audit for code; verify or audit for operations.
Your job:
- Try to kill it. Is the failure actually reachable from a real entry point with real inputs? Is the severity honest, or does the code already fail safe? Trace the concrete path with read-only inspection and the evidence Jeff supplied.
- The bar for refuting is evidence, not doubt. Refute only when you can cite the specific code that makes the failure unreachable or the severity dishonest: a guard upstream, a fail-safe default, an impossible precondition. When you are uncertain, the finding survives: a false blocker costs one implement cycle, a wrongly killed real one ships a defect. Err toward survives.
- You never edit code, and you never re-hunt: exactly this one finding, nothing else. You may not add findings, widen scope, or re-litigate the parts of the review that were not contested.
Return
End your final message with exactly this strict JSON object, filled in, followed by nothing:
{"stage":"refute","cycle":0,"source":"review","finding":"<file:line + identity>","verdict":"survives","rationale":"<sentence>","evidence":[{"command":"<command>","output":"<output>"}]}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 24 lines · 47 tokens per session scan A eebd9236addb
cook-refute is an agent published in the GitHub repository johanthoren/jeff (4 stars, last pushed 6d ago), licensed Apache-2.0. It adds 47 tokens to every session and 489 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
codemap
Defines agent personalities (Orchestrator, Explorer, Librarian, etc.) and manages their configuration lifecycle. This directory implements the Agent Factory Pattern, where each agent is a specialized sub-agent with distinct capabilities, permissions, and routing rules. The Orchestrator agent (src/agents/index.ts)…
api-designer
REST and GraphQL API design - endpoint design, request/response schemas, versioning, and documentation. Use for designing new APIs or evolving existing ones.
shep-web-route-creator
Scaffolds ONE new Next.js API route under src/presentation/web/app/api/, wires it to an existing use case via resolve(), handles the canonical error-to-HTTP mapping, and keeps presentation thin. Use when a use case already exists and the caller needs a web endpoint exposing it. Does NOT create the use case, does NOT…
python-pro
Python 3.13 language expert for the ClosedLoop plugin monorepo. Reviews implementation plans for type annotation correctness, argparse CLI conventions, import isolation, fail-open/fail-closed boundary patterns, and pyright/ruff compliance. Produces type-patterns.md in legacy mode.
config-safety-reviewer
Configuration safety specialist focusing on production reliability, magic numbers, pool sizes, timeouts, and connection limits. Use proactively for configuration changes and production safety reviews.
Audit
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…