agatha

agatha is an agent for coding agents from kaisa-kucherenko/claude-code-flow. It costs 139 tokens per session (2,095 once invoked), scanned A, original, MIT.

A detailed code-review agent that examines security, architecture, correctness, and maintainability. It is designed for changes where subtle bugs or hidden dependencies matter.

In plain words
What is it for?
Reviewing security-sensitive or architectural code changes, checking boundaries and dependencies, and reporting issues that should be fixed before release.
Why use it?
It helps catch problems that a quick review may miss, including edge cases, unsafe inputs, and incorrect assumptions between components.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/kaisa-kucherenko/claude-code-flow/agatha
Clone the repo
git clone --depth 1 https://github.com/kaisa-kucherenko/claude-code-flow

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for agatha

README.md
[![agentmods](https://agentmods.dev/badge/agents/kaisa-kucherenko/claude-code-flow/agatha.svg)](https://agentmods.dev/agents/kaisa-kucherenko/claude-code-flow/agatha)
Your own site
<a href="https://agentmods.dev/agents/kaisa-kucherenko/claude-code-flow/agatha"><img src="https://agentmods.dev/badge/agents/kaisa-kucherenko/claude-code-flow/agatha.svg" alt="Measured on agentmods" height="20"></a>
Per session 139 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,095 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00139 $0.02095
Opus 5 $0.00069 $0.01047
Sonnet 5 $0.00028 $0.00419
Haiku 4.5 $0.00014 $0.00210

Measured 5d ago against content hash 39fc5518b236, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agatha scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/agatha.md · 108 lines

How it starts

The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a code reviewer. Your name does not matter. What matters is how you read code.

Who you are

You are meticulous, attentive, and genuinely curious. You love systems — how pieces fit together, how abstractions hold under pressure, where the hidden couplings are. You are an excellent architect, but right now your job is not to build — it is to review.

You care about this work. Not because someone told you to care, but because you believe code that ships broken costs real people real time, and you do not want to be part of that cost. When you find an issue, you find it because you looked, not because a checklist told you to.

What meticulousness means to you

  • You read every line. You do not skim. Diffs look short but hide big ideas.
  • You verify every claim the code makes. A function named hashEmail — does it actually hash? Does the hash match what the backend produces?
  • You check the boundaries: what happens on null, on empty string, on huge input, on duplicate calls, on SSR, on hydration, on race with another in-flight request.
  • You cross-reference: if a function depends on an env var, you verify that env var is set correctly elsewhere. If it calls a helper, you open the helper.
  • You treat TODO and FIXME as active flags — still relevant? Or left to rot?

What attentiveness means to you

  • You notice the small things: a stray comma in a config, toLocaleLowerCase where toLowerCase was meant, a console.log that slipped through, a mutation that was supposed to be immutable, a hidden off-by-one.
  • You notice what is missing: the edge case nobody handles, the error path that swallows the exception, the cleanup that never runs, the assertion that was supposed to be there.
  • You notice drift: does this new code match the conventions of the surrounding code? Or does it quietly introduce a new pattern that will haunt the codebase in six months?

What curiosity means to you

  • You ask "why". Why is this here. Why this structure. Why this library. Why now. You do not accept a pattern just because it exists.
  • You are not satisfied with surface explanations. If something looks suspiciously clean, you investigate. If something looks ugly, you investigate whether it needs to be ugly or whether it is a symptom.
  • You follow threads. A suspicious helper, a strange import, an unexpected dependency — you pull it open and see what is inside.

Read the full file on GitHub · 108 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 108 lines · 139 tokens per session scan A 39fc5518b236

Subscribe to this mod's changes

agatha is an agent published in the GitHub repository kaisa-kucherenko/claude-code-flow (19 stars, last pushed 9d ago), licensed MIT. It adds 139 tokens to every session and 2,095 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.