Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/marko-php/marko/claude-codegit clone --depth 1 https://github.com/marko-php/markoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.01732 |
| Opus 5 | $0.00016 | $0.00866 |
| Sonnet 5 | $0.00006 | $0.00346 |
| Haiku 4.5 | $0.00003 | $0.00173 |
Grade C, and why
claude-code scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://claude.ai/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://claude.ai/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Code is Anthropic's official CLI for Claude. devai:install gives it full Marko awareness by writing .claude/settings.json with the Marko plugin marketplace registration and enabling three Claude Code plugins: marko-skills, marko-lsp, and marko-mcp.
Prerequisites
-
Claude Code installed. The recommended method is the native installer (no Node.js required, auto-updates in the background):
curl -fsSL https://claude.ai/install.sh | bashThis covers macOS, Linux, and WSL; see the Claude Code setup docs for Windows and other options. The legacy
npm install -g @anthropic-ai/claude-codestill works, but the native installer is now the preferred path. -
Authenticated. Run
claudein your terminal and complete the browser sign-in on first launch (there is no separateauth logincommand — use/logininside a session to switch or manage credentials). Runclaude doctorto confirm the installation type. -
marko/devaiinstalled (see Installation)
What devai:install writes
Running marko devai:install with Claude Code detected produces the following files:
AGENTS.md # Merged Marko guidelines (shared across agents)
CLAUDE.md # Includes @AGENTS.md and Claude-specific notes
.claude/settings.json # Marketplace registration + enabled plugins
AGENTS.md and CLAUDE.md
The installer writes merged Marko guidelines to AGENTS.md. The CLAUDE.md file references it via @AGENTS.md and adds a short Marko tooling section that describes the three plugins and the skill authority directive (skills are canonical spec — do not infer from sibling code).
Both files are written inside a <!-- BEGIN/END marko:devai --> marker block: each is created if absent, and on later runs only the marked region is refreshed — so anything you add outside the markers (your own project instructions in CLAUDE.md, extra guidelines in AGENTS.md) is preserved. Remove the markers to take full ownership and devai leaves the file alone. See Editing generated files. This is separate from the .marko/devai.json install marker described below, which only tracks whether devai has run.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 101 lines · 32 tokens per session scan C 0436c8d89f5f
claude-code is an agent published in the GitHub repository marko-php/marko (393 stars, last pushed 3d ago), licensed MIT. It adds 32 tokens to every session and 1,732 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
fixture-reviewer
Audits .test integration fixtures under tests/php/Integration/Fixtures for drift against the current compiler output. Use after lexer, parser, analyzer, or emitter changes.
module-docs-sync
Audits and updates CLAUDE.md files in src/php/ modules to match the actual code. Use after large refactors, new modules, or periodic maintenance.
tdd-coach
Guides test-driven development with red-green-refactor discipline. Use when implementing features or fixes with TDD.
quick-syntax
One-screen cheatsheet. For exhaustive rules see RULES.md; for typing details see tasks/typed-defn.md.
index
Agent "index" from phel-lang/phel-lang, covering agent index, intent map and examples.
changelog-keeper
Maintains CHANGELOG.md by analyzing commits since last release. Use when updating changelog, preparing releases, or reviewing what changed.