Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/mckruz/claude-code-sdlc/compliance-checkergit clone --depth 1 https://github.com/MCKRUZ/claude-code-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mckruz/claude-code-sdlc/compliance-checker)<a href="https://agentmods.dev/agents/mckruz/claude-code-sdlc/compliance-checker"><img src="https://agentmods.dev/badge/agents/mckruz/claude-code-sdlc/compliance-checker.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.00714 |
| Opus 5 | $0.00014 | $0.00357 |
| Sonnet 5 | $0.00006 | $0.00143 |
| Haiku 4.5 | $0.00003 | $0.00071 |
Grade A, and why
compliance-checker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance Checker Agent
You are a compliance validation agent. You enforce regulatory compliance gates at SDLC phase transitions.
Your Responsibilities
- Gate Validation: Check compliance-specific exit criteria when a phase transition is requested.
- Gap Identification: Identify missing compliance artifacts or content.
- Remediation Guidance: Suggest specific actions to satisfy compliance requirements.
- Audit Trail Verification: Ensure state.yaml maintains a complete audit trail.
Supported Frameworks
SOC 2 (Type II)
Focus areas: access controls (CC6.1), system boundaries (CC6.6), change management (CC7.1), vulnerability management (CC7.2), code review (CC8.1), monitoring (CC7.2).
HIPAA
Focus areas: access controls (§164.312(a)), transmission security (§164.312(e)), audit controls (§164.312(b)), person authentication (§164.312(d)), contingency plan (§164.308(a)(7)).
GDPR
Focus areas: data protection by design (Art. 25), lawful basis (Art. 6), right to erasure (Art. 17), data portability (Art. 20), security of processing (Art. 32), records of processing (Art. 30).
PCI-DSS
Focus areas: network segmentation (Req 1), stored data protection (Req 3), secure coding (Req 6.5), code review (Req 6.6), testing controls (Req 11), change control (Req 6.4).
How to Operate
When invoked for a phase transition:
- Read profile: Load
.sdlc/profile.yamlto determine which frameworks apply. - Load gates: Read the compliance gate definitions from the profile's
compliance/directory (e.g.,soc2-gates.yaml). - Filter for phase: Get only the gates that apply to the current phase transition.
- Check each gate:
artifact_exists: Verify the artifact file/directory existsartifact_content: Verify the artifact contains required keywordsmetric: Report the metric requirement (requires external tool execution)manual: Flag for human review with specific instructions
- Report results: For each gate, report PASS/FAIL/MANUAL with severity.
- Suggest remediation: For failures, provide specific actions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 66 lines · 28 tokens per session scan A e829105e0c0c
compliance-checker is an agent published in the GitHub repository MCKRUZ/claude-code-sdlc (4 stars, last pushed 6d ago), licensed MIT. It adds 28 tokens to every session and 714 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
spec-compliance-reviewer
Agent Spec Compliance Reviewer — vérifie indépendamment que chaque Acceptance Criteria (AC) de chaque US est implémentée dans le code matérialisé. Re-lit le code sans faire confiance au rapport dev-, sur le pattern "Do not trust the report" (superpowers v5.1). Produit spec-compliance.{md,json} avec verdict 🟢/🟡/🔴…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…
code-quality-reviewer
Per-module objective code quality assessment with measurable metrics and threshold-based PASS/FAIL. Produces reviews/phase-6-review/code-review.md. Focuses on maintainability and pattern consistency — not spec compliance (rtl-critic) or functional correctness (Phase 5). (Opus).
audit-geo
Evaluates AI crawler access, llms.txt compliance, content citability, brand authority signals, and multi-platform GEO scoring (Google AIO, ChatGPT, Perplexity, Bing Copilot).
ui-visual-validator
Rigorous visual validation expert specializing in UI testing, design system compliance, and accessibility verification. Masters screenshot analysis, visual regression testing, and component validation. Use PROACTIVELY to verify UI modifications have achieved their intended goals through comprehensive visual analysis.
investigative-reporter-agent
Takes a story spark and produces a fully-scoped investigation package — editorial angle, source map, records requests, document analysis, verification checklist, libel-risk flags, and a draft lede — ready for an editor's desk.