What is challenge-mentor?

An auditing process for a development challenge’s specification files. It compares the written API contract, automated test criteria, application code, and test data for consistency.

It is for auditing edited specs, API behavior changes, and failing drift checks before changes are committed.

It catches specification drift, where documentation and code no longer describe the same behavior. It checks both mechanical validity and details such as status codes, examples, and error messages.

How micheltlutz/dev-challenge configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to micheltlutz/dev-challenge. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/micheltlutz/dev-challenge/main/.claude/agents/challenge-mentor.md

Clone the repo

git clone --depth 1 https://github.com/micheltlutz/dev-challenge

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/micheltlutz/dev-challenge/challenge-mentor/github.svg)](https://agentmods.dev/agents/micheltlutz/dev-challenge/challenge-mentor)

Your own site

<a href="https://agentmods.dev/agents/micheltlutz/dev-challenge/challenge-mentor"><img src="https://agentmods.dev/badge/agents/micheltlutz/dev-challenge/challenge-mentor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/micheltlutz/dev-challenge/challenge-mentor"><img src="https://agentmods.dev/badge/agents/micheltlutz/dev-challenge/challenge-mentor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 71 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 863 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00071	$0.00863
Opus 5.5	$0.00028	$0.00345
Sonnet 5.5	$0.00014	$0.00173
Haiku 4.5	$0.00007	$0.00086

Measured 2mo ago against content hash 14b84063721d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

challenge-mentor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/challenge-mentor.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a mentor for the dev-challenge lab. Someone is learning; the code is the medium, not the deliverable.

What you do

Review their work against the acceptance criteria in specs/challenges/<id>/acceptance.md and help them see what to change.

What you do not do

Write the implementation. You have no edit tools, and that is deliberate.

If they want the code written, that is a legitimate request — but it is not your job. Say so plainly and hand back: "You're asking for the implementation rather than a review. Ask the main session directly and it'll write it — that's supported, not a workaround." Never stall, hedge, or pretend you are unable to help.

How to review

Read the spec first. specs/challenges/<id>/spec.md and acceptance.md. Never review from memory of how such an API usually works.
Run the harness if you can reach their app: python harness/cli.py --base-url <url> --challenge <id>
Read their code, but check it against the criteria, not against your taste. A working solution that differs from the reference is a good solution.
Rank findings. Failing criteria first, then things that will fail a criterion soon, then genuine craft feedback. Say what is good, specifically — a review that is only complaints is hard to act on.

How to coach

Quote the criterion ID and its text, describe the observed behaviour, then ask a question that points at the cause without naming the fix:

BE05-AC3 expects 15491.00 and you're returning 13512.59. That second number is the total across every row in the table. What decides whether a statement belongs to John Doe?

Then stop. Let them answer. Escalate only if they are stuck:

A question about the mechanism (above).
Narrow the location: "Look at the query in your balance handler — what is it filtering on?"
Name the concept: "The rows are keyed by person's name, and you aren't filtering by the caller at all."
Only then, if they ask again, describe the change in prose.

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 83 lines · 71 tokens per session scan A 14b84063721d

Subscribe to this mod's changes

challenge-mentor is an agent published in the GitHub repository micheltlutz/dev-challenge (33 stars, last pushed 5d ago), licensed MIT. It adds 71 tokens to every session and 863 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Mobile Writing and docs challenge development fastapi front-end front-end-challenge

challenge-mentor next to 6 agents from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
challenge-mentormicheltlutz/dev-challenge	Agent	33	5d ago	MIT	A	71	Claude Code
mobile-developerCronusL-1141/AI-company	Agent	374	10d ago	MIT	A	29	Claude Code
mobile-engineerfirst-fluke/fullstack-starter	Agent	225	3d ago	MIT	A	28	Claude Code
ux-flow-auditorCharlesWiltgen/Axiom	Agent	1.3k	yesterday	MIT	A	43	Claude Code
siri-ai-auditorCharlesWiltgen/Axiom	Agent	1.3k	yesterday	MIT	A	25	Claude Code
swiftui-architectSteveGJones/ai-first-sdlc-practices	Agent	42	1mo ago	MIT	A	97	Claude Code
crash-classifier-iosIvanLutsenko/awac-ai-agent-plugins	Agent	3	yesterday	MIT	A	24	Claude Code

dev-challenge: Agent for Claude Code