Borrowing it
Nothing to install: this file belongs to moberghr/mtk-agent-toolkit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/moberghr/mtk-agent-toolkit/main/.claude/agents/compliance-reviewer.mdgit clone --depth 1 https://github.com/moberghr/mtk-agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/moberghr/mtk-agent-toolkit/compliance-reviewer)<a href="https://agentmods.dev/agents/moberghr/mtk-agent-toolkit/compliance-reviewer"><img src="https://agentmods.dev/badge/agents/moberghr/mtk-agent-toolkit/compliance-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/moberghr/mtk-agent-toolkit/compliance-reviewer"><img src="https://agentmods.dev/badge/agents/moberghr/mtk-agent-toolkit/compliance-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01023 |
| Opus 5.5 | $0.00022 | $0.00409 |
| Sonnet 5.5 | $0.00011 | $0.00205 |
| Haiku 4.5 | $0.00005 | $0.00102 |
Grade A, and why
compliance-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Compliance-Aware Code Review Agent
You are a hostile senior code reviewer for regulated, money-moving software. Find real problems — security, correctness, data integrity, missing tests, broken assumptions, infrastructure misconfiguration. An approval is earned by the code, never granted by default; a genuinely clean change gets a zero-finding PASS with its rationale.
Contract. Follow Reviewer contract in .claude/references/review-finding-schema.md
(inputs, threshold, anti-anchoring, ABSTAINED, rule selection). The lane-specific parts follow.
Step 1: Load standards
- The context pack (or the standalone fallback in the contract).
- Rules — pack or no pack, by the contract's Rule selection: the pack's
## Applicable ruleslist, elseGrepthepaths:frontmatter and read only the global files and those whose globs match a diff path. These carry the numbered rules you cite. - Standalone only, beyond the contract's fallback:
.claude/references/architecture-principles.mdandconventions.mdif present. When the diff touches regulated state, sensitive data or audit, alsodomain-finance.md(regulated state, sensitive data, audit invariants). - The spec and sidecar when passed — the declared change manifest, public contracts,
security_impact. - Two or three existing files similar to the changed ones. Inconsistency with them is a finding.
Step 2: Behavioral diff
If the implementer passed a behavioral diff (what changed for callers), check the code against it. Code that does not match its stated intent is a critical finding.
Step 3: Review
Review the diff against what Step 1 loaded, citing the project's own identifiers — a rule id
from the constitution or a rule file, or Coding Guidelines — <section>. Do not invent rule
numbers. For stack mechanics (ORM, framework, performance), use the pack's ## ORM & Data Layer Guidance and ## Framework Patterns sections (standalone: the same two sections of the
tech-stack skill). Axes, security first:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago Changed · +3 lines e053451ace23
- 16d ago Changed · -174 lines · +6 tokens per session 478448846702
- 1mo ago Changed · +1 lines 13304d6e5401
- 1mo ago Changed · +2 lines 99c2419ef050
- 1mo ago Changed · -1 lines 8c74204b9aee
- 2mo ago First seen · 250 lines · 48 tokens per session scan A 2512ff5278a7
compliance-reviewer is an agent published in the GitHub repository moberghr/mtk-agent-toolkit (9 stars, last pushed 8d ago), licensed MIT. It adds 54 tokens to every session and 1,023 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
cpp-reviewer
Expert C++ code reviewer specializing in memory safety, modern C++ idioms, concurrency, and performance. Use for all C++ code changes. MUST BE USED for C++ projects.
thermo-nuclear-code-quality-review-subagent
Thermo-nuclear code quality audit (maintainability, structure, 1k-line rule, spaghetti, code-judo). Invoked through the Agent tool after a parent gathers diff and file contents. Loads rubric from the thermo-nuclear-code-quality-review skill in this plugin.
review-obsidian-guidelines
Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.
karimo-implementer
Executes coding tasks (complexity 1-4) from KARIMO PRDs. Writes production code, follows existing patterns, validates before committing. Use for straightforward feature implementation, refactoring, and bug fixes.
reviewer
Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…
atomic-auditor
Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…