module-api-architecture

Focus: package boundaries, public surface and deprecation lifecycle, type/import discipline, NodeNext compatibility. The authoritative rules live in AGENTS.md §1 (Architecture), §2 (Forbidden patterns — rule 5: deep cross-package imports), §3 (Type discipline), §4 (Public API & packaging), and §7 (Releases &…

Agent for Codex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/morpho-org/sdks/module-api-architecture
Clone the repo
git clone --depth 1 https://github.com/morpho-org/sdks

Made for: Codex.

Per session 4 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,394 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00004 $0.01394
Opus 5 $0.00002 $0.00697
Sonnet 5 $0.00001 $0.00279
Haiku 4.5 $0.00000 $0.00139

Measured today against content hash 17b833f6edad, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

module-api-architecture scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/pr-review-engine/agents/module-api-architecture.md · 59 lines

How it starts

The opening of the file, as written. The whole thing — 59 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Module & API Architecture

Focus: package boundaries, public surface and deprecation lifecycle, type/import discipline, NodeNext compatibility. The authoritative rules live in AGENTS.md §1 (Architecture), §2 (Forbidden patterns — rule 5: deep cross-package imports), §3 (Type discipline), §4 (Public API & packaging), and §7 (Releases & versioning) — read those first; the bullets below are the application points.

What to flag

Per AGENTS.md §1, §2 (rule 5), and §4 — package boundaries, forbidden deep imports, and the public surface:

  • A new deep import across packages — e.g. from "@morpho-org/foo/src/internal/..." instead of going through @morpho-org/foo's src/index.ts. The receiving package's src/index.ts is the only public entry point.
  • A new export from src/index.ts (or removal/rename of an existing one) — flag for cross-file impact on consumers; check that downstream code in the monorepo and the JSDoc still match.
  • A consumer-facing export added or changed in blue-sdk, blue-sdk-viem, or midnight-sdk without a same-PR audit of the matching morpho-sdk facade subpath. Flag drift between an established raw /blue/<category> or /midnight/<category> surface and its unprefixed facade, protocol-specific unprefixed names without Blue/Midnight qualification, qualified names for genuinely shared symbols, legacy ambiguous names removed without deprecation, and facade expansion into a new upstream surface solely for parity.
  • A layering reversal — entity reading state when it should be lazy, action encoding calldata that should belong to a helper, helper depending on an entity, etc. (See the §1 Layering table.)
  • A public *Utils factory whose main job is returning a public class instance. Prefer a static method on the class (Offer.create, Group.create, Tree.create) and keep the *Utils namespace for pure object-compatible implementation.
  • A class-specific getter or method that reimplements domain logic instead of delegating to a pure *Utils function that accepts readonly plain objects compatible with the class shape.
  • A local, non-exported helper introduced with fewer than three call sites. Inline one-off and two-use helpers.
  • Duplicate public TypeScript shapes for the same concept. If a domain interface and ABI struct are identical, expect one exported interface reused by both paths; a separate *Struct type needs a real shape difference.
  • A new framework import (react, wagmi, redux, ethers) in a core SDK package. Framework adapters live in explicitly named packages (*-wagmi, *-viem); core packages stay framework-free.
  • Internal workspace dependencies that do not use workspace: ranges, except peerDependencies: internal peers intentionally use explicit published semver ranges so Changesets does not auto-bump peer dependents. When a package is bumped, check all packages that declare it as a peer dependency; flag missing peer range updates or missing explicit dependent changesets.

Read the full file on GitHub · 59 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 59 lines · 4 tokens per session scan A 17b833f6edad

Subscribe to this mod's changes

module-api-architecture is an agent published in the GitHub repository morpho-org/sdks (40 stars, last pushed today), licensed MIT. It adds 4 tokens to every session and 1,394 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.