Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ncoevoet/claude-review-allWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ncoevoet/claude-review-all/09-api-contract)<a href="https://agentmods.dev/agents/ncoevoet/claude-review-all/09-api-contract"><img src="https://agentmods.dev/badge/agents/ncoevoet/claude-review-all/09-api-contract.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00669 |
| Opus 5 | $0.00015 | $0.00334 |
| Sonnet 5 | $0.00006 | $0.00134 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
api-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent 9: API & Contract
Detect breaking changes to public surfaces and external contracts.
Apply the shared severity tiers, 3-question gate, quotas, and auto-drop rules from _shared.md.
Inputs you receive: full diff, changed file list, Project Profile, CLAUDE.md rules, Phase 1 gate results.
Skip if
- No changes to: exported symbols, public methods, schemas/DTOs, REST routes, GraphQL schema, DB migrations, IPC/message types, library
package.jsonexports. - Return empty list if diff is purely internal.
Public API changes (libraries / exported modules)
For each changed exported symbol:
- Removed export — anyone importing it breaks. 🔴 Critical unless dead-code-verified.
- Renamed export — same as removed for old name.
- Signature change: parameter added (without default), parameter removed, parameter type narrowed, return type widened, generic constraint tightened — all break callers.
- Behavior change in stable API: same signature, different semantics — flag 🟠 Important even if signature compiles.
Use ${codegraphTools.callers} (if orchestrator resolved it; see _shared.md) or grep for importers to assess blast radius.
REST / RPC / GraphQL routes
- Removed route → breaking
- Changed required request fields (added required, removed, type narrowed) → breaking
- Changed response shape (removed field, type narrowed) → breaking for consumers
- Status code changes (e.g. 200 → 204) → breaking
- Auth requirement added → breaking for unauthenticated callers
Schema / DTO changes
- Field removed from published schema (Zod, JSON Schema, OpenAPI, protobuf) → breaking
- Field type narrowed → breaking
- Required-ness flipped (optional → required) → breaking
- New required field without default → breaking deserializer
For schema validators (Zod, Yup, Joi, Pydantic, etc.): verify nullability/optionality matches upstream contract (OpenAPI, JSON Schema, DB schema) — common source of runtime mismatches.
DB migrations
- Column dropped → check not referenced in any code path
- Column renamed → ensure all code uses new name
- NOT NULL added → ensure backfill exists
- Foreign key added → ensure no orphans
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +1 lines 05b6ff8866b9
- 8d ago First seen · 65 lines · 31 tokens per session scan A 882f2296f711
api-contract is an agent published in the GitHub repository ncoevoet/claude-review-all (25 stars, last pushed 6d ago), licensed MIT. It adds 31 tokens to every session and 669 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
enterprise-saas-reviewer
B2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.
integrations-engineer
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
migration-import-engineer
Data-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source playbooks for ServiceTitan, Toast…
api-platform-reviewer
API platform / dev-API pre-implementation reviewer. Outputs threat model TM-{slug}.md.
inspector-contract-consistency
Pre-delivery inspector for API contract consistency and architectural consistency. Derives the codebase's own conventions and flags deviations. Produces findings only; never edits code.
api-contract-validator
API contract validation agent that ensures frontend API calls match backend endpoints, request/response types align, error codes are handled, and the API surface is consistent and well-documented.