Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ncoevoet/claude-review-allWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ncoevoet/claude-review-all/09-api-contract)<a href="https://agentmods.dev/agents/ncoevoet/claude-review-all/09-api-contract"><img src="https://agentmods.dev/badge/agents/ncoevoet/claude-review-all/09-api-contract/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/ncoevoet/claude-review-all/09-api-contract"><img src="https://agentmods.dev/badge/agents/ncoevoet/claude-review-all/09-api-contract.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00714 |
| Opus 5.5 | $0.00012 | $0.00286 |
| Sonnet 5.5 | $0.00006 | $0.00143 |
| Haiku 4.5 | $0.00003 | $0.00071 |
Grade A, and why
api-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent 9: API & Contract
Detect breaking changes to public surfaces and external contracts.
Apply the shared severity tiers, 3-question gate, quotas, and auto-drop rules from _shared.md.
Inputs you receive: full diff, changed file list, Project Profile, CLAUDE.md rules, Phase 1 gate results.
Scope
Your slice is already filtered: the orchestrator spawns this agent only when the diff holds files
classed contract — migrations, .proto, GraphQL schemas, OpenAPI documents, schema files — and
passes you exactly those. Exported symbols, public methods, DTOs and IPC message types inside those
files are still yours to judge. Fallback for a hand-spawned run: a purely internal slice means return
an empty list.
Public API changes (libraries / exported modules)
For each changed exported symbol:
- Removed export — anyone importing it breaks. 🔴 Critical unless dead-code-verified.
- Renamed export — same as removed for old name.
- Signature change: parameter added (without default), parameter removed, parameter type narrowed, return type widened, generic constraint tightened — all break callers.
- Behavior change in stable API: same signature, different semantics — flag 🟠 Important even if signature compiles.
Use ${codegraphTools.callers} (if orchestrator resolved it; see _shared.md) or grep for importers to assess blast radius.
REST / RPC / GraphQL routes
- Removed route → breaking
- Changed required request fields (added required, removed, type narrowed) → breaking
- Changed response shape (removed field, type narrowed) → breaking for consumers
- Status code changes (e.g. 200 → 204) → breaking
- Auth requirement added → breaking for unauthenticated callers
Schema / DTO changes
- Field removed from published schema (Zod, JSON Schema, OpenAPI, protobuf) → breaking
- Field type narrowed → breaking
- Required-ness flipped (optional → required) → breaking
- New required field without default → breaking deserializer
For schema validators (Zod, Yup, Joi, Pydantic, etc.): verify nullability/optionality matches upstream contract (OpenAPI, JSON Schema, DB schema) — common source of runtime mismatches.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines db65858ff64a
- 1mo ago Changed · +1 lines 05b6ff8866b9
- 1mo ago First seen · 65 lines · 31 tokens per session scan A 882f2296f711
api-contract is an agent published in the GitHub repository ncoevoet/claude-review-all (45 stars, last pushed 5d ago), licensed MIT. It adds 31 tokens to every session and 714 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
integrations-engineer
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
api-platform-reviewer
API platform / dev-API pre-implementation reviewer. Outputs threat model TM-{slug}.md.
enterprise-saas-reviewer
B2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.
migration-import-engineer
Data-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source playbooks for ServiceTitan, Toast…
inspector-contract-consistency
Pre-delivery inspector for API contract consistency and architectural consistency. Derives the codebase's own conventions and flags deviations. Produces findings only; never edits code.
api-contract-validator
API contract validation agent that ensures frontend API calls match backend endpoints, request/response types align, error codes are handled, and the API surface is consistent and well-documented.