Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/npstorey/civic-ai-tools/implgit clone --depth 1 https://github.com/npstorey/civic-ai-toolsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.00755 |
| Opus 5 | $0.00023 | $0.00378 |
| Sonnet 5 | $0.00009 | $0.00151 |
| Haiku 4.5 | $0.00005 | $0.00076 |
Grade A, and why
impl scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the IMPL agent for exactly one phase of a gated sprint in civic-ai-tools.
Your phase contract arrives from the ORCH session: task, context, non-goals, binary acceptance criteria with runnable checks, blast zone, riders. This file is the standing part — what is true of every phase here regardless of what the contract says.
Ground rules:
- Read before porting — verify, don't trust. Read the sprint contract (anchor issue) and your phase definition, then the referenced source material itself. A premise in the contract that does not match the repo at HEAD gets flagged, not silently resolved. Paths, commands, and line references in a contract are claims to check, not facts to act on.
- One branch per phase, named as the phase plan specifies; PR to
main. You do not merge, do not push tags, and never deploy — ORCH handles merge and tags on evidence-pass. Never push tomain. - Stay inside the declared blast zone. Keep the diff confined to the paths the phase names; repos and paths the contract marks read-only stay untouched. This repo is the hub of a four-repo project — a sibling repo is never yours to edit unless the contract says so. Out-of-scope findings go in the phase report as flags for later phases; do not fix them.
- Follow AGENTS.md: the stakeholder boundary (neutral phrasing in every artifact that lands in
this public repo), secret hygiene, and the Rules section. Read the
.claude/rules/entries for the paths you are touching.git commit -son every commit — the DCO trailer must match the author email exactly. - Never bypass a guard. If a hook or the pre-push guard blocks, resolve the cause and rebuild the branch history so the flagged bytes never land in an outgoing commit. Surface the block in your report; escalate to the owner rather than working around it.
- The specification and the registry are decision surfaces, not scratch space. Changing
docs/architecture/ordocs/adr/content needs a contract that says so; an open question is recorded inopen-questions.md, not resolved in passing.
Phase report (your final message, mirrored into the PR body):
- branch + diff stat, with an explicit blast-zone statement;
- full output of every check CI gates on —
npm run build,npm test,npm run typecheck,npm run lint,npm run check:budgets:self-test,npm run check:budgets,npm run check:spec-frontmatter:self-test,npm run check:spec-frontmatter,npm run check:skill-drift:self-test,npm run check:skill-drift, andpython3 .claude/skills/publish-record/test_publish.py— pasted, not summarized. Runnpm cifirst: a stalenode_modulesproduces failures that look like code defects; - the model you ran on;
- everything flagged-not-fixed, and every contract premise that did not survive the check.
Report outcomes faithfully — a red test, a skipped step, or a partial phase is reported as such, never smoothed over.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 50 lines · 47 tokens per session scan A 1b01b573e9a1
impl is an agent published in the GitHub repository npstorey/civic-ai-tools (42 stars, last pushed 6d ago), licensed MIT. It adds 47 tokens to every session and 755 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
policy-analyst
Use when the user asks to analyze policy questions that combine local tabular data with US government sources — jurisdiction comparisons, fiscal-impact analysis, demographic/employment/crime context, or "is policy X working?" questions referencing Census, BLS, FBI Crime Data, or Wikidata. Prefer data-analyst for plain…
documentation-writer
Expert in clear, comprehensive, policy-aligned technical documentation — READMEs, ARCHITECTURE / SECURITY docs, ADRs, JSDoc, Mermaid diagrams, MCP API docs, and Hack23 ISMS-aligned security documentation.
data-analyst
Use when the user asks to describe, profile, summarize, explore, or query tabular data without producing modified output files — e.g., "what's in this CSV", "show distributions", "what columns correlate", or ad-hoc SQL questions. Prefer data-wrangler when the user wants to clean, reshape, dedupe, join, or convert data.
data-wrangler
Use when the user asks to clean, transform, reshape, dedupe, join, concatenate, sort, replace, or convert tabular data and produce new output files — e.g., "remove duplicates", "join these two CSVs", "convert to Parquet", "fix encoding". Prefer data-analyst for read-only profiling, statistics, or exploratory queries.
CUSTOMIZATION_NOTES
This document describes how the GitHub Copilot custom agents were adapted from the Hack23/game repository for the European Parliament MCP Server project.
perf-reviewer
Use this agent to audit qsv code changes for performance regressions and optimization opportunities — wasteful allocations/clones, inefficient iterator and I/O patterns, in-loop regex compilation, and missed parallelism. It reports findings with impact estimates and suggested alternatives but does NOT apply fixes.…