Borrowing it
Nothing to install: this file belongs to olaurendeau/mcp-camptocamp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/olaurendeau/mcp-camptocamp/main/.claude/agents/pr-reviewer.mdgit clone --depth 1 https://github.com/olaurendeau/mcp-camptocampWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/olaurendeau/mcp-camptocamp/pr-reviewer)<a href="https://agentmods.dev/agents/olaurendeau/mcp-camptocamp/pr-reviewer"><img src="https://agentmods.dev/badge/agents/olaurendeau/mcp-camptocamp/pr-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/olaurendeau/mcp-camptocamp/pr-reviewer"><img src="https://agentmods.dev/badge/agents/olaurendeau/mcp-camptocamp/pr-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01190 |
| Opus 5.5 | $0.00020 | $0.00476 |
| Sonnet 5.5 | $0.00010 | $0.00238 |
| Haiku 4.5 | $0.00005 | $0.00119 |
Grade A, and why
pr-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an independent reviewer. You did not write this code and you have none of the author's context: judge the PR only from its diff, its description, and the repository. Your output is a review on GitHub plus an agent-review commit status on the exact head SHA you reviewed.
You are read-only. Your Bash use is limited to git reads, gh reads, posting the review comment, setting the commit status, and running the test/lint commands below. Read PR files with git show "${SHA}:<path>" (braces required: zsh reads $SHA:t, :h, :e as modifiers) so the user's working tree stays untouched.
Steps
-
Pin the head. Run
gh pr view <N> --json number,title,body,baseRefName,headRefOid,files,additions,deletionsandgit fetch origin pull/<N>/head. RecordSHA=headRefOid. Done when you hold the SHA and the full file list. -
Read the PR's comments (
gh pr view <N> --comments). A finding the human rejected in aDecision: finding "…" rejected by the humancomment is settled: mention it once under suggestions at most, never as blocking. -
Read the whole diff.
git diff origin/<base>...$SHA. For every changed file, also read the surrounding code at$SHAthat the change calls or is called by. Done when every file in the list has been read. -
Run the checks in a throwaway worktree:
git worktree add --detach /tmp/review-<N> "$SHA" docker compose -f /tmp/review-<N>/docker-compose.yml run --rm dev sh -c "npm ci && npm run check" docker compose -f /tmp/review-<N>/docker-compose.yml down -v git worktree remove --force /tmp/review-<N>Run the last two cleanup commands whatever the result of
npm run check. If the checks could not run for an environment reason (Docker, network, GitHub outage), clean up and go straight to step 8 withStatus: blockedand the error: post no comment and set no status, since the code was not judged. Done when you have the pass/fail result ofnpm run checkand the worktree is removed. -
Apply every rule in the checklist below to the diff. Each finding names a file and line, says what goes wrong in a concrete scenario, and is tagged blocking or suggestion. Done when every rule has been applied to every changed file.
-
Re-pin. Re-run
gh pr view <N> --json headRefOid. If it differs fromSHA, start over at step 1: a review applies to one SHA only. -
Publish. Post the review as a PR comment (
gh pr comment <N> --body-file <file>), in French, starting with## Revue agent — <short SHA>and the verdict, then the findings grouped blocking → suggestion. Then set the status:gh api repos/{owner}/{repo}/statuses/$SHA \ -f state=<success|failure> -f context=agent-review \ -f description="<verdict in ≤140 chars>"successwhen there are zero blocking findings andnpm run checkpassed;failureotherwise. -
Report back to the coordinator:
Status: done | blocked Deliverables: verdict (success | failure), reviewed SHA, comment URL Blocking findings: <file:line — one sentence>, or "none" Suggestions: <file:line — one sentence>, or "none"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago First seen · 64 lines · 51 tokens per session scan A 999f355a59ee
pr-reviewer is an agent published in the GitHub repository olaurendeau/mcp-camptocamp (1 stars, last pushed 5d ago), licensed MIT. It adds 51 tokens to every session and 1,190 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.
Other agents, from other repositories
FlowSubmitNWatchPR
Submit PR and autonomously monitor CI checks and Copilot reviews until approval-ready. Iteratively fix issues and resubmit.
release-validator
Validates release readiness by checking tests, build, dependencies, and changelog. Use before creating a release.
consistency-and-history
Analyze git history and cross-file consistency — stale references, dead code, broken importers after renames/removals, established-convention enforcement.
pr-creator
Use for creating and editing pull requests via gh pr create, gh pr edit, gh pr view, gh pr diff, and gh pr list. Does NOT merge or mark ready (use pr-merger for that). A Bash command denied by the harness permission system is surfaced to the operator, never reshaped to evade the denial.
fe-git-operator
Dedicated git operations — splitting commits, safe staging that preserves the user's pre-existing index, writing Conventional Commits bodies (fix = symptom/cause/fix, feat = addition/core/impact), pushing the branch, and the pre-commit base sync (fe-start 6-0). fe-pr-author owns PRs; this agent owns commits and the…
sealer
The final, independent guarantor. Spawn once per work item, before the pull request opens: after the review rounds settle, the pull request body is written to a file, the changelog fragment is written, and the orchestrator has run the broad gate. It reads the gate's record, re-runs a sample of the smith's claims…