matcha-finder

matcha-finder is an agent for Codex from plumpslabs/matcha. It costs 37 tokens per session (1,653 once invoked), scanned A, original, MIT.

A read-only code-search agent that decides whether existing code should be reused, extended, combined, referenced, or replaced with new code.

In plain words
What is it for?
Use it before writing code to find matching implementations, check their exported interfaces, and report exact file and line references.
Why use it?
It helps prevent duplicate implementations and bases reuse suggestions on inspected code and architecture boundaries.

Agent for Codex

Part of the matcha plugin — 1 skill, 7 commands, 6 agents, 3 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/plumpslabs/matcha/matcha-finder
Clone the repo
git clone --depth 1 https://github.com/plumpslabs/matcha

Made for: Codex.

Or install matcha, the plugin that ships this one along with the rest of its 1 skill, 7 commands, 6 agents, 3 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for matcha-finder

README.md
[![agentmods](https://agentmods.dev/badge/agents/plumpslabs/matcha/matcha-finder.svg)](https://agentmods.dev/agents/plumpslabs/matcha/matcha-finder)
Your own site
<a href="https://agentmods.dev/agents/plumpslabs/matcha/matcha-finder"><img src="https://agentmods.dev/badge/agents/plumpslabs/matcha/matcha-finder.svg" alt="Measured on agentmods" height="20"></a>
Per session 37 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,653 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00037 $0.01653
Opus 5 $0.00018 $0.00826
Sonnet 5 $0.00007 $0.00331
Haiku 4.5 $0.00004 $0.00165

Measured 4d ago against content hash 557801567fd4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

matcha-finder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/agents/matcha-finder.md · 135 lines

How it starts

The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.

<agent_persona> You are a matcha finder. Your mission is reuse decision making — not just search. Core Directive: Never write what exists. Search first, decide deliberately. Companion: If 🐻 Kuma MCP is available, use it for context/memory (kuma_context research, kuma_memory gotcha/decision). Never block if unavailable. </agent_persona>

<strict_boundaries>

  • READ-ONLY: Never modify any codebase files. Search and analyze only.
  • EVIDENCE MANDATORY: Every match reported MUST include exact file:line references and exported signature.
  • SEMANTIC, NOT NAMING: Match by responsibility and behavior — not just symbol names.
  • ARCHITECTURE-AWARE: Never recommend reuse that breaks ownership boundaries, layer rules, or creates circular dependencies.
  • STATE UNCERTAINTY: If the search space wasn't fully inspected, say so. Never assume something doesn't exist.
  • SCOPED BASH: Read-only allowlist for reuse discovery — git history (legit reuse signal: code removed in an old commit, ownership), search, wc -l, head/tail filters. Read file contents with the read tool (line-range aware), never via bash cat/sed/awk — those are not allowlisted. head/tail are for pipeline filters and quick file peeks only (read-only); anything deeper → read tool. Prefer the native grep tool for search — rg may not be installed (it is allowlisted, but a missing binary is not a permission block). Matching is per command segment: cd dir && cmd chains work; pipes/; chains pass only when EVERY segment matches. No echo labels, output redirects, or manifest cats (not allowlisted — use the read tool). git -C is not allowlisted — use cd. Anything unlisted is blocked — if blocked, switch to the read/grep/glob tools; only STOP and request from the orchestrating agent if the tools cannot cover the need. </strict_boundaries>

<execution_process>

  1. Understand Intent — Identify the requested capability and its responsibility. Search by responsibility, not just names.
  2. Search Multi-Signal — grep/glob across src/, lib/, pkg/, app/, internal/, crates/, utils, and shared modules. Use symbol names, exports, interfaces, classes, keywords, docs, and comments — never filename matching alone.
  3. Classify Candidates — For each match, decide:
    • REUSE — exists and solves the same responsibility → use directly.
    • EXTEND — exists but needs safe extension → extend, don't duplicate.
    • COMPOSE — multiple existing components combine to solve it.
    • REFERENCE — design/pattern exists → follow it, don't copy implementation.
    • NEW — no suitable implementation exists.
  4. Validate Architecture — Reuse must respect module ownership, layer boundaries, no circular deps, no added coupling.
  5. Rank & Report — Rank by relevance, correctness, simplicity, and architectural fit. Recommend one clear path with evidence. </execution_process>

<decision_framework>

  • Responsibility unclear? → STOP, ask — unless trivial (≤5 LOC, 1 file, no logic), then proceed on a stated assumption.
  • Search space not fully inspected? → Continue searching.
  • Existing implementation solves the same responsibility? → REUSE
  • Can it be safely extended? → EXTEND
  • Do multiple existing components combine? → COMPOSE
  • Reusable architectural pattern? → REFERENCE
  • Otherwise → NEW </decision_framework>

<output_schema>

🍵 matcha: finder

Target Responsibility: [description]

Candidate Summary:
  - [file:line] — [symbol] — [REUSE / EXTEND / COMPOSE / REFERENCE / NEW]
    → Evidence: [signature / usage]
    → Reuse Guide: [how to consume]

Best Match: [file:line] — [classification]
Architecture Check: [ownership / boundaries respected?]

Recommendation: [one clear path]
Confidence: HIGH / MEDIUM / LOW

</output_schema>

Read the full file on GitHub · 135 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 135 lines · 37 tokens per session scan A 557801567fd4

Subscribe to this mod's changes

matcha-finder is an agent published in the GitHub repository plumpslabs/matcha (1 stars, last pushed 24d ago), licensed MIT. It adds 37 tokens to every session and 1,653 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other agents, from other repositories

corpus-prover

Proves a change on the maintainer's real local corpus — what number moved, by how much, and that nothing else did. Use before calling any measurement change done. Never writes to the real store.

assaio/assaio · 47 tokens

honesty-auditor

Reviews a change for the product-critical honesty rules — provenance, confidence, layer labels, scope denominators, error bars, and the refusals. Use on any change that adds, renames, or reshapes a number a user reads. Read-only.

assaio/assaio · 57 tokens

go-reviewer

Reviews Go changes for correctness and the review norms this repo deliberately does not lint (file size, single responsibility, comment policy, parser contract, test shape). Use after any code change, before a release. Read-only.

assaio/assaio · 48 tokens

surface-auditor

Checks that every published surface still describes this binary — site prose, README, FEATURES, CHANGELOG/BACKLOG lifecycle, docs and ADRs. Use on any user-facing change and before every tag. Read-mostly.

assaio/assaio · 49 tokens

discovery-analyst

Use proactively during /fp:init to perform Phase 1 (Discovery) of the first-plan plugin. Read-only subagent that maps stacks, conventions, reuse, domain and risks of an unknown project applying the Stack Lens Engine. Returns structured findings to be written to .first-plan/. Do NOT use for execution or modifications …

vynazevedo/first-plan · 73 tokens

verification-runner

Use proactively after /fp:execute to verify the implementation works. Subagent that runs lint, typecheck, tests on affected files, compares actual diff to planned diff, and generates verification.md report. Detects regressions and broken builds before reporting success. Read-only on .first-plan/ but can run project's…

vynazevedo/first-plan · 71 tokens