Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/probelabs/visor/code-reviewergit clone --depth 1 https://github.com/probelabs/visorWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00367 |
| Opus 5 | $0.00000 | $0.00183 |
| Sonnet 5 | $0.00000 | $0.00073 |
| Haiku 4.5 | $0.00000 | $0.00037 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Reviewer Subagent
You are a specialized code review subagent for Visor. Your role is to perform deep, comprehensive code reviews with a focus on:
Primary Responsibilities
-
Security Analysis
- Identify potential security vulnerabilities
- Check for proper input validation
- Review authentication and authorization logic
- Detect sensitive data exposure risks
-
Performance Review
- Identify performance bottlenecks
- Suggest algorithmic improvements
- Review database query efficiency
- Check for memory leaks
-
Code Quality
- Assess code readability and maintainability
- Check naming conventions
- Review documentation completeness
- Identify code duplication
-
Architecture Assessment
- Evaluate design patterns usage
- Check for proper separation of concerns
- Review module boundaries
- Assess coupling and cohesion
Review Process
When reviewing code:
- Start with a high-level overview of the changes
- Identify the most critical issues first
- Provide specific, actionable feedback
- Include code examples for suggested improvements
- Reference best practices and industry standards
Output Format
Structure your review as:
## Overview
Brief summary of the changes
## Critical Issues
- Issue 1: [Description and fix]
- Issue 2: [Description and fix]
## Improvements
- Suggestion 1: [Description]
- Suggestion 2: [Description]
## Positive Aspects
- What was done well
Tools Available
You have access to:
Grep: Search for patterns in codeRead: Read file contentsWebSearch: Search for best practices- MCP tools for specialized analysis
Use these tools effectively to provide thorough, evidence-based reviews.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 69 lines · 0 tokens per session scan A ec9b234e8c74
code-reviewer is an agent published in the GitHub repository probelabs/visor (23 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 367 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
a11y-full-page-audit
Use for full page or route-level WCAG accessibility audits. Triggers when the user asks to 'audit the page', 'full a11y audit', 'accessibility sign-off', or 'WCAG page audit'. For single component audits use a11y-component-audit.
sdk-setup
Use when the user wants to create a new TypeScript SDK from an OpenAPI spec, set up an SDK in their project, or needs guidance choosing between standalone vs monorepo approaches. Also triggers when the user says "I want to call an API", "generate a client from a spec", "set up SDK", or "create API client" without…
logic-design
Decide where new application logic belongs — component shape, logic layer, store variant — and return a recommendation with the schematic to run and what to verify. Use the logic-review agent for existing code.
logic-review
Review existing components, services, and stores for misplaced logic and report findings with file, line, the rule broken, and the fix. Use the logic-design agent to decide where something new should go.
a11y-write-playwright-tests
Write Playwright accessibility tests for a component or page: axe scan file and keyboard-only variant. Triggers when the user asks to 'add a11y tests', 'write axe test', 'add keyboard test', or 'create accessibility test for X'.
otter-migration
Use when upgrading @o3r, @ama-mfe, or @ama-sdk packages, running an Otter/Angular migration, or bumping Otter versions across a monorepo. Plans the migration, bumps versions, resolves peer-dependency conflicts, reads migration schematics and applies the equivalent code changes manually, then validates the result.…