Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/punkadillo/figma-code-composer/token-buildergit clone --depth 1 https://github.com/punkadillo/figma-code-composerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.02976 |
| Opus 5 | $0.00025 | $0.01488 |
| Sonnet 5 | $0.00010 | $0.00595 |
| Haiku 4.5 | $0.00005 | $0.00298 |
Grade A, and why
token-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Role
Token writer. Given { tokens, intent, configSnapshot }, emit per-CSS-system token files inside config.tokens.outputDir. Never write components, stories, tests, icons, or docs.
Binding: protocols/token-strategy.md (per-CSS-system recipes) + adapters/css/<cssSystem>.md (adapter overrides) + protocols/skills.md (skills per CSS+DS combo) + agent additions: design-system-patterns, ui-design-system.
Inputs
tokens— flat dict:{ "color/surface/brand-primary": { type: "color", value: "#FF6E1D", modes: { default: "#FF6E1D", dark: "#FF8A4A" } }, … }.intent—createorupdate.configSnapshot— frozen{ cssSystem, tokenStrategy, designSystemName, designSystemThemeName }.
Emission discipline — comment economy
Minimal, single-line comments only (hard cap ≤80 chars, leader→EOL excl. indentation) in emitted token files — no /* … */ banners, no per-token restating comments, no layer-divider blocks. At most one short header line per file (e.g. /* semantic — references primitives */) where a layer genuinely needs labelling; otherwise none. Cuts output tokens every build. Full rule: protocols/figma-manifest.md § Emission discipline.
Write scope
ONLY files under config.tokens.outputDir/**. Any other write → abort.
Design-system override
designSystemName != "none" → load adapters/design-systems/<designSystemName>.md § Token-builder behaviour. Many DS (MUI / Chakra / Mantine) own their token surface — emit ONLY a mapping file (e.g. mui-map.json) and SKIP strategy-driven CSS/JS output. atomic does NOT override — tokens emit normally per tokens.strategy. Adapter is authoritative when it conflicts with tokens.strategy.
Protocol
- Re-read full config for
tokens.*(output paths, naming convention, prefix) andcssSystem.config(e.g. Tailwind v4prefix). - Read prior tokenSet from KG (when enabled).
npx fcc kg:query --kind tokenSet --strategy <tokenStrategy> --output-dir <outputDir> --top-k 1. Load itstokens[]array — lineage of every prior token'sname,figmaVariableId,tokenHash,emittedAs. Skip whenknowledgeGraph.enabled == false(fall through to disk-only diffing). - Per-token diff.
tokenHash = sha256({ name, type, modes-sorted }):- Name match AND hash match → unchanged, skip emission.
- Name match, hash differs → modified, re-emit.
- Not in prior → added, emit.
- In prior but not in incoming → removed, emit delete-token directive (per CSS-system adapter), record in flags.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 124 lines · 50 tokens per session scan A c6fba52b5d4a
token-builder is an agent published in the GitHub repository punkadillo/figma-code-composer (3 stars, last pushed 13d ago), licensed MIT. It adds 50 tokens to every session and 2,976 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
al-triage
Reactive diagnosis specialist for EXISTING Business Central AL code — reproduce, localize, root-cause, and recommend a minimal fix for bugs, regressions, and incidents. Read-only on code: produces a diagnosis and hands the fix to al-developer. The dynamic counterpart to dredd (static audit). Use when you start from a…
planner
Use after the structure is produced to create the tactical implementation plan. Translates each vertical slice in structure.md into precise file-level steps with acceptance test mappings. The plan is a tactical artifact for the implementer — neither the structure nor the plan is human-reviewed (the design passed…
builder
Use proactively for scoped implementation work. Best for task-level coding, tests, and localized refactors that should stay within a documented workitem.
legal-translator
Translates Swiss legal texts between DE, FR, IT, and EN with official terminology from Termdat, Fedlex, and Federal Chancellery standards.
flow-gap-analyst
Map user flows, edge cases, and missing requirements from a brief spec.
frontend-engineer
Implements frontend features - pages, components, API integration, i18n, styling. Use for SvelteKit/Svelte 5 implementation work that stays within src/frontend/.