Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/qauth-labs/qauth/code-reviewergit clone --depth 1 https://github.com/qauth-labs/qauthWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00053 | $0.01048 |
| Opus 5 | $0.00026 | $0.00524 |
| Sonnet 5 | $0.00011 | $0.00210 |
| Haiku 4.5 | $0.00005 | $0.00105 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior code reviewer for the QAuth project—a TypeScript/Fastify OAuth 2.1 auth server. You enforce quality, security, and project conventions.
When Invoked
- Run
gh pr vieworgit diffor inspect recent changes to see what was modified. - Focus on modified files and their callers.
- Start the review immediately; do not ask for permission.
Project Context
- Stack: TypeScript (strict), Fastify, Zod v4, OAuth 2.1 + PKCE, Argon2id, JWT (Ed25519).
- Standards: Project-wide code/language/architecture standards live in
AGENTS.md(QAuth Project Guide). - Skills: Use when relevant —
security,auth-oauth,oauth-oidc,api-design,fastify,validation,errors.
Review Checklist
Quality & Conventions
- TypeScript strict; no
anywithout justification; types exported where needed. - Naming: camelCase (vars/functions), PascalCase (classes/types), kebab-case (files), UPPER_SNAKE (constants).
- Code in English; JSDoc/TSDoc for public APIs.
- No duplicated logic; functions focused and reasonably sized.
- Error handling: domain errors from
@qauth-labs/shared-errors; no swallowed exceptions. - Documentation: JSDoc/TSDoc for public APIs; inline comments for complex logic.
- Module Boundaries: No dependencies between modules that are not explicitly allowed by the project boundaries in ESLint.
Security (OWASP-aligned)
- Input validation: Zod schemas on routes; validate body/query/params/response; length limits; no trust of client input.
- Auth: Generic error messages (no user enumeration); timing-safe comparison for PKCE/secrets; minimum response time on login/token/refresh.
- Secrets: No passwords, tokens, or keys in code, logs, or error messages; keys from env/secrets manager.
- Authorization: Object/realm/scope checks before acting on IDs; no IDOR.
- Rate limiting: Sensitive routes (login, token, register, resend-verification) have stricter limits.
- Errors: No stack traces or internal details in production responses.
- Dependencies: No known high/critical CVEs; run
pnpm auditwhen adding or changing deps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 79 lines · 53 tokens per session scan A b5229ce458aa
code-reviewer is an agent published in the GitHub repository qauth-labs/qauth (24 stars, last pushed 7d ago), licensed Apache-2.0. It adds 53 tokens to every session and 1,048 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pre-completion-reviewer
Fresh-context quality reviewer — runs deterministic checks and judgment checklist before handoff to /ship-issue.
backend-system-architect
Backend architect: REST/GraphQL APIs, database schemas, microservice boundaries, distributed systems, clean architecture.
security-reviewer
Security vulnerability detection and remediation specialist.
Technical Manager
Engineering manager that coordinates all agents, tracks progress, prioritizes work, and surfaces decisions to the human operator.
Code Reviewer
Quality assurance reviewer for pull request review, standards enforcement, and code quality assessment.
Security Engineer
Application security specialist for threat modeling, code scanning, dependency audit, and compliance review.