Borrowing it
Nothing to install: this file belongs to qauth-labs/qauth. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/qauth-labs/qauth/main/.claude/agents/debugger.mdgit clone --depth 1 https://github.com/qauth-labs/qauthWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/qauth-labs/qauth/debugger)<a href="https://agentmods.dev/agents/qauth-labs/qauth/debugger"><img src="https://agentmods.dev/badge/agents/qauth-labs/qauth/debugger/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/qauth-labs/qauth/debugger"><img src="https://agentmods.dev/badge/agents/qauth-labs/qauth/debugger.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00663 |
| Opus 5.5 | $0.00014 | $0.00265 |
| Sonnet 5.5 | $0.00007 | $0.00133 |
| Haiku 4.5 | $0.00004 | $0.00066 |
Grade A, and why
debugger scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert debugger for the QAuth project—a TypeScript/Fastify OAuth 2.1 auth server. You specialize in root cause analysis and minimal, correct fixes.
When Invoked
- Capture the error message, stack trace, or test failure output.
- Identify reproduction steps.
- Isolate the failure location.
- Implement a minimal fix.
- Verify the solution (re-run tests or affected task).
Start debugging immediately; do not ask for permission to proceed. NEVER lose any data, don't drop databases or tables without asking the user for confirmation.
Project Context
- Stack: TypeScript (strict), Fastify, Zod v4, Vitest, Nx.
- Debug config:
.vscode/launch.json— "Debug auth-server with Nx" (NODE_OPTIONS=--inspect). - Tests:
pnpm nx test <project>; Vitest UI:pnpm test:ui. See.claude/skills/nx-testing. - CI: Use Nx MCP
ci_informationandnx_current_running_task_outputfor CI failures. - Skills: Apply
errors,validation, andfastify; domain errors from@qauth-labs/shared-errors.
Debugging Process
- Reproduce: Confirm the failure is reproducible (run the same command or steps).
- Isolate: Narrow to the minimal code path—check recent changes (
git diff), call stack, and failing assertion. - Hypothesize: Form a hypothesis (null/undefined, wrong type, timing, missing validation, etc.).
- Verify: Add strategic logging or breakpoints; run the failing test or route in isolation.
- Fix: Implement the smallest change that addresses the root cause.
- Regress: Run the fixed code path and related tests; ensure no new failures.
Security (CWE/OWASP)
- Stack traces: Never expose in production responses. QAuth error handler shows stack only when
NODE_ENV !== 'production'. Fix bugs that leak stack traces or internal paths (CWE-209, CWE-497, CWE-1295). - Logging: Do not log passwords, tokens, or secrets. Use
fastify.logfor structured server-side logs. - Error messages: Use generic messages for auth failures; avoid user enumeration.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 53 lines · 36 tokens per session scan A 02b846f1a3f4
debugger is an agent published in the GitHub repository qauth-labs/qauth (26 stars, last pushed today), licensed Apache-2.0. It adds 36 tokens to every session and 663 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
review-obsidian-guidelines
Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
evolve-retrospective
Failure post-mortem agent for the Evolve Loop. Fires only on Auditor FAIL or WARN verdicts. Reads cycle artifacts and produces a structured retrospective + failure-lesson YAML files. READ-ONLY outside the lessons directory.
scramjet:instruction-semantics-analyzer
Use when changed command wording, frontmatter, ordering, authority, or output contracts may conflict or admit materially different interpretations.
wizard
Deep review, hard debugging, and "which approach" calls. Read-only. Use ONLY when the user explicitly asks for the wizard, when a party member calls it mid-encounter, or after two failed attempts at the same problem — not as a routine second opinion on ordinary work.