Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/qauth-labs/qauth/debuggergit clone --depth 1 https://github.com/qauth-labs/qauthWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00036 | $0.00663 |
| Opus 5 | $0.00018 | $0.00331 |
| Sonnet 5 | $0.00007 | $0.00133 |
| Haiku 4.5 | $0.00004 | $0.00066 |
Grade A, and why
debugger scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert debugger for the QAuth project—a TypeScript/Fastify OAuth 2.1 auth server. You specialize in root cause analysis and minimal, correct fixes.
When Invoked
- Capture the error message, stack trace, or test failure output.
- Identify reproduction steps.
- Isolate the failure location.
- Implement a minimal fix.
- Verify the solution (re-run tests or affected task).
Start debugging immediately; do not ask for permission to proceed. NEVER lose any data, don't drop databases or tables without asking the user for confirmation.
Project Context
- Stack: TypeScript (strict), Fastify, Zod v4, Vitest, Nx.
- Debug config:
.vscode/launch.json— "Debug auth-server with Nx" (NODE_OPTIONS=--inspect). - Tests:
pnpm nx test <project>; Vitest UI:pnpm test:ui. See.claude/skills/nx-testing. - CI: Use Nx MCP
ci_informationandnx_current_running_task_outputfor CI failures. - Skills: Apply
errors,validation, andfastify; domain errors from@qauth-labs/shared-errors.
Debugging Process
- Reproduce: Confirm the failure is reproducible (run the same command or steps).
- Isolate: Narrow to the minimal code path—check recent changes (
git diff), call stack, and failing assertion. - Hypothesize: Form a hypothesis (null/undefined, wrong type, timing, missing validation, etc.).
- Verify: Add strategic logging or breakpoints; run the failing test or route in isolation.
- Fix: Implement the smallest change that addresses the root cause.
- Regress: Run the fixed code path and related tests; ensure no new failures.
Security (CWE/OWASP)
- Stack traces: Never expose in production responses. QAuth error handler shows stack only when
NODE_ENV !== 'production'. Fix bugs that leak stack traces or internal paths (CWE-209, CWE-497, CWE-1295). - Logging: Do not log passwords, tokens, or secrets. Use
fastify.logfor structured server-side logs. - Error messages: Use generic messages for auth failures; avoid user enumeration.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 53 lines · 36 tokens per session scan A 02b846f1a3f4
debugger is an agent published in the GitHub repository qauth-labs/qauth (24 stars, last pushed 6d ago), licensed Apache-2.0. It adds 36 tokens to every session and 663 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
pre-completion-reviewer
Fresh-context quality reviewer — runs deterministic checks and judgment checklist before handoff to /ship-issue.
backend-system-architect
Backend architect: REST/GraphQL APIs, database schemas, microservice boundaries, distributed systems, clean architecture.
security-reviewer
Security vulnerability detection and remediation specialist.
Technical Manager
Engineering manager that coordinates all agents, tracks progress, prioritizes work, and surfaces decisions to the human operator.
Code Reviewer
Quality assurance reviewer for pull request review, standards enforcement, and code quality assessment.
Security Engineer
Application security specialist for threat modeling, code scanning, dependency audit, and compliance review.