module-state-checker

module-state-checker is an agent for Claude Code from ReviewToolkits/cext-review-toolkit. It costs 93 tokens per session (3,346 once invoked), scanned A, original, MIT.

A review agent for how Python C extensions create modules and store their state. It checks older single-phase initialization and newer multi-phase initialization, including support for subinterpreters.

In plain words
What is it for?
Use it to audit module initialization, module-level state, global Python objects, and migrations toward the practices described by PEP 3121 and PEP 489.
Why use it?
It helps find unsafe global state and module-initialization patterns that can cause problems when multiple Python interpreters run in one process.

Agent for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: model in frontmatter.

Part of the cext-review-toolkit plugin — 1 skill, 4 commands, 14 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/reviewtoolkits/cext-review-toolkit/module-state-checker
Clone the repo
git clone --depth 1 https://github.com/ReviewToolkits/cext-review-toolkit

Made for: Claude Code.

Or install cext-review-toolkit, the plugin that ships this one along with the rest of its 1 skill, 4 commands, 14 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for module-state-checker

README.md
[![agentmods](https://agentmods.dev/badge/agents/reviewtoolkits/cext-review-toolkit/module-state-checker.svg)](https://agentmods.dev/agents/reviewtoolkits/cext-review-toolkit/module-state-checker)
Your own site
<a href="https://agentmods.dev/agents/reviewtoolkits/cext-review-toolkit/module-state-checker"><img src="https://agentmods.dev/badge/agents/reviewtoolkits/cext-review-toolkit/module-state-checker.svg" alt="Measured on agentmods" height="20"></a>
Per session 93 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,346 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00093 $0.03346
Opus 5 $0.00046 $0.01673
Sonnet 5 $0.00019 $0.00669
Haiku 4.5 $0.00009 $0.00335

Measured 6d ago against content hash 55a99a48d88d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

module-state-checker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/cext-review-toolkit/agents/module-state-checker.md · 215 lines

How it starts

The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are an expert in Python/C extension module initialization and state management. Your goal is to audit how a C extension manages its module-level state -- whether it uses single-phase or multi-phase initialization, how it stores global state, whether it supports subinterpreters, and whether it follows modern best practices for module state management (PEP 3121, PEP 489).

Preflight Orientation (read first)

If reports/<extension>_v1/preflight/generated_code_map.md exists, read it before Phase 1. The generated-code-mapper has already classified files (hand-written vs generator-emitted), catalogued ACCEPTABLE generator-runtime idioms with grep regexes, and surfaced project-specific patterns that flip finding classifications. Apply its orientation to:

  • Skip generator-emitted files unless the mapper escalated specific lines
  • Filter findings matching the mapper's ACCEPTABLE-idiom regexes
  • Use project-specific patterns to flip classifications (e.g., uvloop's RAII context-object dismisses Q2 "no Release in this function" findings)
  • Cross-reference any Q1–Q5 finding IDs the mapper triaged

If no preflight exists, proceed normally.

Cython mode (deep-effort runs)

You are SKIPPED BY DEFAULT on Cython projects (low FIX yield from generator-emitted module init). When invoked on a Cython project for a deep-effort review, switch to the Cython-adapted scope — your standard PEP 489 multi-phase init checks are mostly handled by Cython's codegen; instead look for module-state issues that survive that filter:

  1. Module-level static PyObject* cached imports outside module state — Cython projects commonly use .pxi include files (e.g. includes/stdlib.pxi) declaring cdef object some_module = None followed by lazy initialization in module init. These compile to static PyObject* at file scope, NOT registered in the __pyx_m_traverse / __pyx_m_clear set. They are subinterpreter blockers and cycle-collection blind spots. Reference: uvloop includes/stdlib.pxi:28-167 declares ~100 such cached imports. Find all .pxi files and audit them.
  2. Module-level cdef C globals — search for cdef <T> NAME at module scope (not inside any class/function). These are pure C globals, never module-state, never freed. Examples from uvloop: MAIN_THREAD_ID, MAIN_THREAD_ID_SET, __forkHandler in includes/fork_handler.h. Often subinterpreter blockers.
  3. Module-level static <ClassType>* pointers — e.g. static Loop* __forking_loop at uvloop loop.pyx:3361. Same concerns as #2.
  4. Lazy-init flags__atfork_installed, __mem_installed, etc. Test-and-set on module-level flags is FT-fragile (overlap with gil-discipline-checker, but the module-state angle is the lifecycle, not the race).
  5. GC traverse/clear coverage — Cython 3.2+ generates __pyx_m_traverse/__pyx_m_clear automatically for module-state-converted projects. Verify the cdef object declarations at module scope are visited; verify cdef <PyType> declarations are visited via the heap-type infrastructure.
  6. Subinterpreter posture — check the Py_mod_multiple_interpreters slot in the generated .c. Py_MOD_MULTIPLE_INTERPRETERS_NOT_SUPPORTED is the correct posture if any of #1-#3 apply; record this as POLICY rather than FIX.
  7. .pxd cimport'd module state — if the project has cimport of another module's cdef object declarations (rare), audit that the cross-module state is per-interpreter.

Read the full file on GitHub · 215 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 215 lines · 0 tokens per session scan A 55a99a48d88d

Subscribe to this mod's changes

module-state-checker is an agent published in the GitHub repository ReviewToolkits/cext-review-toolkit (28 stars, last pushed 1mo ago), licensed MIT. It adds 93 tokens to every session and 3,346 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

cpp-reviewer

Expert C++ code reviewer specializing in memory safety, modern C++ idioms, concurrency, and performance. Use for all C++ code changes. MUST BE USED for C++ projects.

affaan-m/ECC · 41 tokens

WEBHOOK_SDK

Write a custom Commonly agent in 30 lines of Python. The SDK is a single stdlib-only file that implements the four CAP verbs; the scaffolder wires publish + install + token-issuance in one command.

Team-Commonly/commonly · 0 tokens

Geoprocessing Specialist

ArcPy and Python toolbox expert who automates spatial workflows — builds .pyt toolboxes, Model Builder processes, batch geoprocessing automation, and custom analysis scripts for ArcGIS Pro.

SHAdd0WTAka/Zen-Ai-Pentest · 45 tokens

python-pro

Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.

echoVic/blade-code · 51 tokens

Reviewer

Use when: reviewing C++ code for quality, checking memory safety and RAII compliance, verifying cross-platform portability, enforcing API consistency, reviewing for thread safety, checking const-correctness, auditing error handling patterns.

microsoft/foundry-local · 42 tokens

fsl-vacuity-reviewer

Use PROACTIVELY after adding or changing a .fsl spec under specs/ or examples/. Uses the working-tree native Rust CLI to detect hollowing, weak mutation kill-rate, vacuous properties, and weakened invariants. Read-only on specs; may run verifier commands.

ymm-oss/fsl · 64 tokens