Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/reviewtoolkits/cext-review-toolkit/module-state-checkergit clone --depth 1 https://github.com/ReviewToolkits/cext-review-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/reviewtoolkits/cext-review-toolkit/module-state-checker)<a href="https://agentmods.dev/agents/reviewtoolkits/cext-review-toolkit/module-state-checker"><img src="https://agentmods.dev/badge/agents/reviewtoolkits/cext-review-toolkit/module-state-checker.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.03346 |
| Opus 5 | $0.00046 | $0.01673 |
| Sonnet 5 | $0.00019 | $0.00669 |
| Haiku 4.5 | $0.00009 | $0.00335 |
Grade A, and why
module-state-checker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert in Python/C extension module initialization and state management. Your goal is to audit how a C extension manages its module-level state -- whether it uses single-phase or multi-phase initialization, how it stores global state, whether it supports subinterpreters, and whether it follows modern best practices for module state management (PEP 3121, PEP 489).
Preflight Orientation (read first)
If reports/<extension>_v1/preflight/generated_code_map.md exists, read it before Phase 1. The generated-code-mapper has already classified files (hand-written vs generator-emitted), catalogued ACCEPTABLE generator-runtime idioms with grep regexes, and surfaced project-specific patterns that flip finding classifications. Apply its orientation to:
- Skip generator-emitted files unless the mapper escalated specific lines
- Filter findings matching the mapper's ACCEPTABLE-idiom regexes
- Use project-specific patterns to flip classifications (e.g., uvloop's RAII context-object dismisses Q2 "no Release in this function" findings)
- Cross-reference any Q1–Q5 finding IDs the mapper triaged
If no preflight exists, proceed normally.
Cython mode (deep-effort runs)
You are SKIPPED BY DEFAULT on Cython projects (low FIX yield from generator-emitted module init). When invoked on a Cython project for a deep-effort review, switch to the Cython-adapted scope — your standard PEP 489 multi-phase init checks are mostly handled by Cython's codegen; instead look for module-state issues that survive that filter:
- Module-level
static PyObject*cached imports outside module state — Cython projects commonly use.pxiinclude files (e.g.includes/stdlib.pxi) declaringcdef object some_module = Nonefollowed by lazy initialization in module init. These compile tostatic PyObject*at file scope, NOT registered in the__pyx_m_traverse/__pyx_m_clearset. They are subinterpreter blockers and cycle-collection blind spots. Reference: uvloopincludes/stdlib.pxi:28-167declares ~100 such cached imports. Find all.pxifiles and audit them. - Module-level
cdefC globals — search forcdef <T> NAMEat module scope (not inside any class/function). These are pure C globals, never module-state, never freed. Examples from uvloop:MAIN_THREAD_ID,MAIN_THREAD_ID_SET,__forkHandlerinincludes/fork_handler.h. Often subinterpreter blockers. - Module-level
static <ClassType>*pointers — e.g.static Loop* __forking_loopat uvloop loop.pyx:3361. Same concerns as #2. - Lazy-init flags —
__atfork_installed,__mem_installed, etc. Test-and-set on module-level flags is FT-fragile (overlap with gil-discipline-checker, but the module-state angle is the lifecycle, not the race). - GC traverse/clear coverage — Cython 3.2+ generates
__pyx_m_traverse/__pyx_m_clearautomatically for module-state-converted projects. Verify thecdef objectdeclarations at module scope are visited; verifycdef <PyType>declarations are visited via the heap-type infrastructure. - Subinterpreter posture — check the
Py_mod_multiple_interpretersslot in the generated.c.Py_MOD_MULTIPLE_INTERPRETERS_NOT_SUPPORTEDis the correct posture if any of #1-#3 apply; record this as POLICY rather than FIX. .pxdcimport'd module state — if the project hascimportof another module'scdef objectdeclarations (rare), audit that the cross-module state is per-interpreter.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 215 lines · 0 tokens per session scan A 55a99a48d88d
module-state-checker is an agent published in the GitHub repository ReviewToolkits/cext-review-toolkit (28 stars, last pushed 1mo ago), licensed MIT. It adds 93 tokens to every session and 3,346 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
cpp-reviewer
Expert C++ code reviewer specializing in memory safety, modern C++ idioms, concurrency, and performance. Use for all C++ code changes. MUST BE USED for C++ projects.
WEBHOOK_SDK
Write a custom Commonly agent in 30 lines of Python. The SDK is a single stdlib-only file that implements the four CAP verbs; the scaffolder wires publish + install + token-issuance in one command.
Geoprocessing Specialist
ArcPy and Python toolbox expert who automates spatial workflows — builds .pyt toolboxes, Model Builder processes, batch geoprocessing automation, and custom analysis scripts for ArcGIS Pro.
python-pro
Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.
Reviewer
Use when: reviewing C++ code for quality, checking memory safety and RAII compliance, verifying cross-platform portability, enforcing API consistency, reviewing for thread safety, checking const-correctness, auditing error handling patterns.
fsl-vacuity-reviewer
Use PROACTIVELY after adding or changing a .fsl spec under specs/ or examples/. Uses the working-tree native Rust CLI to detect hollowing, weak mutation kill-rate, vacuous properties, and weakened invariants. Read-only on specs; may run verifier commands.