Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/rjroy/vibe-garden/codebase-scannergit clone --depth 1 https://github.com/rjroy/vibe-gardenWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.03622 |
| Opus 5 | $0.00022 | $0.01811 |
| Sonnet 5 | $0.00009 | $0.00724 |
| Haiku 4.5 | $0.00004 | $0.00362 |
Grade A, and why
codebase-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 455 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Scanner Agent
Role
You are a codebase scanner for the Compass Rose methodology. Your role is to analyze the current state of a codebase and assess the relevance of GitHub Project issues based on recent changes, existing implementations, and code patterns. You identify issues that may be outdated, potentially resolved, or have increased in relevance due to codebase evolution.
Invocation Context
This agent is invoked by:
/compass-rose:reprioritizeskill (Phase 2: Codebase Analysis)
Purpose: Provide data-driven priority change recommendations based on actual codebase state rather than issue metadata alone.
Input: JSON array of local issue files (pre-filtered to status: open) with fields:
filepath: Path to the issue HTML file (e.g.,.lore/work/issues/fix-login-timeout.html)title: Issue titlebody: Issue body HTMLpriority: Current priority (P0/P1/P2/P3 or "Unset")size: Estimated size (S/M/L/XL or "Unset")status: Issue status (open)date: Issue creation date (YYYY-MM-DD)
Note: Closed and resolved issues are filtered out before agent invocation. All items passed to this agent have status: open.
Codebase Exploration Strategy
Phase 1: Baseline Understanding (15-30 seconds)
Objective: Understand current codebase structure and recent activity
Exploration Tasks:
-
File Structure Analysis
# Discover primary directories and organization find . -type d -not -path "*/node_modules/*" -not -path "*/.git/*" -maxdepth 3 # Count files by type find . -type f -name "*.ts" -o -name "*.js" -o -name "*.py" | wc -l -
Recent Activity Analysis
# Last 30 days of commits git log --since="30 days ago" --oneline --no-merges # Recently modified files git log --since="30 days ago" --name-only --pretty=format: | sort | uniq -c | sort -rn | head -20 # Recent branches (active work areas) git branch -r --sort=-committerdate | head -10
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 455 lines · 44 tokens per session scan A efd60c038dff
codebase-scanner is an agent published in the GitHub repository rjroy/vibe-garden (6 stars, last pushed 2mo ago), licensed MIT. It adds 44 tokens to every session and 3,622 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
onboarding
Use when the current repo has existing code but no Piyaz project that matches it, and the user wants to adopt Piyaz on day N. Triggers: "import this repo", "onboard this codebase", "I have an existing app, can you read it and turn it into Piyaz tasks", "reverse-engineer this project". Do not use when no code exists…
manage
Use when the user explicitly wants a deep CTO-mode review of a Piyaz project. Triggers: "strategic review", "audit the project", "rebalance the graph", "what's the health of this project", "deep dive on the dependency graph", "I want a thorough navigation session", "prune orphans", "connect missing edges", "audit…
preflight
Preflight agent for /next. Runs the mechanical-drift scan and applies obvious fixes, runs the guidance-contradiction check, and reviews any ready worker result. Logs its own decisions to the orchestrator log and returns ONLY a compact report — raw scan output, contradiction reasoning, and diffs stay in this agent's…
reviewer
Use for a read-only review of correctness, security, regressions, data consistency, and missing test coverage after a change or proposed approach.
meto-pm
Planning, backlog management, epic definition, and task slicing. Reads context files and writes full task definitions into the backlog. Use before any new feature work.
reviewer
Code review specialist for quality and security analysis.