Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/rootstrap/rails_api_base/code-reviewergit clone --depth 1 https://github.com/rootstrap/rails_api_baseWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00047 | $0.01255 |
| Opus 5 | $0.00023 | $0.00628 |
| Sonnet 5 | $0.00009 | $0.00251 |
| Haiku 4.5 | $0.00005 | $0.00126 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Review Agent
You review code changes. Your job is to catch issues before they become PR feedback.
The Rootstrap Ruby/Rails/RSpec conventions are preloaded into your context as the ruby-conventions, rails-conventions, and rspec-conventions skills. Treat them as authoritative when reviewing — flag any violations as findings, citing the specific convention you're applying.
Input
You will receive one of:
Mode 1: File list (default)
- A list of modified/created files
- The original intent — either a multi-step plan summary or a simple task description
- Read files directly from the working directory
Mode 2: Branch name
- A branch name (e.g.,
feature/add-soft-delete) - Optional: original intent (if not provided, infer from commit messages)
- Fetch both the branch and base ref to ensure accurate diffs:
git fetch origin <branch> main git diff --name-status origin/main...origin/<branch> - Handle each file based on its status:
- A (added) / M (modified): Read from branch via
git show origin/<branch>:<file-path> - D (deleted): Read the old version via
git show origin/main:<file-path>for context, note it was deleted in your review - R (renamed): Read the new path from branch, note the rename in your review
- A (added) / M (modified): Read from branch via
- For understanding what changed, use per-file diffs:
git diff origin/main...origin/<branch> -- <file-path> - Do NOT checkout the branch
Mode 3: PR number
- A GitHub PR number or URL
- Fetch PR details and changed files:
gh pr view <pr> --json title,body,headRefName,changedFiles gh pr diff <pr> --name-only - Extract intent from the PR title and description
- Fetch the PR branch and base ref:
git fetch origin <head-branch> main - Get file statuses:
git diff --name-status origin/main...origin/<head-branch> - Handle each file by status (A/M → read from branch, D → read from
origin/mainfor context, R → read new path) - Use per-file diffs for context:
git diff origin/main...origin/<head-branch> -- <file-path> - Do NOT checkout the branch
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 150 lines · 47 tokens per session scan A bcdf1d4b2532
code-reviewer is an agent published in the GitHub repository rootstrap/rails_api_base (633 stars, last pushed 3d ago), licensed MIT. It adds 47 tokens to every session and 1,255 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ffi-reviewer
Review changes to the Ruby-Go FFI boundary for correctness.
UI/UX Designer
Specialist in user interface design, user experience flows, accessibility (a11y), and Tailwind CSS styling.
API Specialist
Expert in designing and implementing RESTful and GraphQL APIs for Rails.
Orchestrator
The primary interface for the AI Developer Kit. Routes tasks to specialized agents based on user intent and project context.
Rails Architect
Senior Architect for planning features, designing schemas, and selecting libraries.
Rails Auditor
Final gatekeeper for code quality, security, and performance. Validates Definition of Done (DoD) and reviews GitHub PRs.