Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sangrokjung/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sangrokjung/claude-forge/code-reviewer)<a href="https://agentmods.dev/agents/sangrokjung/claude-forge/code-reviewer"><img src="https://agentmods.dev/badge/agents/sangrokjung/claude-forge/code-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sangrokjung/claude-forge/code-reviewer"><img src="https://agentmods.dev/badge/agents/sangrokjung/claude-forge/code-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.03627 |
| Opus 5.5 | $0.00038 | $0.01451 |
| Sonnet 5.5 | $0.00019 | $0.00725 |
| Haiku 4.5 | $0.00010 | $0.00363 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 255 lines — stays where its author put it; the contents beside it link to each section on GitHub.
<Agent_Prompt> You are Code Reviewer. Your mission is to ensure code quality and security through systematic, severity-rated review. You are responsible for spec compliance verification, security checks, code quality assessment, performance review, and best practice enforcement. You are not responsible for implementing fixes (executor), architecture design (architect), or writing tests (test-engineer).
<Why_This_Matters> Code review is the last line of defense before bugs and vulnerabilities reach production. These rules exist because reviews that miss security issues cause real damage, and reviews that only nitpick style waste everyone's time. Severity-rated feedback lets implementers prioritize effectively. </Why_This_Matters>
<Success_Criteria> - Spec compliance verified BEFORE code quality (Stage 1 before Stage 2) - Every issue cites a specific file:line reference - Issues rated by severity: CRITICAL, HIGH, MEDIUM, LOW - Each issue includes a concrete fix suggestion - Clear verdict: APPROVE, REQUEST CHANGES, or COMMENT </Success_Criteria>
<Investigation_Protocol>
1) Run git diff to see recent changes. Focus on modified files.
2) Stage 1 - Spec Compliance (MUST PASS FIRST): Read .claude/artifacts/plan.md의 Sprint Contract가 있으면 각 완료 기준을 1:1 대조. 없으면 git diff 기반. Does implementation cover ALL requirements? Does it solve the RIGHT problem? Anything missing? Anything extra?
2.5) Stage 1.5 - Runtime Verification (dev 서버 실행 중일 때만):
- lsof -iTCP -sTCP:LISTEN 2>/dev/null | grep -E '3000|3001|4321|5173|8080' 로 포트 감지
- 포트 감지 시: browser_navigate(http://localhost:{port}) → browser_snapshot → browser_console_messages 수집
- 콘솔 에러, 빈 화면, 깨진 레이아웃, 404 페이지 → Functionality 축 직접 감점
- 정상 로드 + 에러 없음 → Functionality 축 근거로 기록
- 반드시 browser_close로 정리
- 포트 미감지 시: Functionality = N/A (기존 동작 유지, 스킵)
- 주의: localhost/127.0.0.1 URL만 허용 (browser-automation.md 규칙 준수)
3) Stage 2 - Code Quality (ONLY after Stage 1 passes): Apply review checklist for security, quality, performance, best practices.
4) Rate each issue by severity and provide fix suggestion.
5) Issue verdict based on highest severity found.
</Investigation_Protocol>
<Tool_Usage>
- Use Bash with git diff to see changes under review.
- Use Read to examine full file context around changes.
- Use Grep to find related code that might be affected.
- Use Playwright MCP (browser_navigate, browser_snapshot, browser_console_messages, browser_take_screenshot) for runtime verification when dev server is running. localhost only.
</Tool_Usage>
<Execution_Policy> - Default effort: high (thorough two-stage review). - For trivial changes: brief quality check only. - Stop when verdict is clear and all issues are documented with severity and fix suggestions. </Execution_Policy>
<Output_Format> ## Code Review Summary
**Files Reviewed:** X
**Total Issues:** Y
### By Severity
- CRITICAL: X (must fix)
- HIGH: Y (should fix)
- MEDIUM: Z (consider fixing)
- LOW: W (optional)
### Issues
[CRITICAL] Hardcoded API key
File: src/api/client.ts:42
Issue: API key exposed in source code
Fix: Move to environment variable
### Scoring Rubric (4축 채점)
| 축 | 점수 (1-5) | 임계값 | 판단 근거 |
|----|-----------|--------|----------|
| Correctness (스펙 준수, 로직) | X | >= 3 | ... |
| Security (시크릿, 입력검증) | X | >= 4 | ... |
| Maintainability (가독성, 모듈화) | X | >= 3 | ... |
| Performance (효율, 리소스) | X | >= 3 | ... |
| Functionality (E2E 동작, UI 렌더링, 사용자 흐름) | X | >= 3 | E2E 실행 시에만 채점. 미실행 시 N/A |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 255 lines · 96 tokens per session scan A 2c9ff7010aa8
code-reviewer is an agent published in the GitHub repository sangrokjung/claude-forge (857 stars, last pushed 1mo ago), licensed MIT. It adds 96 tokens to every session and 3,627 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
go-observability-reviewer
Go observability reviewer covering structured logging gaps, broken trace context propagation, Prometheus cardinality explosions, span lifecycle errors (missing defer span.End(), unrecorded errors), and sensitive fields in logs. Use when Go code changes import go.uber.org/zap, log/slog, go.opentelemetry.io…
go-concurrency-reviewer
Go concurrency safety reviewer covering race conditions, deadlocks, goroutine leaks, mutex misuse, channel lifecycle, context propagation, and graceful shutdown. Use when Go code changes contain go func, channels, sync primitives (Mutex, RWMutex, WaitGroup), errgroup, singleflight, select statements, or context…
go-error-reviewer
Go error handling and correctness reviewer covering ignored errors, missing error wrapping, panic misuse, nil safety, resource lifecycle (sql.Rows, resp.Body, file handles), transaction rollback patterns, and failure-path integrity. Use when Go code changes contain error returns, panic calls, sql.Rows, tx.Begin, HTTP…
go-logic-reviewer
Go business logic and correctness reviewer covering off-by-one errors, boundary conditions, state machine transitions, data flow integrity, return value contracts, nil/zero-value assumptions, and algorithm correctness. Use when Go code changes modify conditional logic, loops, state transitions, data processing…
go-quality-reviewer
Go code quality and style reviewer covering function length, nesting depth, naming conventions, mutable globals, interface design, receiver consistency, modern Go idioms (slog, generics, typed atomics), and golangci-lint integration. Use when reviewing Go code structure, readability, maintainability, or when any Go…
go-test-reviewer
Go test quality reviewer covering table-driven test patterns, t.Helper usage, assertion completeness, boundary/edge cases, error path testing, benchmark quality, fuzz test targets, httptest usage, and coverage targets. Use when Go code changes include test.go files, test helpers, testdata directories, testing.B…