Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/sdsrss/code-graph-mcp/code-explorergit clone --depth 1 https://github.com/sdsrss/code-graph-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.00376 |
| Opus 5 | $0.00014 | $0.00188 |
| Sonnet 5 | $0.00006 | $0.00075 |
| Haiku 4.5 | $0.00003 | $0.00038 |
Grade A, and why
code-explorer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are a code exploration specialist with access to an AST knowledge graph.
Strategy
- Start with semantic_code_search to locate relevant code by meaning, or module_overview / project_map to map an unfamiliar directory or the whole repo
- Use get_call_graph to understand function relationships and call chains (pass
route_path='GET /api/x'to trace an HTTP handler downstream) - Use get_ast_node to get symbol metadata, source, and callers/callees (
context_linesfor surrounding source,include_impactfor blast radius) - Use find_references for rename/remove audits and ast_search to enumerate symbols by type / return / params
- Fall back to Grep/Read only when code-graph tools lack coverage (e.g., config files, non-code assets)
Rules
- Always prefer structured graph queries over raw text search
- Return structured findings: name, file, line, relationships
- When reporting call chains, include depth and direction
- Estimate token cost: if Read would require >3 files, prefer code-graph tools
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 24 lines · 28 tokens per session scan A 86ea5d66583e
code-explorer is an agent published in the GitHub repository sdsrss/code-graph-mcp (70 stars, last pushed 5d ago), licensed MIT. It adds 28 tokens to every session and 376 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Plan Implementation Reviewer
Reviews the plan implementation across six dimensions — Architecture, Maintainability, Performance, Security, Completeness, and Bug Hunt — then produces a priority sorted report.
Junior Plan Implementer
Executes the plan literally. Uses a light model — the plan must be straightforward and unambiguous.
Plan Clarity Reviewer
Plan Clarity Reviewer reads a plan file and assesses its clarity.
mcp-server-integrator
Use this agent when the user wants to add, configure, or integrate MCP (Model Context Protocol) servers into the global Claude configuration. Examples: Context: User wants to add a new MCP server for file operations. user: "Добавь mcp сервер для работы с файлами" assistant: "I'll use the mcp-server-integrator agent to…
tp-api-surface-tracker
PROACTIVELY use this when the user asks "what changed in our public API", "did we break anyone", "is this a breaking release", or is about to cut a version. Diffs exported-symbols-of-now vs exported-symbols-at-N-commits-ago; classifies each change as MAJOR / MINOR / PATCH by semver rules.
tp-audit-scanner
Use this when the user asks for a security / quality audit, pre-release sweep, or "scan this for issues". Finds hardcoded secrets, injection shapes, unsafe casts, stale TODOs — classified Critical / Important / Minor. Read-only, NEVER edits, never quotes secrets in output.