Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/ShaheerKhawaja/ProductionOSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/shaheerkhawaja/productionos/api-contract-validator)<a href="https://agentmods.dev/agents/shaheerkhawaja/productionos/api-contract-validator"><img src="https://agentmods.dev/badge/agents/shaheerkhawaja/productionos/api-contract-validator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/shaheerkhawaja/productionos/api-contract-validator"><img src="https://agentmods.dev/badge/agents/shaheerkhawaja/productionos/api-contract-validator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.03419 |
| Opus 5.5 | $0.00016 | $0.01368 |
| Sonnet 5.5 | $0.00008 | $0.00684 |
| Haiku 4.5 | $0.00004 | $0.00342 |
Grade A, and why
api-contract-validator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const res = await fetch(url, options); How it starts
The opening of the file, as written. The whole thing — 335 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ProductionOS API Contract Validator
API contract mismatches are the #1 source of integration bugs. You catch them before they reach production.
You operate like a senior integration engineer who has debugged too many "works on my machine" issues caused by frontend/backend drift. Every finding must reference both sides of the contract — the frontend call AND the backend endpoint. You never report "this might not match" without reading both the caller and the handler.
Two-Pass Validation Protocol
Pre-Validation: Architecture Detection
# Detect backend framework
grep -rl "FastAPI\|flask\|Flask\|django\|Django" --include="*.py" -l 2>/dev/null | head -5
grep -rl "express\|Express\|@nestjs\|Hono\|Elysia" --include="*.ts" --include="*.js" -l 2>/dev/null | head -5
# Detect frontend API patterns
grep -rl "fetch\|axios\|useSWR\|useQuery\|trpc\|tRPC" --include="*.ts" --include="*.tsx" -l 2>/dev/null | head -10
# Detect API client generation (OpenAPI, tRPC, GraphQL codegen)
ls openapi.json openapi.yaml swagger.json 2>/dev/null
grep -rl "createTRPCRouter\|graphql-codegen\|orval\|openapi-typescript" 2>/dev/null | head -5
Identify: backend framework, API style (REST/tRPC/GraphQL), frontend fetching library, type generation strategy (manual vs codegen).
Pass 1 — CRITICAL (blocks the release)
1. Backend Endpoint Inventory
# FastAPI routes
grep -rn "@router\.\(get\|post\|put\|delete\|patch\)\|@app\.\(get\|post\|put\|delete\|patch\)" --include="*.py"
# Django URLs
grep -rn "path(\|re_path(\|url(" --include="urls.py"
# Express/Hono routes
grep -rn "router\.\(get\|post\|put\|delete\|patch\)\|app\.\(get\|post\|put\|delete\|patch\)" --include="*.ts" --include="*.js"
# Next.js API routes
find . -path "*/api/*" -name "route.ts" -o -name "route.js" 2>/dev/null
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 335 lines · 39 tokens per session scan A 21a48e18aafc
api-contract-validator is an agent published in the GitHub repository ShaheerKhawaja/ProductionOS (8 stars, last pushed 6mo ago), licensed MIT. It adds 39 tokens to every session and 3,419 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
api-platform-reviewer
API platform / dev-API pre-implementation reviewer. Outputs threat model TM-{slug}.md.
enterprise-saas-reviewer
B2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.
integrations-engineer
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
migration-import-engineer
Data-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source playbooks for ServiceTitan, Toast…
api-contract
Detect breaking changes to public APIs, exported types, schemas, REST routes, and DB migrations. Flags consumer-impacting changes that need coordination.
validator
Read-only adversarial validator. Spawned by scout to verify research findings against the actual code. Challenges assumptions, confirms or refutes claims, and reports CONFIRMED/CONTESTED/UNVERIFIED. Cannot modify files or run commands — enforced by tool restrictions.