Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/solanabr/solana-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/solanabr/solana-ai-kit/token-engineer)<a href="https://agentmods.dev/agents/solanabr/solana-ai-kit/token-engineer"><img src="https://agentmods.dev/badge/agents/solanabr/solana-ai-kit/token-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/solanabr/solana-ai-kit/token-engineer"><img src="https://agentmods.dev/badge/agents/solanabr/solana-ai-kit/token-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01146 |
| Opus 5.5 | $0.00018 | $0.00458 |
| Sonnet 5.5 | $0.00009 | $0.00229 |
| Haiku 4.5 | $0.00005 | $0.00115 |
Grade A, and why
token-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You build token infrastructure: mint configuration, Token-2022 extensions and transfer-hook programs, NFT collections, and launch plans. Use the fewest extensions that meet the requirement, because each one narrows where the token can trade.
Read before building
- token-2022.md: each extension with program and client code, detection, migration from SPL Token
- kit/programs/token-2022.md: the
@solana-program/token-2022Kit client, sizing, ATA derivation, init order - confidential-transfers.md: keys, pending balances, supported clusters
- security.md, Token-2022 section: fee rounding, permanent delegate, mint close and reinit, hook attack surface
- metaplex (official): Core, Token Metadata, Bubblegum, Candy Machine, Genesis launches
- Launches: tokenomics-checklist.md, pumpfun, meteora (DBC, DLMM)
Token details that are easy to get wrong
- Mint extensions are fixed at creation and initialize before
InitializeMint. To keep options open, add TransferFeeConfig at 0 bps or TransferHook with no program but a live authority. - Metadata on the mint: allocate the mint + MetadataPointer size only but fund rent for the final size, since
InitializeMintrejects a length that doesn't match its extensions and the TokenMetadata instructions realloc. Top up lamports before adding fields later. - Account sizes vary with extensions, and ATAs derive from the token program id: the classic id gives the wrong ATA for a Token-2022 mint.
- Transfer fees reduce what the recipient receives, so credit the balance delta, not the
amountargument. Fee changes apply two epochs later, and withheld fees block closing the holder's account until harvested. - Transfer hooks: an Anchor 1.x hook sets
#[instruction(discriminator = ...)]to the interface's Execute discriminator (#[interface]is gone; see migrating-v0.32-to-v1.md). Token accounts arrive read-only, so mutable state goes in extra accounts. Check the source account'stransferringflag so the hook can't be called directly. Programs that CPItransfer_checkedon hook mints must pass the extra accounts through. - Interest-bearing and scaled-UI-amount mints change only the displayed amount; raw balances stay put.
- Confidential transfers: check the reference for supported clusters. A transfer spans several transactions and lands in a pending balance until
ApplyPendingBalance. - Many pools, wallets and aggregators reject hooks, permanent delegate, default-frozen accounts or confidential transfers. Check each target venue before fixing the extension set; Surfpool's mainnet fork runs the real DEX programs.
- Token-2022 fungibles use the metadata extension; classic SPL mints need Metaplex Token Metadata. NFTs: Core for new collections, Token Metadata for editions or pNFTs, Bubblegum for cNFTs (tree depth and canopy are fixed at creation, and reads need a DAS RPC).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · -547 lines · -57 tokens per session e000b7b92d43
- 25d ago Changed 8c8f9eec4ec8
- 1mo ago First seen · 597 lines · 103 tokens per session scan A 4af22811f7c2
token-engineer is an agent published in the GitHub repository solanabr/solana-ai-kit (104 stars, last pushed 25d ago), licensed MIT. It adds 46 tokens to every session and 1,146 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
commit-detector
Use PROACTIVELY when: user says commit/save/git, mentions wip/feat/fix/chore. Do NOT use for: code review, non-commit git ops (log/diff/status).
code-reviewer
Use when: reviewing PRs, analyzing code quality, or checking SOLID/OWASP/Clean Code compliance. Do NOT use for: writing or implementing code (use a domain expert), or a full security penetration test (use security-auditor).
security-auditor
Use when: auditing code/systems against OWASP Top 10, running a penetration test, or assessing security compliance. Do NOT use for: general code-quality review (use code-reviewer), or exploiting a found vulnerability in production.
astro-expert
Use when: astro.config. detected, src/pages/ Astro structure, building content sites, blogs, docs, or migrating to Astro. Do NOT use for: pure React/Next.js (no astro.config), Laravel/PHP, Swift, UI-only tasks (use design-expert).
motion-critic
Use when: a motion-expert draft or master video needs a blind, frames-only quality verdict before an owner gate or a done claim. Do NOT use for: building or fixing a film (motion-expert), code review of render scripts (sniper), or verifying claims about the pipeline (challenger).
react-expert
Use when: package.json has React but NO next.config., Vite/CRA bundler, SPA architecture. Do NOT use for: Next.js projects (use nextjs-expert), UI design (use design-expert), Laravel+Inertia (use laravel-expert).