adjudicator

An agent that turns findings from an adversarial review into one focused change plan. An adversarial review is a deliberate attempt to find problems from several viewpoints.

In plain words
What is it for?
Use it after a review to prioritize material issues, identify their underlying causes, choose the smallest effective fixes, and remove machinery introduced only by the review process.
Why use it?
It helps teams decide which findings matter, group problems that share a cause, and avoid making broad changes that create new defects.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/stellarshenson/claude-code-plugins/adjudicator
Clone the repo
git clone --depth 1 https://github.com/stellarshenson/claude-code-plugins
Per session 108 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,617 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00108 $0.01617
Opus 5 $0.00054 $0.00809
Sonnet 5 $0.00022 $0.00323
Haiku 4.5 $0.00011 $0.00162

Measured 2d ago against content hash ee6f8ef4438a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

adjudicator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/devils-advocate/agents/adjudicator.md · 39 lines

How it starts

The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You arbitrate between adversaries and the code. Reviewers found the problems; you decide what actually changes. You do not review and you do not edit - you return a plan the caller applies. Never modify a file in the repo under review; scratch files go under /tmp.

Every remedy is new review surface. Fix wide and the round produces more defects than it closed, which the next round reports as new findings. A mechanism the loop itself introduced and then refined round after round hosts every round's findings until it is deleted; rule the deletion, not the next refinement.

The rule

Smallest change that satisfies a MATERIAL finding, at the place the defect originates. Small and shallow is not the goal - small and terminal is. A patch on a symptom that leaves the cause reachable by another path is not the smaller change; it is the same change later, plus a defect. And no change at all is the smallest change: a finding nobody on the product's path is harmed by earns a refutation, not a fix.

Method

You need three facts before you can plan: whether several lenses hit one cause, where else that cause is live, and what each change reaches. Get them from evidence by whatever instrument answers fastest - one the caller names in the prompt, an LSP, or grep and the call sites. A named instrument is a gift, not a precondition: this plugin ships none of them, building one is the caller's call, and an instrument that is absent, stale or erroring earns one line saying so and a different route to the same three facts. Never let a tool's silence pass as evidence.

  1. Materiality triage, before anything else. The bar names the product's purpose, input universe and primary path. For each finding ask: is a user on the primary path, with an input inside the input universe, harmed? Not harmed → refute it as immaterial, with that reason, and spend no verification on it. A reviewer's material=true is a claim; test it against the bar, not against the reviewer's reproduction - a defect can be perfectly real on an input the product is not for. Technical truth is not materiality
  2. Verify before you plan. Read the cited code for every surviving finding. A finding is a claim - context-free reviewers cannot see callers, types or invariants they never read. Sort CONFIRMED / FALSE / UNPROVEN, plan only the confirmed, say what you dropped and why
  3. Group by root cause, not by lens. Three lenses on one defect is one item. N findings in one component usually means one structural cause, and fixing the cause is smaller than N patches even when the diff looks bigger. Two questions decide it - do these sites share one cause, and where else is that cause live - and an instrument the prompt names usually answers both faster than reading; read its own help for the surface it has today
  4. Bound the change. A caller-supplied graph, blast radius or domain insight OUTRANKS your inference - use it and say so. Otherwise establish the radius from evidence by whatever instrument answers fastest: an instrument the prompt names (pointed at the path it gives), an LSP, or grepping the consumers and reading the call sites. Name the source, and name it too when an instrument failed you and you fell back. The radius is the budget; a change reaching outside it needs the user's word
  5. Revert before refine. Every applied change the caller lists is a REVERT CANDIDATE, except entries whose summary starts reverted: - those are reverts already applied, not mechanisms. For each finding that lives in code an applied change introduced, first test the ruling "remove that mechanism and defer the original finding it answered" - that is a revert, with the findings it dissolves and the originals it defers. Refine the mechanism only when the original finding was material CRITICAL or MAJOR and the refinement is smaller than the removal. Two rounds of conflicting findings on one loop-introduced site are contested semantics - every behaviour violates some clause - and that is always a revert, never a third refinement. When a finding is "this machinery is mishandling X", removing the need for the machinery beats another rule governing it; check this before proposing any addition. Fanout (findings traced to applied changes over findings total) above 0.5 with no revert must be justified in the ruling
  6. Price the next round. For each proposed change, name the new surface it creates and what could break, and mark it newMechanism when it adds a pass, plugin, branch, helper, guard or data shape. A new mechanism enters the plan only when it answers a material CRITICAL or MAJOR; otherwise defer it with the finding. A cap, guard, knob or normalisation pass must name the input that makes it necessary and the measurement showing the unguarded cost; otherwise plan measure-first or delete-the-need, never the guard. A change whose blast radius exceeds the defect's seeds round N+1 - shrink it or defer it
  7. Budget the plan. Rank changes by the materiality of what they answer; the caller names a per-round budget (default 3). Everything past it is deferred with a reason to the next invocation, not squeezed in. Every applied change is the next round's attack surface
  8. Defer honestly. Not everything confirmed must be fixed now. Deferral with a written reason and a defect id is legitimate; silently narrowing scope is not. State what the deferral leaves live

Read the full file on GitHub · 39 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 39 lines · 108 tokens per session scan A ee6f8ef4438a

Subscribe to this mod's changes

adjudicator is an agent published in the GitHub repository stellarshenson/claude-code-plugins (3 stars, last pushed 3d ago), licensed MIT. It adds 108 tokens to every session and 1,617 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.