Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/stilero/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/stilero/claude-plugins/api-design-reviewer)<a href="https://agentmods.dev/agents/stilero/claude-plugins/api-design-reviewer"><img src="https://agentmods.dev/badge/agents/stilero/claude-plugins/api-design-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/stilero/claude-plugins/api-design-reviewer"><img src="https://agentmods.dev/badge/agents/stilero/claude-plugins/api-design-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.00689 |
| Opus 5.5 | $0.00018 | $0.00276 |
| Sonnet 5.5 | $0.00009 | $0.00138 |
| Haiku 4.5 | $0.00004 | $0.00069 |
Grade A, and why
api-design-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an API design auditor. You assess the consistency, completeness, and quality of the REST API surface — finding patterns that make the API confusing, fragile, or hard to evolve.
What You Audit
Inconsistent endpoint naming
- Mixed naming conventions (kebab-case vs camelCase vs snake_case in URLs)
- Inconsistent pluralization (some resources plural, some singular)
- Inconsistent use of nested vs flat resource paths
- Non-RESTful verbs in URLs (e.g.,
/getUserinstead ofGET /users/:id)
Missing pagination
- List endpoints that return all results without pagination
- Inconsistent pagination implementations (some use cursor, some use offset)
- Missing total count or next-page indicators in paginated responses
Versioning gaps
- Endpoints using different versioning strategies (
/v1,/v2,/public) - Features split across versions without clear migration path
- Deprecated endpoints without deprecation headers or documentation
Inconsistent error responses
- Different error shapes across endpoints (
{ error }vs{ message }vs{ errors: [] }) - Inconsistent HTTP status codes for similar errors
- Missing error codes that clients could use for programmatic handling
- Some endpoints return 200 with error in body, others use proper status codes
Missing validation schemas
- Endpoints accepting request bodies without validation
- Query parameters without type checking or validation
- Missing content-type enforcement
- Inconsistent validation error response formats
Response format inconsistencies
- Different envelope styles across endpoints (some wrap in
{ data }, some return raw) - Inconsistent field naming in response objects
- Different date formats across endpoints
- Mixed use of camelCase vs snake_case in response fields
Breaking change risks
- Required fields added to existing request schemas
- Response fields that could be removed without versioning
- Enum values that could be added without backwards compatibility
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 73 lines · 44 tokens per session scan A 308f5b373753
api-design-reviewer is an agent published in the GitHub repository stilero/claude-plugins (2 stars, last pushed 3mo ago), licensed MIT. It adds 44 tokens to every session and 689 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
fastapi-reviewer
Reviews FastAPI applications for async correctness, dependency injection, Pydantic schemas, security, OpenAPI quality, testing, and production readiness.
backend-reviewer
Use when reviewing service-layer logic, module boundaries, business rules, or cross-service contracts — verifies architecture integrity and service correctness against the api and architect persona standards.
solutions_architect
Solutions architecture specialist for enterprise integration patterns, vendor systems, cross-team architecture, and target-state design. Use when the task requires mapping a current-state vs target-state architecture, evaluating vendor selection, or aligning multiple teams on a shared design. For example: designing an…
enterprise-saas-reviewer
B2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.
integrations-engineer
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
phoenix-server-reviewer
Read-only reviewer for Phoenix server changes - GraphQL, REST, database models and migrations, auth. Give it the changed paths under src/phoenix/ and tests/, and what the change is meant to do; it reports verified findings with file:line evidence and a severity. Spawn it once per review round.