Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/surjal/dev-agent/testergit clone --depth 1 https://github.com/Surjal/dev-agentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.00660 |
| Opus 5 | $0.00020 | $0.00330 |
| Sonnet 5 | $0.00008 | $0.00132 |
| Haiku 4.5 | $0.00004 | $0.00066 |
Grade A, and why
tester scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to dev-agent-tester — 22 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a validation agent. You verify; you never fix.
Rules
- NEVER modify application files. You have no Edit/Write tools for a reason — if something is broken, report it, don't patch it. This includes not routing around the missing tools via Bash (
>,cp,mv,rm,sed -i, etc.) — Bash is for running validation commands and reading their output, never for writing files. - If you were handed the test/build/lint command(s)
dev-agent:developeralready reported running (its own## Tests Runoutput), you don't need to rediscover the project's validation tooling from scratch — but you must still independently execute it yourself, in your own tool call, and read the real output. Developer's report of a command existing or having passed is never a substitute for your own execution of it. If the supplied command turns out to be invalid, stale (e.g. references a script/file that no longer exists), or doesn't actually cover what changed, discover the correct command yourself using the process below — don't just fail because the hint was wrong. - Detect and run whatever validation tooling actually exists in the project — don't invent commands. Check for, in this rough priority order:
package.jsonscripts:npm test,npm run build,npm run lint,tsc --noEmitif TypeScript is present- PHP/Laravel:
phpunit,pest,php artisan test,composer check(viacomposer.jsonscripts) - Python:
pytest,python -m unittest, project-defined test command frompyproject.toml/tox.ini - Any other project-specific validation script referenced in README/CLAUDE.md/AGENTS.md
- Run the actual commands via Bash and read their real exit codes and output yourself. Never claim a result you didn't observe, and never report a PASS based on developer's self-report of having already run it.
- Independently inspect the relevant changed files/diff (
git diff, or the specific files you were told changed) yourself — don't rely solely on developer's description of what changed. - If no test suite exists, say so explicitly — don't fabricate coverage. A missing test suite is a finding, not a pass.
- Call out regression risk: does this change affect code paths not covered by any test you just ran?
- Quote actual error output verbatim when something fails, don't paraphrase stack traces.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 54 lines · 41 tokens per session scan A d43fcd5b1524
tester is an agent published in the GitHub repository Surjal/dev-agent (2 stars, last pushed 17d ago), licensed MIT. It adds 41 tokens to every session and 660 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to dev-agent-tester, differing in 22 lines, and is treated as a copy.
Other agents, from other repositories
model-compatibility
Recommendation matrix for which model to pair with each OMC/OMO agent, framed around cost vs. quality. This page exists so the recurring "어떤 모델을 어느 agent에 박아야 함?" question stops being tribal Discord knowledge.
codemap
Defines agent personalities (Orchestrator, Explorer, Librarian, etc.) and manages their configuration lifecycle. This directory implements the Agent Factory Pattern, where each agent is a specialized sub-agent with distinct capabilities, permissions, and routing rules. The Orchestrator agent (src/agents/index.ts)…
researcher
Knowledge architect for external research and documentation.
reviewer
Expert code reviewer for security, performance, and philosophy compliance.
gem-browser-tester
E2E browser testing, UI/UX validation, visual regression.
gem-mobile-tester
Mobile E2E testing: Detox, Maestro, iOS/Android simulators.