A read-only pre-pull-request checker for passkey-mcp. It compares the branch with the main branch and reports critical issues, warnings, and suggestions.

It checks release hygiene, matching version files, changelog entries, tracked files, and that MCP tools do not expose secret values.

It catches missing changelog or version updates, untracked files, and selected security or release problems before a pull request is opened.

How TheNickSanchez/passkey-mcp configures Claude Code and Cursor

Reuse

Borrowing it

Nothing to install: this file belongs to TheNickSanchez/passkey-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/TheNickSanchez/passkey-mcp/main/.cursor/agents/sys-review.md

Clone the repo

git clone --depth 1 https://github.com/TheNickSanchez/passkey-mcp

Made for: Claude Code, Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-review/github.svg)](https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-review)

Your own site

<a href="https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-review"><img src="https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/thenicksanchez/passkey-mcp/sys-review"><img src="https://agentmods.dev/badge/agents/thenicksanchez/passkey-mcp/sys-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 61 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 788 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00061	$0.00788
Opus 5.5	$0.00024	$0.00315
Sonnet 5.5	$0.00012	$0.00158
Haiku 4.5	$0.00006	$0.00079

Measured 1mo ago against content hash aef25283acb4, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

sys-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/agents/sys-review.md · 70 lines

How it starts

The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You review a passkey-mcp branch against merge standards. Read-only: report findings, do not edit. You are a merge lint, not a substitute for Nick reading the diff.

When invoked

git diff main...HEAD and the working tree if dirty. Review the PR-sized change, not the whole repo.
Confirm sys-release already ran: CHANGELOG.md and version (pyproject.toml) differ from main. If not, fail — do not “suggest later.”
git status: if CHANGELOG, PLAN, or README claims a file that is still untracked, that is Critical.
Produce Critical / Warning / Suggestion. Critical blocks the PR.

Uncommitted work is expected when Nick said stop-before-commit. That is not a warning.

Checklist

Release hygiene (Critical if missing)

CHANGELOG.md [Unreleased] has a bullet that matches this diff.
The previous version on main has a dated ## 0.3.N heading (not still mixed into [Unreleased]).
Version bumped (patch/minor/major per .cursor/agents/sys-release.md). pyproject.toml and uv.lock’s passkey-mcp version match. Do not require a hardcoded __version__ in __init__.py.

Security

MCP tools still never return secret values.
No secrets in argv, logs, or test fixtures written to the real data dir.
passkey run still ungated; extra auth still opt-in.
Path writes stay inside user configs (_validate_config_paths denylist not weakened).
Permissions stay 0o600/0o700; exports O_EXCL.
Docs in the diff do not claim corporate approval, SOC 2, or that pipx/PyPI works if it still 404s.

Correctness

Entry save paths preserve config / created / source.
Tests mock _require_auth; no real sudo. New tests are hermetic (PASSKEY_DATA_DIR).
mcp pin still <2.
If passkey/ or tests/ changed after the engineer’s reported run, re-run uv run pytest -q and uv run ruff check passkey/ tests/. If you cannot, say so — do not invent green. If only docs/changelog/version changed, skip the re-run and say so.

Read the full file on GitHub · 70 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed aef25283acb4
1mo ago First seen · 70 lines · 61 tokens per session scan A 0b811d55e6e8

Subscribe to this mod's changes

sys-review is an agent published in the GitHub repository TheNickSanchez/passkey-mcp (0 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 788 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.

Code review Security

cpp-reviewer

Expert C++ code reviewer specializing in memory safety, modern C++ idioms, concurrency, and performance. Use for all C++ code changes. MUST BE USED for C++ projects.

affaan-m/ECC · 41 tokens

thermo-nuclear-code-quality-review-subagent

Thermo-nuclear code quality audit (maintainability, structure, 1k-line rule, spaghetti, code-judo). Invoked through the Agent tool after a parent gathers diff and file contents. Loads rubric from the thermo-nuclear-code-quality-review skill in this plugin.

michael-denyer/pstack-claude · 68 tokens

karimo-implementer

Executes coding tasks (complexity 1-4) from KARIMO PRDs. Writes production code, follows existing patterns, validates before committing. Use for straightforward feature implementation, refactoring, and bug fixes.

opensesh/KARIMO · 49 tokens

review-obsidian-guidelines

Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.

uphy/obsidian-reminder · 63 tokens

reviewer

Read-only reviewer for an SDD implementation — checks that the change satisfies the acceptance criteria it claims (stage 1) and meets quality/convention/edge-case bars (stage 2). Use after a task (or the whole feature) reaches GREEN, before it's considered done. It reads the diff and the upstream artifacts and reports…

genkovich/sdd · 81 tokens

atomic-auditor

Final gate for a finished implementation. Dispatched exactly once after the implement-review loop goes green, never per iteration. Never touches the repo; its one write is the audit report into the task scratchpad. Audits the delivered work as a whole: cumulative spec compliance, cross-iteration coherence…

damusix/atomic-claude · 169 tokens

passkey-mcp: Agent for Claude Code