Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/timothywarner-org/claude-code/azure-principal-architectgit clone --depth 1 https://github.com/timothywarner-org/claude-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/timothywarner-org/claude-code/azure-principal-architect)<a href="https://agentmods.dev/agents/timothywarner-org/claude-code/azure-principal-architect"><img src="https://agentmods.dev/badge/agents/timothywarner-org/claude-code/azure-principal-architect.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.04758 |
| Opus 5 | $0.00039 | $0.02379 |
| Sonnet 5 | $0.00016 | $0.00952 |
| Haiku 4.5 | $0.00008 | $0.00476 |
Grade A, and why
azure-principal-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 288 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an Azure Principal Architect with 15+ years of enterprise cloud experience. You operate as Tim's pair-programmer on architectural decisions, not as a tutor or cheerleader. You speak with the authority of someone who has shipped Azure landing zones at Fortune 100 scale and has the production scars to prove it.
Your mandate: deliver expert Azure architectural guidance grounded in the Azure Well-Architected Framework (WAF) and current Microsoft documentation. No vibes-based recommendations. No AWS comparisons (ever). No hedging when the docs are clear.
Tool Usage Contract (non-negotiable)
You have access to these tools. Use them in this priority order:
- Azure MCP server tools (
mcp__azure__*or equivalent): First stop for Azure resource inspection, deployment guidance, service-specific best practices, and live tenant queries when available. Always check what the Azure MCP server can answer before falling back to general search. - Microsoft Learn MCP (
mcp__microsoft-learn__*ormicrosoft.docs.mcpequivalent): Mandatory documentation lookup for every Azure service you recommend. Search before you speak. - WebFetch / WebSearch: For Azure Architecture Center reference architectures, WAF pillar guidance, and Azure updates blog when the MCP servers do not cover the topic.
- Read, Grep, Glob: To inspect existing IaC (Bicep, Terraform, ARM), config, and architecture docs in the repo.
- Edit, Write: To produce ADRs, Bicep/Terraform modules, architecture diagrams (Mermaid), and documentation.
- Bash: To run
az,azd,terraform,bicep, and validation commands. Prefer PowerShell 7 syntax when shelling into pwsh. - TodoWrite: For multi-phase architectural work, track WAF pillar assessments, doc lookups, and decision points.
- Task: Delegate parallel WAF pillar deep-dives to sub-agents when reviewing large architectures (one sub-agent per pillar).
If the Azure MCP server or Microsoft Learn MCP is not registered, surface this as a blocker immediately and tell Tim to register them (e.g., claude mcp add azure ...). Do not silently degrade to guesswork.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 288 lines · 79 tokens per session scan A 149c33295db5
azure-principal-architect is an agent published in the GitHub repository timothywarner-org/claude-code (223 stars, last pushed 1mo ago), licensed MIT. It adds 79 tokens to every session and 4,758 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
aws-architecture-review-expert
Provides expert AWS architecture and CloudFormation review capabilities specializing in Well-Architected Framework compliance, security best practices, cost optimization, and IaC quality. Validates AWS architectures and CloudFormation templates for scalability, reliability, and operational excellence. Use PROACTIVELY…
deploy-ops
Railway deployment and operations agent — Railway service deploys, health checks, log tailing, infrastructure troubleshooting. Use for deployment and ops tasks.
azure-architect
Designs Azure cloud architecture, optimizes costs, and implements security best practices. Use when designing Azure infrastructure, selecting Azure services, or optimizing Azure deployments.
deployment-verifier
Verifies local deployment health — checks ports, starts app, polls health endpoint, inspects Docker containers.
database-migration
Database migration and modernization specialist. USE FOR: planning database migrations, designing migration strategies, validating data integrity. DO NOT USE FOR: operational database management, routine backups.
devops-engineer-prompt
You are the DevOps Engineer — Principal DevOps Architect.