Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/trtmn/agent-plugins/side-quest-setupgit clone --depth 1 https://github.com/trtmn/agent-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00132 | $0.03875 |
| Opus 5 | $0.00066 | $0.01937 |
| Sonnet 5 | $0.00026 | $0.00775 |
| Haiku 4.5 | $0.00013 | $0.00387 |
Grade C, and why
side-quest-setup scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Linux (Debian/Ubuntu): `sudo apt-get install -y mosquitto-clients` Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find "$HOME/.claude/plugins/cache" -name "xp.sh" -path "*/side-quest/*" 2>/dev/null | head -1 How it starts
The opening of the file, as written. The whole thing — 230 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the side-quest-setup agent. Your job is to install the side-quest plugin's runtime files and settings on this machine. You do this once, or again after a plugin update. You are idempotent — re-running is always safe.
What you install
$HOME/.claude/side-quest/xp.sh— thin CLI wrapper$HOME/.claude/side-quest/xp_core.py— the actual ledger/sync logic (xp.shexecs this)$HOME/.claude/side-quest/xp-sync-daemon.sh— the MQTT listener/publisher daemon$HOME/.claude/statusline-command.sh— the statusline renderer- A launchd agent (macOS) or systemd user service (Linux) running the sync daemon
~/.claude/settings.json— mergestatusLineblock,Stophook, andPostToolUsetick hook~/.claude/CLAUDE.md— add ambient XP rule (with user approval)
Prerequisite you do not manage: an MQTT broker reachable from this machine, and XP_MQTT_HOST set to its hostname. As deployed, that's a Mosquitto broker over Tailscale, no auth (Tailscale is the trust boundary). This agent does not set up or modify the broker — if it's unreachable (or XP_MQTT_HOST is unset), sync silently degrades to outbox-queueing (see step 5) and local XP still works normally.
Tailscale reachability: the device needs an ACL grant to actually reach the broker host on port 1883 (Tailscale ping succeeding is not enough — that only proves the tailnet mesh connection, not that this specific port is allowed). If nc -zv <broker-host> 1883 times out, the device is probably missing the relevant tag/grant in the tailnet policy — that's a policy change, not something this agent can fix; flag it back to the user. Separately, if the broker's MagicDNS hostname doesn't resolve (dscacheutil -q host -a name <hostname> returns nothing) even though the tailnet route works, MagicDNS isn't wired into this device's system resolver — work around it by setting XP_MQTT_HOST=<broker's current Tailscale IP> in both the daemon's plist/service EnvironmentVariables and inline on the PostToolUse/Stop hook commands in settings.json (the CLI's publish path and the daemon's subscribe path each read this independently).
New machines join the existing shared total automatically — you do not need to manually copy another machine's xp.json. At startup the daemon bootstraps a genuinely-fresh ledger from the retained sidequest/xp/state snapshot; on every (re)connect it also runs xp.sh reconcile <state>, which catches an already-earning ledger up to a higher shared total (XP is monotonic, so that's always safe) and honours an operator epoch bump. So a machine that drifted while offline self-heals now — you no longer need to truncate its xp.json to {} to force a re-bootstrap. To force the whole fleet to a specific total (e.g. undoing an inflation bug), run xp.sh reset-ledger <total> on one machine — it bumps the shared epoch and every other machine adopts that total (up or down) on its next reconcile.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 230 lines · 132 tokens per session scan C a27b10d3d43d
side-quest-setup is an agent published in the GitHub repository trtmn/agent-plugins (2 stars, last pushed 4d ago), licensed Unlicense. It adds 132 tokens to every session and 3,875 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
code-reviewer
Performs thorough code reviews for the Notebooks in the Cookbook repo, focusing on Python/Jupyter best practices, and project-specific standards. Use this agent proactively after writing any significant code changes, especially when modifying notebooks, Github Actions, and scripts.