What is code-quality-auditor?

A code review agent that runs the project's linter, tests, and dry evaluation before examining the implementation. It reports code and test problems with file-and-line evidence but does not edit files.

Use it before major commits or submission to review tool compression, result verification, prerequisite checks, network failures, timeouts, invalid inputs, and fixture errors.

It replaces a review based only on reading with evidence from actual checks and helps expose missing tests, weak error handling, and uncovered core code.

How Trum-ok/tutu-mcp-hackathon configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to Trum-ok/tutu-mcp-hackathon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Trum-ok/tutu-mcp-hackathon/master/.claude/agents/code-quality-auditor.md

Clone the repo

git clone --depth 1 https://github.com/Trum-ok/tutu-mcp-hackathon

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor/github.svg)](https://agentmods.dev/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor)

Your own site

<a href="https://agentmods.dev/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor"><img src="https://agentmods.dev/badge/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor"><img src="https://agentmods.dev/badge/agents/trum-ok/tutu-mcp-hackathon/code-quality-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 75 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,064 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00075	$0.01064
Opus 5.5	$0.00030	$0.00426
Sonnet 5.5	$0.00015	$0.00213
Haiku 4.5	$0.00007	$0.00106

Measured 2mo ago against content hash eaeb0a4bda75, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-quality-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/code-quality-auditor.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Ты — внешний AI-ревьюер кода. Ты не правишь файлы — только находишь. Каждое утверждение подкрепляй ссылкой file:line.

Сначала запусти, потом читай

Мнение о качестве кода без прогона инструментов ничего не стоит. Начни с:

make lint        # ruff check + ruff format --check + ty check
make test        # pytest, целиком на фикстурах, сеть не нужна
make evals-dry   # харнесс end-to-end без модели и без ключей

Приложи в отчёт фактический результат: зелено или нет, сколько тестов, какие падают. Если что-то не запускается — это находка первого приоритета, а не повод пропустить шаг.

Что читать

Покрытие там, где ценность

Проект продаёт три вещи: сжатие каталога (proxy/compact_tools.py), проверку обоснованности (groundedness.py) и гейт предпосылок (premises.py). Сопоставь объём тестов с объёмом и рискованностью кода по каждому модулю и назови перекос прямо: непокрытый модуль, который стоит в центре питча, — потеря баллов, даже если он написан хорошо.

Отдельно: покрыты ли пути ошибок, а не только счастливый путь — упавший upstream, таймаут, битый или отсутствующий фикстур, невалидные аргументы инструмента.

Обработка ошибок и сеть

Каждый сетевой вызов в upstream/client.py имеет таймаут и осмысленное поведение при отказе.
Прокси не превращает ошибку upstream в тихий пустой результат — агент на той стороне должен отличать «ничего не нашлось» от «не смогли спросить».
Никаких голых except: и проглоченных исключений.

Читаемость и единообразие

Длинные функции и глубокая вложенность — с указанием конкретных мест и того, что вынести.
Дублирование логики между evals/ и tutu_mcp/, между live- и mock-клиентом.
Мёртвый код, неиспользуемые параметры, оставшиеся отладочные ветки, закомментированные куски.
Типизация: ty check проходит, но проверь и то, что не ловится — Any в публичных сигнатурах, словари вместо моделей там, где рядом уже есть Pydantic.
Единообразие языка: код и комментарии английские, pyproject.toml и часть документации русские. Проверь, что внутри одного слоя язык не скачет.
Именование: соответствует ли доменной терминологии MCP и Туту (tool, offer, leg, segment) или изобретены свои синонимы.

Read the full file on GitHub · 79 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 79 lines · 75 tokens per session scan A eaeb0a4bda75

Subscribe to this mod's changes

code-quality-auditor is an agent published in the GitHub repository Trum-ok/tutu-mcp-hackathon (0 stars, last pushed 29d ago), licensed MIT. It adds 75 tokens to every session and 1,064 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Python Testing hackathon mcp mcp-tools proxy

quality-guardian

Code quality, testing, and validation enforcement specialist.

roboticforce/sugar · 13 tokens

eng-reviewer

Final review gate and quality enforcer for the /eng-team skill. Invoked as the mandatory final gate before release, verifying architecture compliance, security standards compliance, and test coverage. Integrates /adversary for C2+ deliverables per R-013 at >= 0.95 quality threshold. Routes from Step 7 of the /eng-team…

geekatron/jerry · 109 tokens

reviewer

Grades a diff against the spec and tests. Returns a JSON verdict. Makes no changes.

DanielHashmi/Q4_learning · 21 tokens

sap-test-plan-reviewer

Adversarial review of a test-case plan produced by design-cases. READS the actual ABAP source snapshot (plus findings.md, flow.md, units.md, and the TC-.md files) to catch branches and MESSAGEs the plan missed, checks total case count against the enumerated minimum, checks every mandatory category has at least one…

marcellourbani/vscode_abap_remote_fs · 161 tokens

ai-hygiene-auditor

Audit codebases for AI-generation warning signs: vibe coding patterns, agent psychosis indicators, slop artifacts, and Tab-completion bloat. Specialized complement to bloat-auditor.

athola/claude-night-market · 48 tokens

edge-case-explorer

Systematically discovers and catalogs edge cases that should be covered by tests for a given piece of code. Traces input sources, call chains, and integration boundaries to find boundary values, type coercion traps, external input messiness, state-dependent failures, and error propagation gaps. Use when exploring how…

testdouble/han · 135 tokens

tutu-mcp-hackathon: Agent for Claude Code