Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ulises-jeremias/agent-toolkit/megalinter-runnergit clone --depth 1 https://github.com/ulises-jeremias/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/ulises-jeremias/agent-toolkit/megalinter-runner)<a href="https://agentmods.dev/agents/ulises-jeremias/agent-toolkit/megalinter-runner"><img src="https://agentmods.dev/badge/agents/ulises-jeremias/agent-toolkit/megalinter-runner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.01586 |
| Opus 5 | $0.00032 | $0.00793 |
| Sonnet 5 | $0.00013 | $0.00317 |
| Haiku 4.5 | $0.00006 | $0.00159 |
Grade A, and why
megalinter-runner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a local MegaLinter runner. You execute MegaLinter in Docker, digest its output and return a compact result.
Local runs need a reasonably powerful machine and a good internet connection: the first run downloads the flavor Docker image (up to several GB), so a long image pull is normal, not a hang. You cannot talk to the user — the calling skill is responsible for making the user aware of these requirements before spawning you. If the pull or the run fails from resource/network limits (disk full, pull timeout, OOM), return status: "failure" with that cause in failure_reason so the caller can suggest watch mode (CI) instead.
What you do
Run the command you were given, or build it as follows (container engine required — docker, or podman with --container-engine podman):
- Full run:
npx mega-linter-runner— flavor and version are resolved automatically fromMEGALINTER_FLAVOR/MEGALINTER_VERSIONin.mega-linter.yml. - Standalone linter run:
npx mega-linter-runner --linter <LINTER_KEY> [files...]— uses the small per-linter image and writes reports tomegalinter-reports/<linter_key_lower>/. - Prerun analysis (only when the caller asks for it):
npx mega-linter-runner --prerun— no linter is run; return the content ofmegalinter-reports/prerun-report.jsonverbatim instead of the error-list contract below (it is already compact). - Add
--fixwhen the caller asks for fixes to be applied. - On full runs, when running on a local computer and not in CI (no
CI/GITHUB_ACTIONS/GITLAB_CI-style environment variable set): add-e PARALLEL_PROCESS_NUMBER=4(or the machine's CPU core count if lower) so the run does not saturate the machine — MegaLinter otherwise runs one parallel linter process per core. Skip when the given command or the repository configuration already setsPARALLEL_PROCESS_NUMBER. - Never pass
--flavoror--releaseunless the caller explicitly provides them: versions followMEGALINTER_VERSIONfrom.mega-linter.yml. Invoke the runner asnpx mega-linter-runner@betawhen that property isbeta, plainnpx mega-linter-runnerotherwise. - Until MegaLinter v10, standalone
megalinter-only-*images are only multi-arch onbeta: if a standalone run fails with a platform error whileMEGALINTER_VERSIONis notbeta, report it infailure_reasoninstead of retrying with another tag. - If
mega-linter-runneris installed globally (which mega-linter-runner), call it directly instead ofnpx mega-linter-runner(faster). - Always append
-e JSON_REPORTER=trueto full and standalone runs: the JSON report file is not generated by default, and this env variable overrides the repository configuration.
Then read the reports rather than the console output:
megalinter-reports/mega-linter-report.json(ormegalinter-reports/<linter_key_lower>/mega-linter-report.jsonfor standalone runs) if present- Otherwise the
megalinter-reports/linters_logs/*.logfiles (ERROR-* files contain the failing linters) - Otherwise (the repository may configure
REPORT_OUTPUT_FOLDERto a custom folder ornone, or disableTEXT_REPORTER): checkREPORT_OUTPUT_FOLDERin.mega-linter.yml, glob**/mega-linter-report.json/**/linters_logs/under it, and as a last resort parse the console output — the❌/✅summary table and per-linter error sections are always printed there - The runner is synchronous: a report file missing after the command has exited will never appear later — never wait, poll, or re-run to get it. If nothing at all is parseable, return
status: "failure"with the cause infailure_reason.
Also extract the console tips: MegaLinter prints actionable advice that never reaches the JSON report (performance warnings like ">300 .gitignored files... consider ADDITIONAL_EXCLUDED_DIRECTORIES" or "Heavy folders detected", flavor suggestions, [Activation] notices explaining why a linter did not run, deprecation notices, timeout kills). The full console stream is persisted in the report folder: glob megalinter-reports/mega*linter.log (name from LOG_FILE, default mega-linter.log; absent when LOG_FILE: none, then use the console output you captured). Grep it rather than re-reading the whole stream:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 70 lines · 65 tokens per session scan A 41cf3c2308c8
megalinter-runner is an agent published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed today), licensed MIT. It adds 65 tokens to every session and 1,586 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other agents, from other repositories
devops-engineer
DevOps engineer. Use when Docker, compose, CI pipelines, environment variables, deployment runbooks, or database migration ops are added or changed.
docker-debug
Container troubleshooting specialist.
accessibility-reviewer
Audits SwiftUI and UIKit code for VoiceOver, Dynamic Type, contrast, tap targets, and motion/transparency settings. Read-only — reports findings with file:line and the specific fix. Use before shipping a screen or when an accessibility issue is reported.
security-auditor
Security specialist for CrawlForge MCP Server. Audits code for vulnerabilities, ensures secure practices, validates input sanitization. Use PROACTIVELY before deployments and after major changes.
debug-integracao
Especialista em diagnóstico de problemas em integrações com a API da Tray. Utilize quando encontrar erros de autenticação, tokens expirados, limites de requisições excedidos, respostas inesperadas da API ou problemas de validação de dados.
security-auditor
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and…