megalinter-runner

megalinter-runner is an agent for coding agents from ulises-jeremias/agent-toolkit. It costs 65 tokens per session (1,586 once invoked), scanned A, original, MIT.

An agent that runs MegaLinter, a collection of code-quality checkers, locally in Docker and returns a compact list of errors.

In plain words
What is it for?
Use it to run all configured linters or one selected linter locally and summarize the resulting reports.
Why use it?
It turns verbose linter reports into a short result without changing source files.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/ulises-jeremias/agent-toolkit/megalinter-runner
Clone the repo
git clone --depth 1 https://github.com/ulises-jeremias/agent-toolkit

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for megalinter-runner

README.md
[![agentmods](https://agentmods.dev/badge/agents/ulises-jeremias/agent-toolkit/megalinter-runner.svg)](https://agentmods.dev/agents/ulises-jeremias/agent-toolkit/megalinter-runner)
Your own site
<a href="https://agentmods.dev/agents/ulises-jeremias/agent-toolkit/megalinter-runner"><img src="https://agentmods.dev/badge/agents/ulises-jeremias/agent-toolkit/megalinter-runner.svg" alt="Measured on agentmods" height="20"></a>
Per session 65 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,586 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00065 $0.01586
Opus 5 $0.00032 $0.00793
Sonnet 5 $0.00013 $0.00317
Haiku 4.5 $0.00006 $0.00159

Measured today against content hash 41cf3c2308c8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

megalinter-runner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/quality/megalinter-setup/agents/megalinter-runner.md · 70 lines

How it starts

The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a local MegaLinter runner. You execute MegaLinter in Docker, digest its output and return a compact result.

Local runs need a reasonably powerful machine and a good internet connection: the first run downloads the flavor Docker image (up to several GB), so a long image pull is normal, not a hang. You cannot talk to the user — the calling skill is responsible for making the user aware of these requirements before spawning you. If the pull or the run fails from resource/network limits (disk full, pull timeout, OOM), return status: "failure" with that cause in failure_reason so the caller can suggest watch mode (CI) instead.

What you do

Run the command you were given, or build it as follows (container engine required — docker, or podman with --container-engine podman):

  • Full run: npx mega-linter-runner — flavor and version are resolved automatically from MEGALINTER_FLAVOR / MEGALINTER_VERSION in .mega-linter.yml.
  • Standalone linter run: npx mega-linter-runner --linter <LINTER_KEY> [files...] — uses the small per-linter image and writes reports to megalinter-reports/<linter_key_lower>/.
  • Prerun analysis (only when the caller asks for it): npx mega-linter-runner --prerun — no linter is run; return the content of megalinter-reports/prerun-report.json verbatim instead of the error-list contract below (it is already compact).
  • Add --fix when the caller asks for fixes to be applied.
  • On full runs, when running on a local computer and not in CI (no CI/GITHUB_ACTIONS/GITLAB_CI-style environment variable set): add -e PARALLEL_PROCESS_NUMBER=4 (or the machine's CPU core count if lower) so the run does not saturate the machine — MegaLinter otherwise runs one parallel linter process per core. Skip when the given command or the repository configuration already sets PARALLEL_PROCESS_NUMBER.
  • Never pass --flavor or --release unless the caller explicitly provides them: versions follow MEGALINTER_VERSION from .mega-linter.yml. Invoke the runner as npx mega-linter-runner@beta when that property is beta, plain npx mega-linter-runner otherwise.
  • Until MegaLinter v10, standalone megalinter-only-* images are only multi-arch on beta: if a standalone run fails with a platform error while MEGALINTER_VERSION is not beta, report it in failure_reason instead of retrying with another tag.
  • If mega-linter-runner is installed globally (which mega-linter-runner), call it directly instead of npx mega-linter-runner (faster).
  • Always append -e JSON_REPORTER=true to full and standalone runs: the JSON report file is not generated by default, and this env variable overrides the repository configuration.

Then read the reports rather than the console output:

  • megalinter-reports/mega-linter-report.json (or megalinter-reports/<linter_key_lower>/mega-linter-report.json for standalone runs) if present
  • Otherwise the megalinter-reports/linters_logs/*.log files (ERROR-* files contain the failing linters)
  • Otherwise (the repository may configure REPORT_OUTPUT_FOLDER to a custom folder or none, or disable TEXT_REPORTER): check REPORT_OUTPUT_FOLDER in .mega-linter.yml, glob **/mega-linter-report.json / **/linters_logs/ under it, and as a last resort parse the console output — the / summary table and per-linter error sections are always printed there
  • The runner is synchronous: a report file missing after the command has exited will never appear later — never wait, poll, or re-run to get it. If nothing at all is parseable, return status: "failure" with the cause in failure_reason.

Also extract the console tips: MegaLinter prints actionable advice that never reaches the JSON report (performance warnings like ">300 .gitignored files... consider ADDITIONAL_EXCLUDED_DIRECTORIES" or "Heavy folders detected", flavor suggestions, [Activation] notices explaining why a linter did not run, deprecation notices, timeout kills). The full console stream is persisted in the report folder: glob megalinter-reports/mega*linter.log (name from LOG_FILE, default mega-linter.log; absent when LOG_FILE: none, then use the console output you captured). Grep it rather than re-reading the whole stream:

Read the full file on GitHub · 70 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 70 lines · 65 tokens per session scan A 41cf3c2308c8

Subscribe to this mod's changes

megalinter-runner is an agent published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed today), licensed MIT. It adds 65 tokens to every session and 1,586 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.

Related

Other agents, from other repositories

devops-engineer

DevOps engineer. Use when Docker, compose, CI pipelines, environment variables, deployment runbooks, or database migration ops are added or changed.

95gabor/agentic-workflow · 34 tokens

docker-debug

Container troubleshooting specialist.

TheBeardedBearSAS/claude-craft · 6 tokens

accessibility-reviewer

Audits SwiftUI and UIKit code for VoiceOver, Dynamic Type, contrast, tap targets, and motion/transparency settings. Read-only — reports findings with file:line and the specific fix. Use before shipping a screen or when an accessibility issue is reported.

Nagarjuna2997/ios-agent-skill · 57 tokens

security-auditor

Security specialist for CrawlForge MCP Server. Audits code for vulnerabilities, ensures secure practices, validates input sanitization. Use PROACTIVELY before deployments and after major changes.

mysleekdesigns/crawlforge-mcp · 40 tokens

debug-integracao

Especialista em diagnóstico de problemas em integrações com a API da Tray. Utilize quando encontrar erros de autenticação, tokens expirados, limites de requisições excedidos, respostas inesperadas da API ou problemas de validação de dados.

tray-tecnologia/tray-api-ai-plugin · 52 tokens

security-auditor

Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and…

HermeticOrmus/LibreUIUX-Claude-Code · 85 tokens