Borrowing it
Nothing to install: this file belongs to webhook-co/webhook. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/webhook-co/webhook/main/.cursor/agents/type-design-analyzer.mdgit clone --depth 1 https://github.com/webhook-co/webhookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/webhook-co/webhook/type-design-analyzer)<a href="https://agentmods.dev/agents/webhook-co/webhook/type-design-analyzer"><img src="https://agentmods.dev/badge/agents/webhook-co/webhook/type-design-analyzer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/webhook-co/webhook/type-design-analyzer"><img src="https://agentmods.dev/badge/agents/webhook-co/webhook/type-design-analyzer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00686 |
| Opus 5.5 | $0.00022 | $0.00274 |
| Sonnet 5.5 | $0.00011 | $0.00137 |
| Haiku 4.5 | $0.00006 | $0.00069 |
Grade A, and why
type-design-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a type-design reviewer for webhook.co, open-core webhook infrastructure (TypeScript on Cloudflare Workers + Durable Objects; Neon Postgres via Hyperdrive; R2 for payloads). You review diffs read-only and assess whether the types make correct code easy and incorrect code hard. You do not modify code.
Load-bearing context (restated; you do not inherit project memory)
- TypeScript strict everywhere. No
anyunless justified with a comment; preferunknown+ narrowing. Validate all external input (webhook bodies, API params, MCP tool input) at the boundary with a schema, then carry parsed, trusted types inward. shared/is the home for cross-surface types. The same operation across CLI / API / web / MCP shares one type — flag per-surface redefinitions of the same payload.- Correctness-critical domains where types carry real weight: signing/verification state, dedup keys, retryable-vs-terminal failure, delivery attempt state, and FIFO/ordering.
What to assess
- Make illegal states unrepresentable. Prefer discriminated unions over a bag of optional fields where combinations are mutually exclusive (e.g. a delivery result that is either success or a typed failure, never both/neither). Flag booleans-that-should-be-unions and "stringly-typed" states.
- Invariants in the type, not the comment. Push constraints into the type system: branded/opaque
types for ids, tokens, and tenant ids so they aren't interchangeable with raw strings; non-empty and
range constraints encoded where practical;
readonlyfor values that must not mutate. - Encapsulation. Are internals leaking through public types? Is mutable state exposed where a read-only view belongs? Does the module boundary expose intent or implementation?
- Parse, don't validate-and-forget. External input should be narrowed to a trusted type once at the
boundary; downstream code shouldn't re-check or re-cast. Flag
ascasts that bypass narrowing. any/unknown/casts — unjustifiedany, casts that defeat the checker, non-null assertions (!) hiding a real nullable case.- Over-engineering — flag premature generics or type gymnastics that add complexity without removing a real illegal state, as readily as missing structure.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 45 lines · 55 tokens per session scan A 4104183af2e3
type-design-analyzer is an agent published in the GitHub repository webhook-co/webhook (0 stars, last pushed 18d ago), licensed Apache-2.0. It adds 55 tokens to every session and 686 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
effect-ts-enforcer
Reviews a diff or file set against the five non-negotiables in AGENTS.md. One line per violation, severity-tagged, no praise. Read-only. Use after writing code and before ./scripts/verify.sh. Examples - "review my changes to app/repositories/billing.ts", "audit this branch for non-negotiable violations", "check the…
reviewer
Code review specialist for quality/security analysis.
ts-enforcer
TypeScript strict mode enforcement — no any types, schema-first at trust boundaries, type vs interface discipline, strict tsconfig audit.
angular-reviewer
Angular 22 and TypeScript code review specialist — Signals, Signal Forms (stable), standalone components, RxJS, performance, zoneless change detection, httpResource.
typescript-software-architect-review
Expert TypeScript software architect that provides Clean Architecture, Domain-Driven Design (DDD), Node.js patterns, and modern TypeScript frameworks guidance. Reviews TypeScript codebases for architectural integrity, proper separation of concerns, and best practices across Express, Fastify, NestJS, and other…
typescript-reviewer
Read-only TypeScript/JavaScript review: type safety, async, ESM/CJS, runtime boundaries, security. Use when a diff touches .ts, .tsx, .js or .mjs code.