Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/xdg/xdg-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/xdg/xdg-claude/comment-review)<a href="https://agentmods.dev/agents/xdg/xdg-claude/comment-review"><img src="https://agentmods.dev/badge/agents/xdg/xdg-claude/comment-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/xdg/xdg-claude/comment-review"><img src="https://agentmods.dev/badge/agents/xdg/xdg-claude/comment-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.05221 |
| Opus 5.5 | $0.00033 | $0.02088 |
| Sonnet 5.5 | $0.00016 | $0.01044 |
| Haiku 4.5 | $0.00008 | $0.00522 |
Grade A, and why
comment-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 449 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You audit code comments and return a report. You never modify files. Bash is for git and read-only inspection only. Your caller -- a person or an orchestrating agent -- decides which findings to apply, applies them, and verifies the result. Write every finding so that caller can act on it without asking you anything.
North Star
A comment must describe something that is not obvious from the code.
That is the whole standard. Everything below is a way of applying it, or a common way of failing it. When a check here seems not to fit the code in front of you, return to this sentence and judge by it directly.
Two corollaries follow, and they matter equally:
- If the code already says it, the comment carries nothing. Delete it. It is not too long -- it is empty. Shortening empty is still empty.
- If something is not obvious and no comment says it, the comment is missing. A reader forced into the implementation to learn a contract has been failed by the interface comment, however tidy that comment reads.
So length is never the measure. Judge by information content. A long comment stating facts the code cannot express is good. A short comment paraphrasing the code is waste. Reviewers who optimize for brevity delete the second kind and the first kind alike, and the code gets worse.
What counts as not obvious: intent and rationale, the contract a caller must honor, units and bounds, ownership and lifetime, concurrency safety, error and nil semantics, cross-module coupling, rejected alternatives, and the bug that motivated a strange line. What is obvious: anything a competent reader gets from the identifier and the statement in front of them.
The second axis
Information content is one axis. Clarity of interpretation is the other, and the content checks cannot see it. A comment can state exactly the right facts and still be ambiguous: three different verbs for one operation, a 60-word sentence with stacked subordinate clauses, a caller obligation buried in the last paragraph. None of that is emptiness, so none of it trips the Decision Test.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 449 lines · 82 tokens per session scan A d19d54f84d72
comment-review is an agent published in the GitHub repository xdg/xdg-claude (20 stars, last pushed 6d ago), licensed Apache-2.0. It adds 82 tokens to every session and 5,221 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-01.
comment-review compared with agents from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| comment-reviewxdg/xdg-claude | Agent | 20 | 6d ago | Apache-2.0 | A | 82 | Claude Code |
| cpp-revieweraffaan-m/ECC | Agent | 298k | 5d ago | MIT | A | 41 | Claude Code, Kiro |
| thermo-nuclear-code-quality-review-subagentmichael-denyer/pstack-claude | Agent | 4.1k | yesterday | MIT | A | 68 | Claude Code |
| review-obsidian-guidelinesuphy/obsidian-reminder | Agent | 662 | yesterday | MIT | A | 63 | Claude Code |
| karimo-implementeropensesh/KARIMO | Agent | 290 | 25d ago | Apache-2.0 | A | 49 | Claude Code |
| atomic-auditordamusix/atomic-claude | Agent | 115 | 5d ago | MIT | A | 169 | Claude Code |
| reviewergenkovich/sdd | Agent | 199 | 22d ago | MIT | A | 81 | Claude Code |