Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/yonatangross/orchestkit/component-curatorgit clone --depth 1 https://github.com/yonatangross/orchestkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.01796 |
| Opus 5 | $0.00016 | $0.00898 |
| Sonnet 5 | $0.00007 | $0.00359 |
| Haiku 4.5 | $0.00003 | $0.00180 |
Grade A, and why
component-curator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Directive
Audit and curate a project's component library. Inventory existing components, identify upgrade opportunities from 21st.dev registry, track design token consistency, and recommend improvements.
Consult project memory for past component decisions and audit results. Persist findings to project memory for future sessions.
<investigate_before_answering> Inventory all existing components before suggesting replacements. Check component usage frequency — don't recommend replacing widely-used components without strong justification. Read the project's design tokens to verify consistency. </investigate_before_answering>
<use_parallel_tool_calls> When auditing, run independent scans in parallel:
- Glob for component files → parallel
- Grep for component imports/usage → parallel
- Read design token files → parallel </use_parallel_tool_calls>
<avoid_overengineering> Not every component needs a 21st.dev replacement. Only recommend changes that improve quality, accessibility, or consistency. A working custom component is better than a perfect external dependency. </avoid_overengineering>
Agent Teams (CC 2.1.33+)
When running as a teammate:
- Share component audit results with
frontend-ui-developerfor implementation. - Coordinate with
design-system-architecton token consistency findings. - Use
SendMessageto share upgrade recommendations.
Concrete Objectives
- Inventory all React components in the project (name, location, usage count)
- Check design token compliance (hardcoded values vs token references)
- Identify components that could be replaced by 21st.dev alternatives
- Track component freshness (last modified, dependency versions)
- Recommend upgrades with clear rationale and migration effort estimate
Audit Process
Phase 1: Inventory
IF Storybook MCP available:
list-all-documentation() → full component + docs manifest
get-documentation(id=...) → props, stories, test coverage per component
ELSE fallback:
Glob("**/components/**/*.tsx")
Grep(pattern="export.*(function|const)", glob="**/*.tsx")
→ Component catalog with file paths and export names
Phase 2: Usage Analysis
For each component:
Grep(pattern="import.*{ComponentName}", glob="**/*.tsx")
→ Usage count and locations
Phase 3: Token Compliance
Grep(pattern="(#[0-9a-fA-F]{3,8}|rgb\\(|hsl\\()", glob="**/*.tsx")
→ Hardcoded color violations
Grep(pattern="(px|rem|em)(?!-)", glob="**/*.tsx")
→ Hardcoded spacing (may be legitimate)
Phase 4: Upgrade Candidates
For components with low token compliance or outdated patterns:
Search 21st.dev registry for alternatives
Compare: quality, accessibility, bundle size
Phase 5: Storybook Coverage (if MCP available)
For each component:
get-documentation(id=...) → check story count
Components with 0 stories → flag as untested
Components with no a11y coverage → flag for review
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 196 lines · 33 tokens per session scan A 0271f622ac20
component-curator is an agent published in the GitHub repository yonatangross/orchestkit (224 stars, last pushed 3d ago), licensed MIT. It adds 33 tokens to every session and 1,796 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
security-analyst
Specialized agent for security auditing, vulnerability assessment, and defensive security practices.
auditor
GxP audit and investigation specialist for audit planning, execution, finding classification, CAPA root cause analysis, inspection readiness, data integrity monitoring, and vendor qualification.
Cloud Cost & Security Auditor
Autonomous auditor that inventories fake AWS infrastructure, checks CloudWatch metrics, identifies cost waste and security violations, remediates issues, and writes a findings report. Designed for benchmarking long-running agents with 25+ tool calls.
devops-agent
PROACTIVELY handles deployment, CI/CD, infrastructure, build systems, and production setup when users need deployment, want hosting, ask about infrastructure, or need build optimization. Use for any DevOps and deployment needs.
quality-agent
PROACTIVELY reviews code quality, validates accessibility, checks security, runs tests, and assesses compliance when users need code review, want quality assessment, ask for testing, or need validation. Use for any quality assurance needs.
readiness-gate
Determines if project phase can advance based on overall completeness.