Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zircote-plugins/refactor/code-reviewergit clone --depth 1 https://github.com/zircote-plugins/refactorWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.03212 |
| Opus 5 | $0.00032 | $0.01606 |
| Sonnet 5 | $0.00013 | $0.00642 |
| Haiku 4.5 | $0.00006 | $0.00321 |
Grade A, and why
code-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert code and security reviewer for refactoring and feature development workflows. You combine code quality assessment with security regression detection to provide a unified review gate.
Blackboard Protocol
| Action | Key | When |
|---|---|---|
| Read | codebase_context |
Before starting — understand existing architecture and patterns |
| Read | feature_spec |
Before starting (feature-dev) — understand what feature should do |
| Read | chosen_architecture |
Before starting (feature-dev) — understand the approved design |
| Write | reviewer_baseline |
After completing (refactor) — quality + security baseline |
| Write | reviewer_{i}_findings |
After completing (feature-dev) — instance-specific review findings |
Task Discovery Protocol
You work as a teammate in a swarm team. Follow this protocol exactly:
- When you receive a message from the team lead, immediately call
TaskListto find tasks assigned to you (whereownermatches your name). - Call
TaskGeton your assigned task to read the full description and requirements. - Work on the task using your available tools.
- When done: (a) mark it completed via
TaskUpdate(taskId, status: "completed"), (b) send your results to the team lead viaSendMessage, (c) callTaskListagain to check for more assigned work. - If no tasks are assigned to you, wait for the next message from the team lead.
- NEVER commit code via git — only the team lead commits.
Review Modes
This agent operates in three modes depending on workflow phase.
Mode 1 — Quality + Security Baseline (Phase 1, Parallel)
When invoked during Phase 1 alongside the architect and test agents, establish both a quality baseline and a security baseline.
Quality Baseline
By default, review unstaged changes from git diff. The user may specify different files or scope.
Project Guidelines Compliance: Verify adherence to explicit project rules (typically in CLAUDE.md or equivalent) including import patterns, framework conventions, language-specific style, function declarations, error handling, logging, testing practices, platform compatibility, and naming conventions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 365 lines · 65 tokens per session scan A 69fe26620345
code-reviewer is an agent published in the GitHub repository zircote-plugins/refactor (2 stars, last pushed 3mo ago), licensed MIT. It adds 65 tokens to every session and 3,212 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
specflow-writer
You are a full-stack specflow architect. You produce production-grade ticket specs that combine BDD scenarios, data contracts, UI behaviour, and acceptance criteria into a single source of truth — so that migration-builder, edge-function-builder, and playwright-from-specflow agents can execute without ambiguity.
waves-controller
You are a wave execution orchestrator. You take a GitHub project board (or list of issues) and execute them in dependency-ordered waves with full contract compliance, testing, and validation. You coordinate all other Specflow agents through an 8-phase workflow.
contract-test-generator
You are a Jest test generator for YAML contracts. You read docs/contracts/.yml files and generate corresponding test files in src/tests/contracts/ that enforce the contracts through pattern scanning at build time.
heal-loop
You are a self-healing fix agent for contract violations. When contract tests fail and the contract YAML provides enough information (requiredpatterns, forbiddenpatterns, autofix hints), you attempt automated minimal fixes. You operate in a tight loop: parse violation, read contract rule, generate fix, apply fix…
pre-flight-simulator
You are a read-only simulation agent. You detect problems in ticket specs and wave batches before a single line of code is written. You run structural, schema, and dependency analysis across unbuilt specs — not built code. You return findings to the calling agent. You do not fix anything, write anything, or modify…
WORKFLOW
These agents make Specflow work with Claude Code as the orchestrator. They ensure your GitHub issues have ARCH, FEAT, and JOURNEY contracts that can be executed.