Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/andyzengmath/soliton/blast-radiusgit clone --depth 1 https://github.com/andyzengmath/solitonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/andyzengmath/soliton/blast-radius)<a href="https://agentmods.dev/commands/andyzengmath/soliton/blast-radius"><img src="https://agentmods.dev/badge/commands/andyzengmath/soliton/blast-radius.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00711 |
| Opus 5 | $0.00008 | $0.00356 |
| Sonnet 5 | $0.00003 | $0.00142 |
| Haiku 4.5 | $0.00002 | $0.00071 |
Grade A, and why
blast-radius scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/blast-radius
Compute the blast radius (number of files that import or reference a target file, plus sensitive-paths hit) using Soliton's risk-scorer heuristic — the same grep-based computation the risk-scorer agent uses today (agents/risk-scorer.md Factor 1).
This is a degraded-mode standalone surface of Soliton's existing logic. When the graph plugin lands (POST_V2_FOLLOWUPS §B1), this command will switch to graph-cli's info + dependency-edges queries; the user-facing contract stays the same.
Argument
<file>— path to a file in the current repository (relative or absolute).
Behavior
-
Validate input: if
<file>is missing or doesn't exist, outputError: file not found: <file>and STOP. -
Compute import-count via grep heuristic (same as
agents/risk-scorer.mdFactor 1):- Extract the file's basename without extension (e.g.
auth-utils.ts→auth-utils) - Run
git grep -l "<basename>"to count files that reference it - Strip the input file itself from the count
- Extract the file's basename without extension (e.g.
-
Compute sensitive-paths hit (same as
risk-scorerFactor 3):- Apply each pattern from
rules/sensitive-paths.md(and anyconfig.sensitivePathsoverrides from.claude/soliton.local.md) to the input file path - Mark hit if any pattern matches
- Note: do NOT inline the pattern list in this command's output — read the canonical source so future updates to
rules/sensitive-paths.mdpropagate automatically.
- Apply each pattern from
-
Output a compact summary:
Blast Radius for <file>
Importers: <N> files (grep heuristic)
Sensitive: <hit | clean>
Backing source: grep (graph plugin pending §B1; will upgrade when graph-cli ships)
Top 5 importers (alphabetical):
- path/a.ts
- path/b.ts
- ...
If the import-count is 0, note explicitly: "0 importers found via grep — file may be entry-point, deleted-only PR target, or grep-heuristic miss. Risk-scorer's full analysis runs the same query against git diff context."
Non-goals
- This is NOT the full risk score. The risk-scorer agent computes 6 factors weighted to a 0-100 score;
/blast-radiusexposes only Factor 1 + Factor 3 in isolation for ad-hoc queries. - This is NOT graph-aware. When the graph plugin lands, the same surface upgrades to use real call/import edges. Until then, false-positives are possible (any file containing the basename string matches, including comments and unrelated symbols).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 54 lines · 16 tokens per session scan A 1e1b6e5caab2
blast-radius is a command published in the GitHub repository andyzengmath/soliton (1 stars, last pushed 2mo ago), licensed MIT. It adds 16 tokens to every session and 711 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
harness-build
Full build pipeline — evidence gate, product gate, COGS gate, PRD writing, OKR design, sprint planning, design system setup, spec compliance review (--step spec-review), quality gate (--step quality-gate), progress tracking, and scope guard. Use when committing to building a product or agent, running individual gate…
harness-operate
Full production operations workflow — KPI dashboard, reliability scan, cost review, improvement planning, knowledge extraction, decision pattern matching, and TK-to-instruction conversion. Use when an agent is live and needs a weekly/monthly operational review, or when running any individual operations step. Use…
harness-verify
Verify task/feature completion against CONDITIONALGO conditions in STATE.md. Syncs condition status (❌→✅) before any 'done' declaration. Use when marking a task complete, closing a sprint, or claiming a condition is met. Use --spec to run full Spec Compliance Review instead of STATE.md condition check.
openehr-explain
One-stop router that explains or looks up any openEHR thing — auto-detects an archetype, a template, an RM/AM/BASE type, an RM structural concept, an ADL idiom, an AQL query or keyword, or a terminology code (replaces /archetype-explain, /template-explain, /type-spec, /rm-structure, /adl-idiom, /terminology).
cogs-sentinel
Use when AI 기능의 단가·사용량·가격으로 p50/p90 월간 마진을 결정해야 합니다. hplan/cogs-sentinel wrapper는 lognormal sampler와 free-user abuse blend로 GREEN/CONDITIONALGO/RED를 판정합니다.
harness
Run the full Auto-Harness orchestration flow. /auto-harness:harness.