Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/cognitive-fab/polygraph/polynvgit clone --depth 1 https://github.com/cognitive-fab/polygraphWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/cognitive-fab/polygraph/polynv)<a href="https://agentmods.dev/commands/cognitive-fab/polygraph/polynv"><img src="https://agentmods.dev/badge/commands/cognitive-fab/polygraph/polynv.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.01270 |
| Opus 5 | $0.00039 | $0.00635 |
| Sonnet 5 | $0.00015 | $0.00254 |
| Haiku 4.5 | $0.00008 | $0.00127 |
Grade C, and why
polynv scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
the record's provenance — omit it and a model-drafted prior is silently recorded as designer-sourced; never omit it when adding YOUR priors. How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Run polynv over the arguments in $ARGUMENTS. This is the ELICITATION side
of the method (Polygraph audits, polygen authors, polyrun executes, polyvers
evolves, polynv ELICITS): every other gate is exactly as good as
invariants.mjs, and this engine is how that file gets good — the plugin
takes the lead, and the designer's job reduces to judging concrete stories.
Deterministic and no API key except the optional --llm harvest source.
Follow the polynv skill — it is the dialog protocol, and the dialog is the
product. The CLI is ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs:
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs harvest --artifacts <dir> [--traces <p>] [--snapshots <p>] [--min-obs N] [--llm --model <id>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs questions --artifacts <dir> [--next] [--for <name>] [--json]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs add --artifacts <dir> --id prior:<slug> --target state|transition --question "…" --js "…" --author <you> [--source domain-prior --domain <d> --norm "…" --model <id>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs record --artifacts <dir> --id <id> --disposition confirm|reject|abandon|defer|modify --author <designer>
[--js "…"] [--concern "…"] [--assign <name>] [--target state|transition] [--out <path>] [--force]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs grade --artifacts <dir> [--include-invariants]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs drift --artifacts <dir> [--reopen --author <name>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs report --artifacts <dir> [--log]
On a version bump (the machine changed since the interview), run
drift first: it re-checks every recorded answer against the machine as it
is now and names every verdict that moved — a confirmed rule now violated
is a finding; a rejected candidate whose behavior changed is re-asked
(--reopen, attributed). Emission candidates get real verdicts whenever
the dir carries the composition (effects.cjs + manifest, via polyrun
check-effects).
Disposition flags that trip the unprepared: a temporal (precedence)
record's revision is STRUCTURED — --disposition modify --js '{"kind":"precedence","first":"<ACTION>","then":"<ACTION>"}' —
free-form js is refused (there is no checker for it). A mutation-survivor
record arrives with no predicate: your answering modify supplies both the
rule and its shape (--target state|transition), then a separate confirm.
And --source domain-prior is what routes --domain/--norm/--model into
the record's provenance — omit it and a model-drafted prior is silently
recorded as designer-sourced; never omit it when adding YOUR priors.
Workflow (the skill has the full protocol — these are the fixed points):
- Harvest first, passing every substrate the user has (traces, a
polyrun journal export, fleet snapshots) — then contribute your own
domain priors via
addbefore the first question: identify the domain from the contract and enumerate its canonical invariants; the designer of a payment system gets asked about authorization-before-capture whether or not any harvester surfaced it. - Interview one question at a time (
questions --next), concrete-story-first. You propose and frame; only the designer dispositions — never answer an intent question on their behalf; offerdefer --assignwhen they are unsure. Everyrecordcarries--author <designer>. - Grade before closing (
--include-invariantswhen a hand-writteninvariants.mjsexists). Survivor questions rank first on the next pass. - End with the verdict: CONVERGED (all records terminal AND graded) or
PARTIAL with what remains, per assignee. Commit
intent-ledger.json(the system of record) and the generatedinvariants.mjs;INTENT-LOG.mdis the rendered view for the PR.
Always state the disclosure the skill carries: pre-checks are consistency checks over the declared finite domains; harvested candidates are behavior, not intent; the grade bounds unconstrained behavior (behavior-REMOVING mutations largely evade it) and never certifies that the questions asked were sufficient.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 71 lines · 0 tokens per session scan C 992ad0ec17fc
polynv is a command published in the GitHub repository cognitive-fab/polygraph (11 stars, last pushed 8d ago), licensed Apache-2.0. It adds 77 tokens to every session and 1,270 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
gh-triage
GitHub OSS maintainer lifecycle triage, review, and approval management.
gh-debug-issue
../../.mastracode/commands/gh-debug-issue.md.
commit
../../.mastracode/commands/commit.md.
ralph-plan
../../.mastracode/commands/ralph-plan.md.
selfreview
../../.mastracode/commands/selfreview.md.
arrow-maintenance
Run an audit-and-update pass on the docs/arrows/ overlay. Dispatches on project state — audits an existing overlay, bootstraps the overlay from existing LID docs, or redirects to /map-codebase or /linked-intent-dev for projects without LID.