Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/coleam00/archon/validategit clone --depth 1 https://github.com/coleam00/ArchonWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00873 |
| Opus 5 | $0.00000 | $0.00436 |
| Sonnet 5 | $0.00000 | $0.00175 |
| Haiku 4.5 | $0.00000 | $0.00087 |
Grade A, and why
validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate
Run the project's own checks and report the truth. You fix nothing and judge nothing beyond pass or fail — running the gate is the whole job.
Optional narrowing (may be empty — empty means the full applicable gate):
$INPUTS.scope
The run's trigger message, which may add context:
$ARGUMENTS
Discover, then run
- Discover the checks from the repository itself: package scripts, task runners, CI workflow definitions, contributor docs. Never invent a generic command the project does not define; never substitute your own idea of a check for the project's.
- If dependencies are missing, install them with the project's own package manager in locked mode first — a gate that fails on a broken environment is reporting the environment, not the code.
- Run what applies, in the project's own order where one is documented: type checks, lint, tests, build. Honor any documented aggregate gate (a
validate/checkscript) over reassembling its pieces by hand. - Capture each command and its outcome as you go.
The object under validation is the tracked tree
An Archon run injects its own scaffolding into the checkout — the .archon/ copy, and on some launch paths untracked workflow packages. That is run machinery, not the change under validation, and repository gates that inspect git state (untracked-file refusals, cleanliness checks) will trip on it. When a check fails only because of untracked files under .archon/ that the run itself injected: quarantine them for the gate's duration (move them aside, run the gate, restore them — always restore, even on failure), note the quarantine in your report, and judge the gate's real result. Never quarantine tracked files, or anything the change under validation actually touches.
Not your job
Do not modify source files, fix failures, commit, push, or touch pull requests. Do not skip a failing check to make the verdict green. Do not re-run a flaky-looking check more than once without saying so.
Report
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 41 lines · 0 tokens per session scan A 4e8e13b00ebe
validate is a command published in the GitHub repository coleam00/Archon (23,339 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 873 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
fix-issues
Diagnose, reproduce, then fix reproducible open GitHub issues in parallel: one clean worktree/issue; symlink build artifacts to avoid rebuilds.
triage
Classify/label newly opened GitHub issues missing labels.
review-prs
Parallel PR triage: decide merge-worthiness, prepare rebased worktrees, fix blockers, return them for human merge.
release
Release all packages at specified version.
cleanup
Autonomous cleanup-loop iteration: discover ONE target → complete execution → verify → report. Runs stateless: derive from current tree; assume prior runs left it consistent.
hello
Say hello.