Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/coltonbearden/carrelWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/coltonbearden/carrel/pack)<a href="https://agentmods.dev/commands/coltonbearden/carrel/pack"><img src="https://agentmods.dev/badge/commands/coltonbearden/carrel/pack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/coltonbearden/carrel/pack"><img src="https://agentmods.dev/badge/commands/coltonbearden/carrel/pack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01807 |
| Opus 5.5 | $0.00014 | $0.00723 |
| Sonnet 5.5 | $0.00007 | $0.00361 |
| Haiku 4.5 | $0.00004 | $0.00181 |
Grade A, and why
pack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pack these paths into an LLM-ready context document: $ARGUMENTS
Run the carrel CLI via Bash. Map the user's request onto the real flags in the --help block below (regenerated from the CLI by scripts/sync_plugins.py; if the installed carrel pack --help differs, trust the installed version — never invent flags):
Usage: carrel pack [OPTIONS] PATHS...
Bundle PATH... (files or directories) into one LLM-ready context document.
Formats: md (default: header + fenced tree + per-file fenced sections, fences lengthened on
collision), xml (<context><tree/><file/></context> with CDATA, Claude-friendly), json ({meta,
tree, files}). Token counts are ceil(chars / 3.6) labeled tokens_est by default; --tokenizer exact
counts with tiktoken (o200k_base) and labels the field tokens.
Selection: --query ranks files through the desk index under --root (build it with the `index`
command) and emits hits in relevance order; --since REF / --changed narrow to what git reports as
changed (deleted files are listed in the header as removed; --since REF compares REF with the
working tree). --query combines with either git selector and with the usual --include/--exclude
filters (intersection); --since and --changed exclude each other.
.gitignore handling is a deliberately simple per-directory matcher: plain names and `*` globs
match anywhere below their .gitignore; a trailing `/` restricts a pattern to directories; patterns
containing `/` match relative to their .gitignore's directory; `!pattern` re-includes, with git's
ordering rule (last matching line wins) — the negation is honored. `.git` and `.carrel` are always
skipped. Binaries outside the supported set are listed in the tree as [skipped: binary] with their
size, never inlined; images are only read (OCR) with --ocr.
Options:
-o, --output FILE Write here instead of stdout (with --chunk: OUT.part1..N).
--format [md|xml|json] Output format. [default: md]
--include GLOB Only pack files matching GLOB (repeatable).
--exclude GLOB Drop files/dirs matching GLOB (repeatable).
--no-gitignore Do not honor .gitignore files.
--max-bytes N Stop adding file contents once N total bytes are packed; omissions
are noted in the header.
--max-file-bytes N Skip any single file larger than N bytes.
--chunk TOKENS Split into OUT.part1..N, each at most TOKENS tokens under the
active --tokenizer (requires -o). Files are never split mid-file
unless one alone exceeds the budget; then it is split on line
boundaries with (continued) markers.
--tree-only Emit header + tree only, no contents.
--ocr OCR images and scanned PDFs (needs tesseract / ocrmypdf).
--stats Print a per-file token table instead of the pack (the pack is
still written when -o is given).
--query TEXT Pack only files the desk index under --root ranks for TEXT (FTS5
syntax), in relevance order. Requires a prior `index` run.
--top N With --query: consider at most the N best-ranked hits. [default:
20]
--since REF Pack only files changed since git REF (`git diff --name-only
REF`); deleted files are listed as removed, not packed.
--changed Pack only uncommitted changes: files differing from HEAD plus
untracked files (not --since).
--dedupe-content Inline identical file contents once; later copies are tree-listed
as [same as <first path>].
--tokenizer [heuristic|exact] Token counting: heuristic = ceil(chars/3.6) labeled tokens_est;
exact = tiktoken o200k_base labeled tokens (needs the
'carrel[tokens]' extra). [default: heuristic]
--outline Structure instead of contents (tree-only cost): .py top-level
def/class names with line numbers, .md headings; other types show
size only. Not with --chunk.
--fail-empty / --no-fail-empty Exit 5 when no file is packed (e.g. --query without hits, --since
with no changes). Default: on under --json, off otherwise — an
agent that packs nothing should not get a valid-looking empty
document back. --no-fail-empty restores exit 0.
--json Machine-readable JSON output.
--help Show this message and exit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +2 lines b659b30646a7
- 1mo ago Changed · +65 lines · +8 tokens per session 5bbee56a5d47
- 1mo ago Changed 68b373fb45d7
- 1mo ago First seen · 30 lines · 28 tokens per session scan A e76a92194e5f
pack is a command published in the GitHub repository coltonbearden/carrel (2 stars, last pushed yesterday), licensed MIT. It adds 36 tokens to every session and 1,807 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
tree-ring-certify
Generate Tree Ring harness or recall-quality evidence without confusing it with the full framework release suite.
tree-ring-recall
Recall durable Tree Ring Memory context before starting or resuming work.
tree-ring-update
Check for or install a verified Tree Ring Memory CLI update without changing installation scope.
tree-ring-status
Check receipt-backed Tree Ring harness readiness without claiming configuration is activation.
sync
Mid-session context refresh command. Keeps context fresh and consistent during work.
memory-diff
Memory and knowledge-base limit check + global project comparison.