6_gofer_validate

6_gofer_validate is a command for Claude Code from eai-support/eai-gofer. It costs 21 tokens per session (26,955 once invoked), scanned A, original, Apache-2.0.

A validation command that reviews completed work using evidence, risk analysis, and an engineering score.

In plain words
What is it for?
Use it to review a feature, assess its wider impact, and record what is verified or still blocked.
Why use it?
It separates work that is merely implemented from work that has been checked and supported by evidence.

Command for Claude Code

Written for Claude Code: $ARGUMENTS substitution. Also seen: mentions CLAUDE.md; mentions subagents; mentions Claude Code.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is node .specify/scripts/node/eai-app-template-readiness.mjs --root . --source eai-managed --json.

Part of the eai-gofer plugin — 4 skills, 28 commands, 42 agents, 3 hooks, 1 MCP server shipped together

Good fit Use it to review a feature, assess its wider impact, and record what is verified or still blocked.

Compare 6 commands from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/eai-support/eai-gofer
agentmods
npx agentmods add commands/eai-support/eai-gofer/6_gofer_validate

Made for: Claude Code.

Or install eai-gofer, the plugin that ships this one along with the rest of its 4 skills, 28 commands, 42 agents, 3 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for 6_gofer_validate

README.md
[![agentmods](https://agentmods.dev/badge/commands/eai-support/eai-gofer/6_gofer_validate/github.svg)](https://agentmods.dev/commands/eai-support/eai-gofer/6_gofer_validate)
Your own site
<a href="https://agentmods.dev/commands/eai-support/eai-gofer/6_gofer_validate"><img src="https://agentmods.dev/badge/commands/eai-support/eai-gofer/6_gofer_validate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for 6_gofer_validate

Your own site · 80×15
<a href="https://agentmods.dev/commands/eai-support/eai-gofer/6_gofer_validate"><img src="https://agentmods.dev/badge/commands/eai-support/eai-gofer/6_gofer_validate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 26,955 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00021 $0.26955
Opus 5.5 $0.00008 $0.10782
Sonnet 5.5 $0.00004 $0.05391
Haiku 4.5 $0.00002 $0.02695

Measured 20d ago against content hash e3a30855416f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

6_gofer_validate scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Require: screenshot, curl/HTTP transcript, deployment log, headless browser
.specify/commands/6_gofer_validate.md · 2,510 lines

How it starts

The opening of the file, as written. The whole thing — 2,510 lines — stays where its author put it; the contents beside it link to each section on GitHub.


description: Unified validation, blast-radius analysis, and engineering review (3 phases, 110-point rubric)

Gofer Validate

Continuation And Stop Contract

  1. Preserve the requested scope and mode, including read-only, plan-only, research-only and MVP work. Keep the full applicable pipeline, stage functions, artifacts, reviews and validation; do not expand an MVP into an unapproved release.
  2. After a stage's required evidence is complete, read and follow the next internal file in .specify/commands/ in the same conversation. Do not require a numbered command or a host-specific skill dispatcher. Optional helpers remain optional; maintenance and control commands do not start delivery work.
  3. Treat the stated business goal as authority for ordinary planning, task ordering, design, diagnosis, repair, testing, and reversible repository changes within scope. Record material Gofer decisions with their reason and effect. Do not ask the user to choose implementation details that Gofer can safely decide.
  4. Ask only when the goal is unclear or changes, the action is irreversible or destructive, it changes security or access, it creates external cost or commitment, it changes production or public exposure, it requires missing authority or credentials, or it conflicts with an explicit user constraint. Record the exact reason before asking. missing or ambiguous approval is not approval when an approval boundary applies. Rejected, revoked, changed or unclear authority requires a pause.
  5. Pause for material scope, security, cost, deployment, destructive or protected files/boundary changes and any outstanding user gate. A business goal does not authorize publishing, spending, external changes, or bypassing host permissions. Complete safe authorized work without bypassing the blocked gate.
  6. A tool proposal is not execution. If host consent is required, wait for it. After the tool result or approved proposal returns, inspect the result and resume the next authorized action within approved scope; do not end with only a plan or a proposed tool call. A denied tool or unavailable capability must not be bypassed through another host or CLI.
  7. Use the current agent's available native tools. Optional Gofer/MCP tools are conveniences, not prerequisites. If the current agent lacks a required capability, report that limitation and the safe next action; do not pretend a handoff button transfers control automatically.
  8. Stop after research only when research-only work was requested, the user paused, or a real gate blocks progress. Otherwise continue to specification. At validation, report completion only when the requested scope's required evidence passes; failures remain unfinished work.
  9. Respect budget, context and retry limits from the existing loop contract. Repair safe within-scope failures only within those limits. Preserve a checkpoint before an orderly context stop; resume by reading its recorded stage and rechecking scope, approvals and evidence. Never claim an abrupt host termination was handled.
  10. Report concise Progress during work. At every controlled stop, report Progress, Stop reason and Next action, including the exact missing input or approval and unfinished work. Reasons are requested scope complete, user pause, approval required, material change, missing capability/access, validation blocked, or budget/context/retry limit. Stage completion alone is not pipeline completion.

Read the full file on GitHub · 2,510 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 20d ago Changed · +20 lines e3a30855416f
  2. 27d ago Changed · +8 lines 7823d65b7149
  3. 1mo ago Changed · +4 lines 18e063a86fb6
  4. 1mo ago Changed · -4 lines c87bbab396ef
  5. 1mo ago Changed · +18 lines d45541e3e035
  6. 1mo ago Changed 9132f8628c56
  7. 1mo ago Changed · +7 lines ce0fb5eebde9
  8. 1mo ago Changed · +23 lines d6293fc512bc
  9. 1mo ago Changed · +16 lines 57d9f4f3e74b
  10. 1mo ago First seen · 2,418 lines · 21 tokens per session scan A 4fb792cf1c1d

Subscribe to this mod's changes

6_gofer_validate is a command published in the GitHub repository eai-support/eai-gofer (1 stars, last pushed today), licensed Apache-2.0. It adds 21 tokens to every session and 26,955 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.