Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Enovatr-Labs/SpecRoutenpx agentmods add commands/enovatr-labs/specroute/parityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/enovatr-labs/specroute/parity)<a href="https://agentmods.dev/commands/enovatr-labs/specroute/parity"><img src="https://agentmods.dev/badge/commands/enovatr-labs/specroute/parity/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/enovatr-labs/specroute/parity"><img src="https://agentmods.dev/badge/commands/enovatr-labs/specroute/parity.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01430 |
| Opus 5 | $0.00014 | $0.00715 |
| Sonnet 5 | $0.00006 | $0.00286 |
| Haiku 4.5 | $0.00003 | $0.00143 |
Grade C, and why
parity scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
runtimes/.codex/config.template.toml \ Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
a=$(ls -d .claude/skills/*/ 2>/dev/null | xargs -n1 basename | sort) How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Check parity between the six vendor runtime layouts under runtimes/ - .claude,
.codex, .gemini, .kiro, .cursor, and .devin. Devin Desktop is one
vendor identity; Cascade compatibility paths are not a seventh runtime. Skills
share a portable body while preserving vendor-native frontmatter. Agents and
commands are vendor-shaped and maintained per vendor. Drift is sometimes
intentional but should be explicit, not accidental.
echo "── skills parity (body-aware, all vendors) ──"
if [ -f tools/sync-skills.py ]; then
python3 tools/sync-skills.py # read-only report; Claude is the default source of truth
else
echo " (tools/sync-skills.py missing - skipping)"
fi
echo
echo "── agents: not cross-synced ──"
echo " Agent formats diverge by vendor: flat Markdown + frontmatter for Claude/Gemini/Kiro/Cursor,"
echo " TOML (agents/<name>.toml) for Codex, per-profile agents/<name>/AGENT.md for Devin Local."
echo " Required fields also differ per vendor, so there is no cross-vendor agent parity"
echo " to enforce - maintain each independently."
for d in claude codex gemini kiro cursor devin; do
if [ -d "runtimes/.$d/agents" ]; then
echo " .$d/agents: $(find "runtimes/.$d/agents" -type f \( -name '*.md' -o -name '*.toml' \) ! -name 'README.md' | wc -l | tr -d ' ') agent file(s)"
else
echo " .$d/agents: (none)"
fi
done
echo
echo "── .agents/ vendor-neutral root vs .claude/skills ──"
# .agents/skills is a LIVE runtime directly verified here for Codex.
# It mirrors .claude/skills - the implementation skills - NOT runtimes/.claude/skills,
# which holds the consumer examples. sync-skills.py deliberately does not cover it.
if [ -d .agents/skills ]; then
a=$(ls -d .claude/skills/*/ 2>/dev/null | xargs -n1 basename | sort)
b=$(ls -d .agents/skills/*/ 2>/dev/null | xargs -n1 basename | sort)
if [ "$a" = "$b" ]; then
echo " ✓ same skill set ($(echo "$a" | wc -l | tr -d ' ') skills)"
else
echo " ✗ skill sets differ:"
diff <(echo "$a") <(echo "$b") | sed 's/^/ /'
fi
# Bodies must match; frontmatter is expected to differ. Split only the first
# frontmatter block - later `---` horizontal rules are body content.
skill_body() {
python3 - "$1" <<'PY'
from pathlib import Path
import sys
text = Path(sys.argv[1]).read_text(encoding="utf-8")
if text.startswith("---\n") and "\n---\n" in text[4:]:
print(text.split("\n---\n", 1)[1], end="")
else:
print(text, end="")
PY
}
drift=0
for d in .claude/skills/*/; do
s=$(basename "$d"); f1="$d/SKILL.md"; f2=".agents/skills/$s/SKILL.md"
[ -f "$f1" ] && [ -f "$f2" ] || continue
if ! diff -q <(skill_body "$f1") <(skill_body "$f2") >/dev/null; then
echo " ✗ body drift: $s"; drift=1
fi
done
[ $drift -eq 0 ] && echo " ✓ bodies identical (frontmatter differs by design)"
else
echo " ✗ .agents/skills missing - Codex and other non-Claude CLIs will find no skills in this repo"
fi
echo
echo "── MCP single-source coverage ──"
if [ -f "runtimes/mcp/servers.yaml" ]; then
echo "Source of truth: runtimes/mcp/servers.yaml"
for vendor_config in \
runtimes/.claude/mcp.template.json \
runtimes/.codex/config.template.toml \
runtimes/.gemini/settings.template.json \
runtimes/.kiro/settings/mcp.template.json \
runtimes/.cursor/mcp.template.json \
runtimes/.devin/config.template.json; do
if [ -f "$vendor_config" ]; then
echo " ✓ $vendor_config exists (re-run its renderer to verify drift vs servers.yaml)"
else
echo " ✗ $vendor_config missing"
fi
done
echo
echo " renderers:"
for v in claude codex gemini kiro cursor devin; do
if [ -f "runtimes/mcp/render/render_$v.py" ]; then
echo " ✓ render_$v.py"
else
echo " ✗ render_$v.py missing"
fi
done
echo
echo " note: Devin Local installs the rendered project config at \`.devin/config.json\`."
echo " Cascade's user-level compatibility config is a separate product surface, not another renderer."
else
echo " (runtimes/mcp/servers.yaml missing - single source not yet established)"
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 114 lines · 28 tokens per session scan C 10857e4fccfe
parity is a command published in the GitHub repository Enovatr-Labs/SpecRoute (3 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 28 tokens to every session and 1,430 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
sdd-apply
Implement SDD tasks — writes code following specs and design.
sdd-init
Initialize SDD context — detects project stack and bootstraps persistence backend.
icpg-bootstrap
Infer ReasonNodes from existing git commit history. One-time setup for existing codebases.
atomic-plan
Write a design doc (concepts, business rules, approaches) and a checkpoint-table spec (contract) for non-trivial work; inline spec only for trivial. Gauges triviality; loops spec authoring with subagents. Human-facing artifact, Mermaid diagrams allowed.
review-branch
Review the current branch's diff against base by dispatching atomic-reviewer. No orchestration loop, no spec required — pre-flight before /commit pr or /commit merge.
session-report
Capture what changed this session and why, scoped to the current branch. Read by ship verbs when synthesizing the commit message; deleted after a successful commit.