Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/everyone-needs-a-copilot/claude-copilot/setup-projectgit clone --depth 1 https://github.com/Everyone-Needs-A-Copilot/claude-copilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/everyone-needs-a-copilot/claude-copilot/setup-project)<a href="https://agentmods.dev/commands/everyone-needs-a-copilot/claude-copilot/setup-project"><img src="https://agentmods.dev/badge/commands/everyone-needs-a-copilot/claude-copilot/setup-project.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01452 |
| Opus 5 | $0.00000 | $0.00726 |
| Sonnet 5 | $0.00000 | $0.00290 |
| Haiku 4.5 | $0.00000 | $0.00145 |
Grade B, and why
setup-project scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 "$REQUEST_FILE" "$CC_PATH_FILE" How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Project
Set up the current project with the complete Claude + Codex Copilot reference
installation. This command is a human-facing adapter over the canonical cc
transaction; it does not copy, delete, merge, or generate framework files
itself.
The canonical transaction installs .claude/hooks/copilot-hook.sh, marks it executable, registers the supported Claude hook events, and records the shim as a framework-owned file in copilot.lock.json. Independent verification must reject an installation whose shim is missing, non-executable, unregistered, or absent from the lock; this command must never replace that transaction with a manual copy.
The former partial minimal / quick start profile is retired. It could not
produce the declared reference state and created a second repair path. If the
user asks for that profile, explain that setup now installs the complete local
reference while preserving existing memory and project-authored files, then
ask whether to continue. A decline stops without mutation. An existing minimal
installation is treated as degraded input and repaired through this same
transaction.
0. Verify the local CLI prerequisites
The cc-owned prerequisite fact must report both Copilot CLIs ready. It rejects
macOS' unrelated C compiler even when it is named cc, and names machine setup
as the person's recovery when either cc or tc is unavailable. Do not plan
or mutate on a failed prerequisite report.
1. Build and inspect the exact plan
Run this from the project root. The helper only creates a temporary request; planning is read-only and the request is removed when the shell exits.
set -eu
CC_BIN=""
for CANDIDATE in "$(command -v cc 2>/dev/null || true)" "$HOME/.local/bin/cc"; do
if [ -n "$CANDIDATE" ] && [ -x "$CANDIDATE" ] && "$CANDIDATE" --version 2>/dev/null | grep -q '^cc version'; then
CC_BIN="$CANDIDATE"
break
fi
done
if [ -z "$CC_BIN" ] || ! command -v tc >/dev/null 2>&1; then
echo "Claude Copilot machine setup is required: the Copilot cc and tc CLIs must both be available. Open ~/.claude/copilot, run /setup, open a fresh shell, then retry." >&2
exit 3
fi
PROJECT_ROOT="$(git rev-parse --show-toplevel)"
REQUEST_FILE="$(mktemp -t cc-project-request.XXXXXX)"
CC_PATH_FILE="$(mktemp -t cc-project-cli.XXXXXX)"
trap 'rm -f "$REQUEST_FILE" "$CC_PATH_FILE"' EXIT
chmod 600 "$REQUEST_FILE" "$CC_PATH_FILE"
python3 - "$PROJECT_ROOT" "$REQUEST_FILE" "$CC_PATH_FILE" <<'PY'
import json
import sys
from pathlib import Path
from cc.core.ecosystem.canonical_transaction import (
canonical_project_request_json,
inspect_canonical_prerequisites,
)
prerequisites = inspect_canonical_prerequisites()
if not prerequisites["ready"]:
print(json.dumps(prerequisites, sort_keys=True), file=sys.stderr)
raise SystemExit(3)
Path(sys.argv[3]).write_text(str(prerequisites["cc"]["path"]), encoding="utf-8")
Path(sys.argv[2]).write_text(canonical_project_request_json(sys.argv[1]), encoding="utf-8")
PY
CC_BIN="$(cat "$CC_PATH_FILE")"
"$CC_BIN" reconcile plan --request "$REQUEST_FILE" --json
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 130 lines · 0 tokens per session scan B 6f402a36511e
setup-project is a command published in the GitHub repository Everyone-Needs-A-Copilot/claude-copilot (13 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,452 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other commands, from other repositories
go
You are the Project Kickstart agent. Your job is simple: find PRDs, validate them, and execute the full implementation pipeline.
analytics
/analytics Show full analytics dashboard /analytics top Top 10 most-used agents /analytics failures Show agents with highest failure rates /analytics timeline Show invocation timeline (last 7 days) /analytics agent Show stats for a specific agent /analytics trends Show improving vs degrading agents over time…
explain
/explain Explain the last agent action (quick mode) /explain --verbose Full trace with file changes and decision rationale /explain --story STORY-XXX All actions for a story in chronological order /explain --agent Last action by a specific agent /explain --session All actions from a specific session /explain --diff…
feature
Role: Per-feature quality pipeline that takes a story or feature description from zero to a committed, documented, tested, and evaluated implementation. No stage is skipped. No commit happens without the evaluator's approval.
security-scanner
Security scanner specialized in detecting AI-generated code vulnerabilities using comprehensive anti-pattern databases. You are methodical, thorough, and uncompromising -- every vulnerability is documented, traced, and given a concrete fix.
swarm
You are the Swarm Coordination Manager: a disciplined parallel execution engine that decomposes work into independent units, dispatches them to isolated workers, monitors progress, detects conflicts, and aggregates results into a coherent whole. You turn serial bottlenecks into parallel throughput — safely.