Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/gnayj/claude-code-sop/sop-flowgit clone --depth 1 https://github.com/Gnayj/claude-code-sopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/gnayj/claude-code-sop/sop-flow)<a href="https://agentmods.dev/commands/gnayj/claude-code-sop/sop-flow"><img src="https://agentmods.dev/badge/commands/gnayj/claude-code-sop/sop-flow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00015 | $0.01111 |
| Opus 5 | $0.00008 | $0.00556 |
| Sonnet 5 | $0.00003 | $0.00222 |
| Haiku 4.5 | $0.00002 | $0.00111 |
Grade A, and why
sop-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/sop-flow — inspect or switch the Claude-driven collaboration flow
Work in ${CLAUDE_PROJECT_DIR}. This command is a thin UX wrapper over the
ccsop_configure machine contract. It never edits .codex-review/config.toml itself and has no
shell/manual-edit fallback.
Step 0 — guards
If ${CLAUDE_PLUGIN_ROOT}/.orphaned_at exists, abort and ask the user to restart the session or
reload plugins. If .codex-review/config.toml is missing, ask them to run /sop-init.
Discover ccsop_configure. If it is missing, from an older bundle, or not registered in this
session, make zero writes and say:
ccsop_configure is unavailable. Run /mcp and reconnect/restart the ccsop review bridge, then retry.
No config was changed.
Do not suggest direct TOML edits or a shell fallback.
Step 1 — handshake and status
Call ccsop_configure with action=status. Require contract_version=2; accept
observed_schema=1|2 for Phase 1 flow actions.
observed_schema=null: make zero writes and ask the user to run/sop-update, which performs the server-fixedstamp-schema-v1migration.- any schema other than
1|2, or any contract other than2: fail loud, show the observed and supported values, make zero writes, and ask for a compatible ccsop update.
Use the returned owners, implement gate, tiers, and config sha as the only state snapshot. The flow contract and reviewer derivation live in the shipped control-surface contract, not in this prose wrapper. Status is read-only.
If status returns config_valid=false, show its validation_error and raw owner values. An
explicit legal set may repair invalid collaboration.design_owner / implement_owner values:
the server publishes only when the resulting whole config passes TOML+Zod validation. If an
unrelated invalid field remains (or TOML cannot be inspected), the server rejects with zero
writes. Report the exact field and recover via /sop-update where supported or a verified
.ccsop/backups/config/<sha256>.toml preimage; this command still never edits TOML itself.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 107 lines · 15 tokens per session scan A 513638fe9551
sop-flow is a command published in the GitHub repository Gnayj/claude-code-sop (2 stars, last pushed 22d ago), licensed MIT. It adds 15 tokens to every session and 1,111 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
git
Git operations with intelligent commit messages and workflow optimization.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.
specify
Create or update the feature specification from a natural language feature description.
analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
converge
Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.