Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/hamza-ali-shahjahan/claudexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hamza-ali-shahjahan/claudex/demo)<a href="https://agentmods.dev/commands/hamza-ali-shahjahan/claudex/demo"><img src="https://agentmods.dev/badge/commands/hamza-ali-shahjahan/claudex/demo/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/hamza-ali-shahjahan/claudex/demo"><img src="https://agentmods.dev/badge/commands/hamza-ali-shahjahan/claudex/demo.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01019 |
| Opus 5.5 | $0.00009 | $0.00408 |
| Sonnet 5.5 | $0.00004 | $0.00204 |
| Haiku 4.5 | $0.00002 | $0.00102 |
Grade C, and why
demo scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
8. **Clean up.** Remove the throwaway directory (`rm -rf "$DEMO"` — it is a This is a copy
100% identical to demo — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are running the ClauDex demo — a safe, self-contained first experience of the duet. You will plant bugs, let both models review them independently, and reveal who caught what. Everything happens in a throwaway directory; the user's own files are never touched.
Sign-off contract: this is a real review, so the normal rules apply — end
with reviewed with love by ClauDex 🧡🖤 ONLY if Codex successfully delivered
its review; if the Codex call fails (after one retry), end unsigned with the
interruption message.
Preflight — it takes two to ClauDex
Run codex --version and check auth (codex login status or equivalent).
If either fails, STOP and reply with exactly:
It takes two to ClauDex. 🧡 Claude is here — 🖤 Codex is not, so there is no duet to demo. Fix it in two lines, then come back:
npm i -g @openai/codex codex login
(No git preflight — the demo brings its own repo.)
The demo
-
Set the stage. Create a throwaway workspace and repo:
DEMO=$(mktemp -d "${TMPDIR:-/tmp}/claudex-demo.XXXXXX") && git -C "$DEMO" init -q -
Plant the bugs. Write exactly this to
$DEMO/discount.js:// discount.js — apply coupon discounts to a shopping cart function applyDiscount(cart, coupon) { let total = 0; for (let i = 0; i <= cart.length; i++) { total += cart[i].price * cart[i].qty; } if (coupon.type == "percent") { total = total - (total * coupon.value) / 100; } else { total = total - coupon.value; } cart.forEach((item) => (item.discounted = true)); return "$" + total.toFixed(2); } module.exports = { applyDiscount };For your own reveal later, the planted issues are: (a) off-by-one
i <= cart.length— guaranteed crash; (b) no validation ofcoupon.value— negative totals, >100% discounts; (c) loose==comparison; (d) the function silently mutates the caller's cart; (e) floating-point money math. Do NOT tell either reviewer this list. -
Tell the user what's happening in two sentences: bugs are planted — some obvious, some subtle, one a pure judgment call — and the two models will now review the same file independently.
-
Claude's review (yours). Review
discount.jsand write down your findings BEFORE consulting Codex. -
Codex's review. With a hard timeout of ~10 minutes:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 93 lines · 22 tokens per session scan C 3a04bf1c1930
demo is a command published in the GitHub repository hamza-ali-shahjahan/claudex (4 stars, last pushed 2mo ago), licensed MIT. It adds 22 tokens to every session and 1,019 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). It is 100% identical to demo, differing in 0 lines, and is treated as a copy.
Other commands, from other repositories
crystallize
After a session or an incident, turn what happened into reusable knowledge — learn captures this session's lessons, review/approve promotes incident patterns into agent improvements, skill turns a repeating procedure into a skill.
debug
Systematic debugging: root cause before any fix, one hypothesis at a time, and a three-strikes rule that questions the architecture instead of stacking patches.
recover
Diagnose and recover from interrupted or corrupted state.
analyze-misfires
Identify skills injected where not needed, propose regex and description tightening.
bugfix
TDD-driven bugfix workflow: tester writes failing test (RED) → developer fixes (GREEN) → developer refactors (REFACTOR) → reviewer validates. Accepts issue number, description, or both. Asks before pushing and creating a PR; --no-pr commits locally without asking.
dead-code-scan
Scan for dead code, unused imports, duplicates, and zombie code across the project.