Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/intellegix/intellegix-code-agent-toolkitnpx agentmods add commands/intellegix/intellegix-code-agent-toolkit/health-checkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/intellegix/intellegix-code-agent-toolkit/health-check)<a href="https://agentmods.dev/commands/intellegix/intellegix-code-agent-toolkit/health-check"><img src="https://agentmods.dev/badge/commands/intellegix/intellegix-code-agent-toolkit/health-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/intellegix/intellegix-code-agent-toolkit/health-check"><img src="https://agentmods.dev/badge/commands/intellegix/intellegix-code-agent-toolkit/health-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.08126 |
| Opus 5.5 | $0.00000 | $0.03250 |
| Sonnet 5.5 | $0.00000 | $0.01625 |
| Haiku 4.5 | $0.00000 | $0.00813 |
Grade A, and why
health-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 567 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/health-check — Read-Only 3-Layer Production Health Check
Perform a comprehensive, read-only end-to-end review of any portfolio app across three layers — Frontend (E2E), Database integrity, and Audit Log & User Activity — and produce a structured, observations-only report. Optionally, on explicit opt-in, generate (never apply) the infrastructure provisions needed so future health-checks are possible.
Architecture: P0 (Target & Safety Gate, one confirmation) → P1 (Frontend E2E, read-only,
request-capped) → P2 (Database integrity via hc_db.py) → P3 (Audit log & user activity) →
P4 (Report). Then, only with --provision: a separate plan-mode path that writes a local
provision.sql for manual review.
TRUST CONTRACT — READ FIRST. The default run is 100% read-only. It never mutates production. Every database query flows through
hc_db.py, the single code-enforced read-only boundary (SQLite openedmode=ro; Postgres runs every query inside a server-enforcedREAD ONLYtransaction and hard-refuses if it cannot establish one). The frontend layer only navigates — it never submits a form, clicks a destructive control, or logs in as a real user. The--provisionpath is the ONLY thing that produces change, and even then it merely writes a local.sqlfile for you to review and apply manually — it never connects to a database and never auto-applies anything.
Cost: Free — local tools + browser-bridge MCP + optional Perplexity login session. No API keys required.
Guiding principle: health check, not a sprint. Full visibility and peace of mind — not change.
Input
$ARGUMENTS = <repo-path-or-app-name> [flags]
| Flag | Description | Default |
|---|---|---|
--provision |
Opt-in: enter plan mode and generate a local provision.sql (read-only role + audit_log table as needed). Never applies it. |
off |
--deep |
Exact row counts (--exact) + full sequential scans instead of approximate pg_stat estimates. Recommend off-peak — heavier DB load. |
off (approximate) |
--skip-frontend |
Skip P1 (frontend E2E). | run |
--skip-db |
Skip P2 (database integrity). | run |
--skip-audit |
Skip P3 (audit log & user activity). | run |
--sentinel |
Force the Sentinel cross-reference in P3 (otherwise auto-detected). | auto-detect |
--url <override> |
Override the auto-detected deployed/prod URL. | auto-detect |
--db <override> |
Override the auto-detected DATABASE_URL. |
auto-detect |
--off-peak-ack |
Acknowledge that you are knowingly running against the busy app now (skips the off-peak nag for the PO system). | off |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 567 lines · 0 tokens per session scan A 0488c784fef5
health-check is a command published in the GitHub repository intellegix/intellegix-code-agent-toolkit (57 stars, last pushed 6d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 8,126 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
qa-sweep
Full platform QA sweep — auto-discovers every page, tests every UI element via browser automation, creates GitHub issues for all findings.
qa-automation
Set up a comprehensive test automation strategy.
qa-e2e
End-to-End tests with Playwright or Cypress.
tester
Comprehensive testing with parallel execution capabilities.
e2e
Generate and run E2E tests with Playwright.
test-browser
Run browser tests on pages affected by current PR or branch.