Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/jayminwest/mulch/releasegit clone --depth 1 https://github.com/jayminwest/mulchWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00001 | $0.00958 |
| Opus 5 | $0.00000 | $0.00479 |
| Sonnet 5 | $0.00000 | $0.00192 |
| Haiku 4.5 | $0.00000 | $0.00096 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
intro
Prepare a release by updating docs and bumping the version.
User specified: $ARGUMENTS
Steps
1. Analyze changes since last release
- Run
git log --onelineto find the last version tag/release commit - Run
git diff --stat <last-release>..HEADto see all changed files - Read the commit messages to understand what was added, fixed, and changed
- Run
npm testto get the current test count, file count, and expect() count
2. Determine version bump
- If the user specified
major,minor, orpatchabove, use that - Default:
patchif nothing was specified - Current version is in
package.json("version"field) andsrc/cli.ts(.version()call)
3. Bump version
Run: bun run version:bump <major|minor|patch>
This atomically updates both package.json and src/cli.ts.
4. Update CHANGELOG.md
- Add a new
## [X.Y.Z] - YYYY-MM-DDsection under## [Unreleased] - Categorize changes into
### Added,### Fixed,### Changedsubsections - Use sub-headers (####) for grouping related changes (e.g., "New CLI Commands", "Testing")
- Include updated test counts (tests, files, expect() calls)
- Update the comparison links at the bottom of the file:
[Unreleased]link should compare against the new version- Add a new link for the new version comparing against the previous
5. Update CLAUDE.md
- Update command counts if new commands were added
- Add new files to the directory structure listing
- Update any descriptions that changed (e.g., file format migrations)
- Keep the structure consistent with existing entries
6. Update README.md
- Update test counts in the Tech Stack and Development sections
- Update command counts in the Project Structure section
- Add new CLI commands/flags to the CLI Reference section
- Update architecture descriptions if features changed
- Add new files to the Project Structure listing
7. Update CONFIG.md
CONFIG.md is the user-facing reference for every configuration surface Mulch exposes (the .mulch/mulch.config.yaml schema, hooks, custom types, decay, recipes, CLI flags). Releases that touch any of these MUST update it; if nothing relevant changed, say so explicitly in the summary so it's a deliberate choice, not an oversight.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 90 lines · 1 tokens per session scan A 3ab22b983bdf
release is a command published in the GitHub repository jayminwest/mulch (333 stars, last pushed 21d ago), licensed MIT. It adds 1 tokens to every session and 958 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
deploy_to_docker
Build Docker image and start/redeploy the MCP Task Orchestrator container, reusing the last-used config by default.
check_schema_version
Check the Flyway schema version of the SQLite database on a Docker volume.
graph
Generate an interactive visual graph of your memories. Powered by graphify (github.com/safishamsi/graphify, MIT).
dejavu-memory
Lightweight memory primitives — record-version (v0.8.4) + backfill-gists (v0.8.6).
dejavu-session-copy
Manage the restic-backed session-copy subsystem (v0.8.0).
dejavu-jit-recall-preview
Preview what the UserPromptSubmit JIT recall hook would inject for a given prompt (v0.8.5).