Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jonase47/ccprWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/jonase47/ccpr/p0-regulatory)<a href="https://agentmods.dev/commands/jonase47/ccpr/p0-regulatory"><img src="https://agentmods.dev/badge/commands/jonase47/ccpr/p0-regulatory/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/jonase47/ccpr/p0-regulatory"><img src="https://agentmods.dev/badge/commands/jonase47/ccpr/p0-regulatory.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01152 |
| Opus 5.5 | $0.00000 | $0.00461 |
| Sonnet 5.5 | $0.00000 | $0.00230 |
| Haiku 4.5 | $0.00000 | $0.00115 |
Grade A, and why
p0-regulatory scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/p0-regulatory – Regulatory & Legal Knock-Out Criteria
Identifies regulatory requirements, DSGVO (GDPR) obligations, and legal knock-out criteria early on, before significant time is invested in the idea. A regulatory showstopper should be recognised as early as possible.
Argument: $ARGUMENTS = [Area, e.g. "health data", "financial services", "children's app"]
If provided: Use as the focus for the regulatory check. If not provided: Read DISCOVERY.md to understand the context (Target Audience, data, industry). If context is missing, ask for the relevant area.
Execution
1. Read Context
Read docs/discovery/DISCOVERY.md (phase index), docs/discovery/PROBLEM.md (problem statement, Target Audience), and docs/discovery/MARKET.md (market context) to understand which regulatory areas are relevant.
2. Delegate to security-master Agent (Lead)
Delegate the regulatory analysis to the security-master agent:
Conduct a first regulatory assessment for the following area: $ARGUMENTS Context from PROBLEM.md and MARKET.md: [Insert problem statement, Target Audience, industry]
Check and evaluate:
- DSGVO Relevance: What personal data is processed? Which articles apply (Art. 6, Art. 9, Art. 13/14)?
- Sector-Specific Regulation: Are there specific laws or regulations (e.g. MDR for medical devices, DiGA, FINMA, GwG)?
- Licences and Certifications: Are permits required?
- Knock-Out Criteria: What could legally stop or massively delay the project?
- Assessment: 🟢 No significant hurdles / 🟡 Hurdles, but surmountable / 🔴 Critical knock-out criterion
Be concrete and practical. Cite relevant laws/regulations.
3. Delegate to konzeptor Agent (Support)
Delegate the classification in the project context to the konzeptor agent:
Evaluate the regulatory findings of the security-master: Are the identified hurdles acceptable? What impact do they have on the Concept (scope, timeline, costs)?
4. Write Detail File
Write the result to docs/discovery/REGULATORY.md (overwrite if it exists). Start with this YAML frontmatter:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 201fc5de29aa
- 1mo ago Changed · +3 lines 5c5ecdaa3095
- 1mo ago First seen · 82 lines · 0 tokens per session scan A 1b09beec7059
p0-regulatory is a command published in the GitHub repository jonase47/ccpr (1 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,152 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
deps-audit
Audit project dependencies for vulnerabilities, outdated packages, license conflicts, and supply chain risks — then provide actionable remediation strategies.
scope
Mandatory pre-flight scope check — verify an asset is in scope BEFORE any HTTP touch. Deterministic (deny-wins, default-deny) via engine/scope.py against the engagement's scope.md. Blocks out-of-scope testing. Usage: /scope [ ...].
stats
Show real token usage, delegation rate, and actual savings for the current Hydra session (parses Claude Code session JSONL — no AI estimation).
debug
Systematic debugging with automated investigation and 4-phase methodology. Default: inline evidence gathering and diagnosis. --deep: spawns systematic-debugger agent for full autonomous debugging. Use for errors, stack traces, test failures, or unexpected behavior.
forge-compact-task
Compact context with dotforge-standardized hint that preserves decisions, files modified, pending TODOs, behaviors disabled, and last commit. Use at 80% context window instead of waiting for auto-compact.
golden-path
The golden path. One command, idea to merged PR. Runs the full pipeline, prd → prp → plan → dev → test → pr, with sensor + eval gates at every stage.