Borrowing it
Nothing to install: this file belongs to julianobarbosa/azure-finops-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/julianobarbosa/azure-finops-mcp-server/main/.claude/commands/BMad/tasks/qa-gate.mdgit clone --depth 1 https://github.com/julianobarbosa/azure-finops-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/julianobarbosa/azure-finops-mcp-server/qa-gate)<a href="https://agentmods.dev/commands/julianobarbosa/azure-finops-mcp-server/qa-gate"><img src="https://agentmods.dev/badge/commands/julianobarbosa/azure-finops-mcp-server/qa-gate/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/julianobarbosa/azure-finops-mcp-server/qa-gate"><img src="https://agentmods.dev/badge/commands/julianobarbosa/azure-finops-mcp-server/qa-gate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01013 |
| Opus 5 | $0.00000 | $0.00507 |
| Sonnet 5 | $0.00000 | $0.00203 |
| Haiku 4.5 | $0.00000 | $0.00101 |
Grade A, and why
qa-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to qa-gate — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/qa-gate Task
When this command is used, execute the following task:
qa-gate
Create or update a quality gate decision file for a story based on review findings.
Purpose
Generate a standalone quality gate file that provides a clear pass/fail decision with actionable feedback. This gate serves as an advisory checkpoint for teams to understand quality status.
Prerequisites
- Story has been reviewed (manually or via review-story task)
- Review findings are available
- Understanding of story requirements and implementation
Gate File Location
ALWAYS check the bmad-core/core-config.yaml for the qa.qaLocation/gates
Slug rules:
- Convert to lowercase
- Replace spaces with hyphens
- Strip punctuation
- Example: "User Auth - Login!" becomes "user-auth-login"
Minimal Required Schema
schema: 1
story: '{epic}.{story}'
gate: PASS|CONCERNS|FAIL|WAIVED
status_reason: '1-2 sentence explanation of gate decision'
reviewer: 'Quinn'
updated: '{ISO-8601 timestamp}'
top_issues: [] # Empty array if no issues
waiver: { active: false } # Only set active: true if WAIVED
Schema with Issues
schema: 1
story: '1.3'
gate: CONCERNS
status_reason: 'Missing rate limiting on auth endpoints poses security risk.'
reviewer: 'Quinn'
updated: '2025-01-12T10:15:00Z'
top_issues:
- id: 'SEC-001'
severity: high # ONLY: low|medium|high
finding: 'No rate limiting on login endpoint'
suggested_action: 'Add rate limiting middleware before production'
- id: 'TEST-001'
severity: medium
finding: 'No integration tests for auth flow'
suggested_action: 'Add integration test coverage'
waiver: { active: false }
Schema when Waived
schema: 1
story: '1.3'
gate: WAIVED
status_reason: 'Known issues accepted for MVP release.'
reviewer: 'Quinn'
updated: '2025-01-12T10:15:00Z'
top_issues:
- id: 'PERF-001'
severity: low
finding: 'Dashboard loads slowly with 1000+ items'
suggested_action: 'Implement pagination in next sprint'
waiver:
active: true
reason: 'MVP release - performance optimization deferred'
approved_by: 'Product Owner'
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 168 lines · 0 tokens per session scan A 9b713050c0ba
qa-gate is a command published in the GitHub repository julianobarbosa/azure-finops-mcp-server (2 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,013 tokens. A static security scan graded it A with 0 findings. It is 100% identical to qa-gate, differing in 0 lines, and is treated as a copy.
Other commands, from other repositories
sdd-init
Initialize SDD context — detects project stack and bootstraps persistence backend.
review-branch
Review the current branch's diff against base by dispatching atomic-reviewer. No orchestration loop, no spec required — pre-flight before /commit pr or /commit merge.
init
Install the formatters this repository needs, with every command visible before it runs.
repo-audit
Audit a codebase (local or remote GitHub/GitLab) against architecture principles and requirements, surfacing drift, risk, and missing decisions.
argos
A command for checking whether an implementation matches its design deliverables. Its Korean description compares the work to the design as part of a completion inspection.
security-review
AI-powered security review of the current git diff (or specified paths). Dispatches the security-reviewer agent and prints findings grouped by severity.