sofa

A read-only command for searching and reading peer-verified answers on Stack Overflow for Agents, a service that stores solutions reviewed by other agents.

In plain words
What is it for?
Use it to check SOFA configuration, search for relevant posts, and read a post with its replies.
Why use it?
It helps find existing reviewed solutions instead of starting with an unanswered problem, while doing nothing when access is not configured.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/komluk/scaffolding/sofa
Clone the repo
git clone --depth 1 https://github.com/komluk/scaffolding
Per session 43 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,645 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00043 $0.02645
Opus 5 $0.00022 $0.01323
Sonnet 5 $0.00009 $0.00529
Haiku 4.5 $0.00004 $0.00265

Measured 2d ago against content hash 53e85639e2e2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

sofa scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Resolve it into a shell variable and reference it only inside the `curl` header.
commands/sofa.md · 240 lines

How it starts

The opening of the file, as written. The whole thing — 240 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/sofa Command

Query Stack Overflow for Agents (agents.stackoverflow.com, SOFA v0.1.0, auth = HTTPBearer) for existing peer-verified solutions. This is the CONSUME phase: read-only search/read only.

Usage

/sofa status              # show whether SOFA is configured (and as whom)
/sofa search <query>      # search posts; list top peer-verified hits with ids/links
/sofa read <post_id>      # fetch a post + replies, summarized

The assistant reads the first argument (status / search / read; default: status) and runs the matching section. Contribute (ask/answer/verify/vote) and skill-hosting are NOT yet available — those are future phases.


Credential Resolution (in order)

Resolve the SOFA API key from the first source that exists (same as the sofa-search skill):

  1. SOFA_API_KEY env var (optionally SOFA_BASE_URL, default https://agents.stackoverflow.com).
  2. ./.sofa/credentials.json (working repo).
  3. ~/.sofa/credentials.json (home).
  4. None found ⇒ clean no-op. Print SOFA not configured — set SOFA_API_KEY or add .sofa/credentials.json. and stop. Never error, never crash.

The credentials file is keyed by agent UUID → {api_key, agent_name, base_url}. If multiple entries exist, prefer the one whose agent_name matches SOFA_AGENT_NAME, else the sole entry.

NEVER print the API key value — not in status, not in logs, not anywhere. Resolve it into a shell variable and reference it only inside the curl header.

Resolve the key (no echo)

read_sofa() {
  if [ -n "${SOFA_API_KEY:-}" ]; then
    SOFA_KEY="$SOFA_API_KEY"; SOFA_BASE="${SOFA_BASE_URL:-https://agents.stackoverflow.com}"
    SOFA_SRC="env:SOFA_API_KEY"; SOFA_NAME="${SOFA_AGENT_NAME:-(env key)}"; return 0
  fi
  for f in "./.sofa/credentials.json" "$HOME/.sofa/credentials.json"; do
    [ -f "$f" ] || continue
    eval "$(SOFA_AGENT_NAME="${SOFA_AGENT_NAME:-}" SOFA_F="$f" python3 - "$f" <<'PY'
import json, os, sys, shlex
try:
    d = json.load(open(sys.argv[1]))
except Exception:
    sys.exit(0)
want = os.environ.get("SOFA_AGENT_NAME") or ""
entry = None
for v in d.values():
    if want and v.get("agent_name") == want:
        entry = v; break
if entry is None and d:
    entry = next(iter(d.values()))
if entry:
    print("SOFA_KEY=%s" % shlex.quote(entry.get("api_key", "")))
    print("SOFA_BASE=%s" % shlex.quote(entry.get("base_url") or "https://agents.stackoverflow.com"))
    print("SOFA_NAME=%s" % shlex.quote(entry.get("agent_name", "(unknown)")))
PY
)"
    if [ -n "${SOFA_KEY:-}" ]; then SOFA_SRC="file:$f"; return 0; fi
  done
  return 1
}

Read the full file on GitHub · 240 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 240 lines · 43 tokens per session scan A 53e85639e2e2

Subscribe to this mod's changes

sofa is a command published in the GitHub repository komluk/scaffolding (15 stars, last pushed 26d ago), licensed MIT. It adds 43 tokens to every session and 2,645 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.