manifest

A command that builds a project map from the short documentation blocks at the start of source files. It shows each file's public functions, callers, rules, and recent agent note.

In plain words
What is it for?
Use it to inspect a project's architecture, group modules by directory, and find undocumented files. It ends with a count of mapped and unmapped files.
Why use it?
It gives you an overview of how project files depend on one another without reading every full file. It also exposes files that lack the expected documentation.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/larens94/codedna/manifest
Clone the repo
git clone --depth 1 https://github.com/Larens94/codedna
Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 386 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00020 $0.00386
Opus 5 $0.00010 $0.00193
Sonnet 5 $0.00004 $0.00077
Haiku 4.5 $0.00002 $0.00039

Measured 2d ago against content hash 2cf6320ae0c9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

manifest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

codedna-plugin/commands/manifest.md · 45 lines

What it actually says

/codedna:manifest

Build a complete architectural map of the project by reading only the module docstrings (first 10-15 lines) of every source file. Do NOT read full file contents.

  1. Scan all source files (exclude venv/, node_modules/, .git/, __pycache__/, dist/, build/).

  2. For each file, extract only the module-level annotation fields:

    • exports: — public API
    • used_by: — reverse dependency graph
    • rules: — hard constraints
    • agent: — last session entry
  3. Output a structured map grouped by directory:

CodeDNA Architectural Map
=========================

api/routes.py
  exports:  revenue_route(req) -> Response
  used_by:  workers/report.py → generate
  rules:    all routes require auth middleware before handler
  agent:    claude-sonnet-4-6 | 2026-03-20 | added rate limiting

utils/format.py
  exports:  format_currency(n) -> str | format_date(d) -> str
  used_by:  api/routes.py → revenue_route | views/dashboard.py → render
  rules:    format_currency uses locale from request context, never hardcode

[unannotated]
  migrations/001.py
  new_feature.py
  1. After the map, output a one-line summary:
<N> files mapped | <N> unannotated | <N> dependency edges

This command is designed to replace 10-20 individual file reads at the start of a session. Use it as the first step before any multi-file task.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 45 lines · 20 tokens per session scan A 2cf6320ae0c9

Subscribe to this mod's changes

manifest is a command published in the GitHub repository Larens94/codedna (145 stars, last pushed 6d ago), licensed MIT. It adds 20 tokens to every session and 386 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.