Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/mendixlabs/mxcli/lintgit clone --depth 1 https://github.com/mendixlabs/mxcliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00012 | $0.01385 |
| Opus 5 | $0.00006 | $0.00692 |
| Sonnet 5 | $0.00002 | $0.00277 |
| Haiku 4.5 | $0.00001 | $0.00138 |
Grade A, and why
lint scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lint Project
Check a Mendix project for common issues like naming convention violations, security gaps, and best practice deviations.
Commands
# Basic lint
mxcli lint -p app.mpr
# With colored output
mxcli lint -p app.mpr --color
# JSON output
mxcli lint -p app.mpr --format json
# SARIF output (for CI/GitHub)
mxcli lint -p app.mpr --format sarif > results.sarif
# List available rules
mxcli lint -p app.mpr --list-rules
# Exclude modules
mxcli lint -p app.mpr --exclude System --exclude Administration
Built-in Go Rules
| Rule | Category | Description |
|---|---|---|
| MPR001 | naming | NamingConvention - PascalCase with 21 microflow prefixes (ACT_, SUB_, DS_, VAL_, SCH_, IVK_, BCO_, ACO_, etc.) |
| MPR002 | quality | EmptyMicroflow - Microflows should have at least one activity |
| MPR003 | design | DomainModelSize - Max persistent entities per domain model |
| MPR004 | quality | ValidationFeedback - Validation feedback with empty message |
| MPR005 | quality | ImageSource - IMAGE widgets with no source configured |
| MPR006 | quality | EmptyContainer - Empty layout containers |
| MPR007 | security | PageNavigationSecurity - Navigation pages need allowed roles (CE0557) |
| SEC001 | security | NoEntityAccessRules - Persistent entities need access rules |
| SEC002 | security | WeakPasswordPolicy - Password minimum length should be 8+ |
| SEC003 | security | DemoUsersActive - Demo users should be off at Production security |
| CONV011 | performance | NoCommitInLoop - Commit actions inside loops cause N+1 issues |
| CONV012 | quality | ExclusiveSplitCaption - Exclusive splits need meaningful captions |
| CONV013 | quality | ErrorHandlingOnCalls - External calls (REST/WS/Java) need custom error handling |
| CONV014 | quality | NoContinueErrorHandling - Don't silently swallow errors with Continue |
Bundled Starlark Rules
These are loaded automatically from .claude/lint-rules/:
| Rule | Category | Description |
|---|---|---|
| SEC004 | security | GuestAccessEnabled - Review anonymous user entity access |
| SEC005 | security | StrictModeDisabled - XPath constraint enforcement off |
| SEC006 | security | PIIAttributesExposed - PII-sounding attributes need access rules |
| SEC007 | security | UnconstrainedAnonymousEntityRead - DIVD-2022-00019 detection |
| SEC008 | security | PIIUnconstrainedRead - PII entities readable without row scoping |
| SEC009 | security | MissingMemberRestriction - Large entities without attribute-level access |
| ARCH001 | architecture | CrossModuleDataAccess - Pages should use same-module entities |
| ARCH002 | architecture | DataChangesThroughMicroflows - Enforce microflow-based writes |
| ARCH003 | architecture | EntityBusinessKey - Persistent entities need a unique key |
| QUAL001 | quality | McCabeComplexity - Microflow cyclomatic complexity threshold |
| QUAL002 | quality | MissingDocumentation - Entities/microflows need documentation |
| QUAL003 | quality | LongMicroflows - Microflows with >25 activities |
| QUAL004 | quality | OrphanedElements - Unreferenced elements in the project |
| DESIGN001 | design | EntityAttributeCount - Entities with too many attributes |
| CONV001 | naming | BooleanNaming - Boolean attributes start with Is/Has/Can/Should/Was/Will |
| CONV002 | naming | NoEntityDefaultValues - Avoid attribute defaults, use microflows |
| CONV003 | naming | PageNamingSuffix - Pages end with _NewEdit/_View/_Overview/etc. |
| CONV004 | naming | EnumerationPrefix - Enumerations start with ENUM_ |
| CONV005 | naming | SnippetPrefix - Snippets start with SNIPPET_ |
| CONV006 | security | NoCreateDeleteRights - Use microflows for create/delete |
| CONV007 | security | XPathOnAllAccess - Entity access should have XPath constraints |
| CONV008 | security | ModuleRoleMapping - Each module role maps to one user role |
| CONV009 | quality | MaxMicroflowObjects - Microflows should have <= 15 activities |
| CONV010 | architecture | ACTMicroflowContent - ACT_ microflows should only have UI actions |
| CONV015 | quality | NoEntityValidationRules - Use VAL_ microflows instead |
| CONV016 | performance | NoEventHandlers - Use explicit microflow calls instead |
| CONV017 | performance | NoCalculatedAttributes - Use stored attributes updated by microflows |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 135 lines · 12 tokens per session scan A 69fd3254c8d2
lint is a command published in the GitHub repository mendixlabs/mxcli (115 stars, last pushed 2d ago), licensed Apache-2.0. It adds 12 tokens to every session and 1,385 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
MIGRATE_DESIGN
Design doc for the migration tool PR. Author: Sol ([email protected]). Co-authored-by: wakesync.
plan
Create a structured task-by-task implementation plan for a feature and write it to docs/superpowers/plans/.
toh-help
Display all Toh Framework commands and quick usage guide.
specsmd-construction-agent
Command "specsmd-construction-agent" from fabriqaai/specs.md, covering activate construction agent, activation, parameters, critical first steps and your skills.
fire
FIRE orchestrator - Fast Intent-Run Engineering main entry point.
issue-resolve
Drive an assessed gflow-cli issue (verdict CONFIRMED-BUG or LIKELY-BUG, with localized verifiable scope) to a fix: isolated worktree off develop, test-first fix, /gflow:check, then a DRAFT PR for human review. Mutating and gated — runs inside a strict action envelope (never merges, never spends credits, never marks a…