Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/rjmurillo/ai-agents/shipgit clone --depth 1 https://github.com/rjmurillo/ai-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/rjmurillo/ai-agents/ship)<a href="https://agentmods.dev/commands/rjmurillo/ai-agents/ship"><img src="https://agentmods.dev/badge/commands/rjmurillo/ai-agents/ship.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.03154 |
| Opus 5 | $0.00010 | $0.01577 |
| Sonnet 5 | $0.00004 | $0.00631 |
| Haiku 4.5 | $0.00002 | $0.00315 |
Grade A, and why
ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
@CLAUDE.md
Ship: $ARGUMENTS
Default target is main unless specified. If $ARGUMENTS names a different branch, use that as the target.
Mode Detection
Run this block BEFORE the pre-flight checks. It sets two variables, host and mode, that branch every step below. State the detected host and mode in the ship report.
1. VCS host detection
Derive the host from the origin remote URL:
remote_url="$(git remote get-url origin 2>/dev/null || true)"
if [ -z "$remote_url" ]; then
echo "ERROR: origin remote is not configured; cannot detect VCS host." >&2
exit 2
fi
case "$remote_url" in
*dev.azure.com*|*visualstudio.com*) host=ado ;;
*) host=github ;;
esac
redacted_remote_url="$(printf '%s' "$remote_url" | sed -E 's#(https://)[^/@]+@#\1[redacted]@#')"
echo "host=$host (origin: $redacted_remote_url)"
dev.azure.com or visualstudio.com anywhere in the URL means host=ado; everything else is host=github. This match covers both Azure DevOps remote URL shapes:
- HTTPS:
https://dev.azure.com/<org>/<project>/_git/<repo>and the legacyhttps://<org>.visualstudio.com/<project>/_git/<repo>. - SSH:
[email protected]:v3/<org>/<project>/<repo>and the legacy<org>@vs-ssh.visualstudio.com:v3/<org>/<project>/<repo>.
2. PR ownership and existence detection
Determine two facts:
- (a) Branch ownership. Are you on a branch you own (you created it and push to it freely), or are you a contributor pushing commits onto someone else's feature branch? Treat a branch whose open PR lists a different author as not yours.
- (b) Open PR exists for this branch. Query the host:
host=github:gh pr view --json number,author,state,urlfor the current branch. Treat the result as an open PR only when the JSONstatefield is exactlyOPEN. A non-zero exit can mean "no PR exists" or "the query itself failed" (auth, network, API rate limit). Distinguish these: capture both stdout and stderr, then check whether stderr contains the documented no-PR message (e.g. "no pull requests found"). Only setpr=noneon that specific signal. On any other non-zero exit, stop with an error; do not assume no PR exists.host=ado: derivebranch_ref="refs/heads/$(git rev-parse --abbrev-ref HEAD)", then runaz repos pr list --source-branch "$branch_ref" --status active --output json. An empty array means no open PR for the branch.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 157 lines · 19 tokens per session scan A a48916b477bc
ship is a command published in the GitHub repository rjmurillo/ai-agents (45 stars, last pushed today), licensed MIT. It adds 19 tokens to every session and 3,154 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
load-session
Load a synced session summary for context.
statusline
Configure which sections appear in the Claude Code statusline.
02_execute
Execute a plan (auto-moves pending to in-progress) with Ralph Loop TDD pattern.
add-integration
Add support for a new service (like Slack, Notion, or GitHub) with full OAuth and API integration.
update-model-rubric
Research the current LLM landscape and update Carmenta's model routing rubrics with latest models, capabilities, and pricing.
update-image-rubric
Research the current image generation landscape and update Carmenta's image model routing rubrics with latest models, capabilities, and pricing.