Borrowing it
Nothing to install: this file belongs to SylphxAI/pdf-reader-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SylphxAI/pdf-reader-mcp/main/.opencode/command/saas-review.mdgit clone --depth 1 https://github.com/SylphxAI/pdf-reader-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sylphxai/pdf-reader-mcp/saas-review)<a href="https://agentmods.dev/commands/sylphxai/pdf-reader-mcp/saas-review"><img src="https://agentmods.dev/badge/commands/sylphxai/pdf-reader-mcp/saas-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/sylphxai/pdf-reader-mcp/saas-review"><img src="https://agentmods.dev/badge/commands/sylphxai/pdf-reader-mcp/saas-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.01377 |
| Opus 5 | $0.00007 | $0.00688 |
| Sonnet 5 | $0.00003 | $0.00275 |
| Haiku 4.5 | $0.00001 | $0.00138 |
Grade A, and why
saas-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SaaS Product Review — Master Orchestration
Mandate
- Perform a complete end-to-end review across product, engineering, security, compliance, growth, operations, and UX.
- Delegate work to multiple workers; you act as the final gate to improve quality.
- Deliverables must be stated as standards, constraints, and acceptance criteria.
- Single-pass delivery: no roadmap, no phasing, no deferrals; deliver an integrated outcome.
Non-Negotiable Engineering Principles
- No workarounds, hacks, or TODOs.
- Feature-first with clean architecture; designed for easy extension; no "god files".
- Type-first, strict end-to-end correctness (DB → API → UI).
- Serverless-first; edge-compatible where feasible without sacrificing correctness, security, or observability.
- Mobile-first responsive design; desktop-second.
- Precise naming; remove dead/unused code.
- Upgrade all packages to latest stable; avoid deprecated patterns.
Fixed Platform & Stack (Locked)
| Layer | Technology |
|---|---|
| Platform | Vercel |
| Framework | Next.js (SSR-first) |
| API | tRPC |
| i18n | next-intl |
| Database | Neon (Postgres) |
| ORM | Drizzle |
| Auth | better-auth |
| Payments | Stripe |
| Resend | |
| Observability | Sentry |
| Analytics | PostHog |
| Cache/Workflows | Upstash Redis + Workflows + QStash |
| Storage | Vercel Blob |
| Tooling | Bun, Biome, Bun test |
| Tag Management | GTM (marketing only) |
Review Execution
Phase 1: All Reviews (Parallel)
Spawn all workers in parallel using the Task tool. Each worker runs its slash command and returns findings.
Delegation pattern:
Use Task tool with subagent_type: "Coder" for each worker.
Spawn ALL 8 workers in a single message (parallel execution).
Each worker prompt: "Run /{command} and return findings."
| Worker | Command | Focus |
|---|---|---|
| Billing | /saas-billing |
Stripe, webhooks, pricing governance, ledger |
| Auth | /saas-auth |
SSO, passkeys, verification, sessions, account security |
| i18n | /saas-i18n |
Locales, routing, canonicalization, hreflang |
| Platform | /saas-platform |
Design system, SEO, PWA, performance, a11y |
| Security | /saas-security |
OWASP, privacy, consent, observability, operability |
| Growth | /saas-growth |
Onboarding, referral, retention, guidance |
| Admin | /saas-admin |
RBAC, bootstrap, config, feature flags, ops tooling |
| Discovery | /saas-discovery |
Feature opportunities, pricing optimization, competitive research |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 179 lines · 14 tokens per session scan A 9912c62fea44
saas-review is a command published in the GitHub repository SylphxAI/pdf-reader-mcp (921 stars, last pushed 3d ago), licensed MIT. It adds 14 tokens to every session and 1,377 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other commands, from other repositories
assemble-team
Assemble a pre-built agent team for parallel work - review, feature, debug, cross-platform, full-stack, or research.
announce
Draft X/Twitter announcement post (or thread) for the latest plugin release.
ia-test-browser
Run browser tests on pages affected by current PR or branch.
ia-verify
Run pre-PR verification chain -- build, types, lint, tests, security scan, diff review.
ia-agent-native-audit
Score each of the 5 agent-native principles (parity, granularity, composability, emergent capability, improvement-over-time) against a codebase and report gaps.
check-architecture
Angular Architecture Review.