Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/varienos/agentic-workflow/bootstrapgit clone --depth 1 https://github.com/varienos/agentic-workflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.43414 |
| Opus 5 | $0.00000 | $0.21707 |
| Sonnet 5 | $0.00000 | $0.08683 |
| Haiku 4.5 | $0.00000 | $0.04341 |
Grade E, and why
bootstrap scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -LsSf https://astral.sh/uv/install.sh | sh Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
test -f ./.claude/settings.json && echo "✅ C1: settings.json var" || echo "❌ C1: settings.json YOK" Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
grep -q '"basic-memory"' ./.mcp.json && echo "✅ I2: .mcp.json basic-memory entry içeriyor" || echo "❌ I2: .mcp.json basic-memory entry EKSIK" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -LsSf https://astral.sh/uv/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 2,952 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bootstrap — Agentic Workflow Kurulum Sihirbazi
Bu komut projenizi analiz eder, sizinle kisa bir roportaj yapar ve tum agentic workflow yapilandirmasini olusturur. Her adim konsolda gorunur. Islem sonunda .claude/ dizini, root dosyalar, manifest ve backlog hazir olur.
KURAL: Bu talimatlari harfi harfine, ADIM ADIM, sirasiyla uygula. Hicbir adimi atlama, hicbir adimi birlestirme. Her adimdaki ciktilari kullaniciya goster.
KUTSAL KURALLAR
Bu kurallar Bootstrap'in ve urettigi tum dosyalarin temelini olusturur:
1. Git sadece Codebase'de calisir
- Agentbase'de
.git/YOKTUR. Agentbase sadece bir konfigürasyon dizinidir. - Tum git islemleri (commit, push, branch, worktree)
../Codebase/icinde yapilir. - Command'lardaki git komutlari:
cd ../Codebase && git ... - Worktree izolasyonu:
cd ../Codebase && git worktree add ... - Bu ayrim Codebase'in guvenli worktree izolasyonunu saglar — agent ve backlog dosyalarindan bagimsiz.
- Iki-repo teslimat modeli (opsiyonel): Proje koku (Agentbase/Codebase/Docbase'in USTU) gelistiricinin KENDI git reposu olabilir — Agentbase + Docbase'i versiyonlar,
Codebase'i.gitignoreile yok sayar (bkz. ADIM 6.6). Codebase kendi bagimsiz reposudur ve musteriye AYRI teslim edilir (musteri sadece Codebase'i klonlar). Bu durumda bile.gitproje kokune yazilir; Agentbase icine YAZILMAZ — yukaridaki "Agentbase'de.git/YOKTUR" kurali aynen korunur. - Ajan siniri: Ajan/workflow git islemleri (commit/push/branch/worktree) DAIMA
../Codebase/'i hedefler; ust-kok (gelistirici) reposuna ASLA dokunmaz. Ust-kok repo gelistiricinin manuel aracidir, ajanlarin degil.
2. Bootstrap Codebase'e ASLA yazmaz (tek istisna: AI Import)
- Bootstrap Codebase'i OKUR → Agentbase'i YAPILANDIRIR.
- Codebase'deki hiçbir dosya degistirilmez, eklenmez veya silinmez.
- Tum uretilen dosyalar Agentbase/ icine gider — alt dagilim:
- Agentbase ROOT (yani
Agentbase/direkt) — Bootstrap'in DOĞRUDAN urettigi (6+1 root dokuman + 1 mcp config):PROJECT.md,STACK.md,DEVELOPER.md,ARCHITECTURE.md,WORKFLOWS.md,CLAUDE.md(root context),onboarding.md(yeni gelistirici rehberi),.claude-ignore,.mcp.json(zorunlu —templates/core/mcp.skeleton.jsonkaynagindan). Bootstrap'in cagirdigi araclarin urettigi:backlog/(Backlog.md CLI),../Docbase/memory/(basic-memory vault). Repo'da hazir gelen (statik root dokumanlar — Bootstrap doldurmaz, rootCLAUDE.md'deki@<dosya>zincirine dahil edilir):ORCHESTRATION.md(ortak ajan davranis felsefesi — tum modeller icin),LESSONS.md(oz-gelisim dersleri),BACKLOG.md(Backlog CLI hizli referans). Repo'da hazir gelen (kod ve template altyapisi):bin/,templates/,tests/,generate.js,transform.js,package.json. - Agentbase/.claude/ altinda:
commands/,agents/,hooks/,rules/,reports/,tracking/,custom/,settings.json,CLAUDE.md(agent-icin dahili runtime config — rootCLAUDE.md'den AYRI bir dosya, son kullaniciya degil agent'a yoneliktir). - Manifest:
../Docbase/agentic/project-manifest.yaml(Agentbase disinda, Docbase altinda). - Transform.js opsiyonel ciktilari (
manifest.targetsicindeclaudedisinda hedef varsa):GEMINI.md(gemini/antigravity hedefi → Agentbase root),.agents/workflows/*,.agents/skills/*/SKILL.md,.agents/rules/*(antigravity hedefi),AGENTS.md+.codex/skills/*/SKILL.md(codex hedefi → Agentbase root +.codex/),.kimi/skills/,.kimi/agents/(kimi hedefi),.opencode/AGENTS.md+.opencode/skills/+.opencode/agents/(opencode hedefi). Bu dosyalar rootCLAUDE.mdicerigini hedef CLI formatina cevirir — enjeksiyon zinciri otomatik korunur. - YASAK: Root dokumanlari (PROJECT.md, STACK.md, DEVELOPER.md, ARCHITECTURE.md, WORKFLOWS.md, ORCHESTRATION.md, LESSONS.md, BACKLOG.md, root CLAUDE.md, onboarding.md)
.claude/altina YAZMA veya KOPYALAMA..claude/agent runtime konfiguudur, dokumantasyon degil. Bu dosyalar gercek Agentbase root'unda kalir ki tum modeller (Claude, Gemini, Antigravity, Codex, Kimi, OpenCode) ayni context'i okuyabilsin.
- Agentbase ROOT (yani
- Manifest
../Docbase/agentic/altina gider (Codebase disinda). - Projenin mevcut .gitignore, package.json, CI config dosyalari korunur.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 2,952 lines · 0 tokens per session scan E 4ae90e1d48ac
bootstrap is a command published in the GitHub repository varienos/agentic-workflow (58 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 43,414 tokens. A static security scan graded it E with 4 findings (downloads and executes remote code, reads agent configuration directories, reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
status
Show current Craft progress — cycles, stories, backlog in a rich dashboard view.
story-archive
Move a story from a cycle back to the backlog.
project
Manage projects inside a topic wiki. Projects are folders under output/projects/ that group related outputs (playbooks, images, code, data) with a goal captured in WHY.md.
luda
Invoke Luda, your Scrum Master, for board integrity — orphan work items, plan-vs-tracker divergence, Done-without-negative-criteria, parked-without-a-trigger — plus ticket creation and team orchestration.
design-sprint
Orchestrate design-to-implementation workflow for a sprint or feature. Coordinates /ui (Aura) and /fe (Finn).
ledger-plan
Generate implementation plan with backlog, milestones, and test plan constrained by decisions and risks.