Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/jpicklyk/task-orchestrator/claude-mdgit clone --depth 1 https://github.com/jpicklyk/task-orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/jpicklyk/task-orchestrator/claude-md)<a href="https://agentmods.dev/instructions/jpicklyk/task-orchestrator/claude-md"><img src="https://agentmods.dev/badge/instructions/jpicklyk/task-orchestrator/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04722 | $0.04722 |
| Opus 5 | $0.02361 | $0.02361 |
| Sonnet 5 | $0.00944 | $0.00944 |
| Haiku 4.5 | $0.00472 | $0.00472 |
Grade C, and why
task-orchestrator CLAUDE.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
`rm -rf ~/.claude/plugins/cache/task-orchestrator-marketplace`, then How it starts
The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project: MCP Task Orchestrator
A Kotlin-based MCP server providing hierarchical work item management with dependency tracking, note schemas, and role-based workflow automation.
Key Technologies:
- Kotlin 2.3.21 with Coroutines
- Exposed ORM 1.2.0 for SQLite
- MCP SDK 0.12.0 (with Ktor Streamable HTTP transport)
- Flyway for database migrations
- Gradle with Kotlin DSL / Docker
Build Commands
./gradlew build # fat JAR → current/build/libs/
./gradlew clean build
./gradlew test
./gradlew test --tests "*ToolTest"
java -jar current/build/libs/mcp-task-orchestrator-*.jar
# Docker (most common)
docker build -t task-orchestrator:dev .
docker run --rm -i \
-v mcp-task-data:/app/data \
-v "$(pwd)"/deploy/global-config/.taskorchestrator:/project/.taskorchestrator:ro \
-e AGENT_CONFIG_DIR=/project \
task-orchestrator:dev
Architecture
Source lives under current/.
Package root: io.github.jpicklyk.mcptask.current
Source root: current/src/main/kotlin/io/github/jpicklyk/mcptask/current/
domain/
model/ — WorkItem, Note, Dependency, Role, Priority, RoleTransition, LifecycleMode, WorkItemSchema
repository/ — WorkItemRepository, NoteRepository, DependencyRepository, RoleTransitionRepository
application/
tools/items/ — ManageItemsTool, QueryItemsTool (FTS5 search + list-filter)
tools/notes/ — ManageNotesTool, QueryNotesTool (FTS5 search + get/list)
tools/dependency/ — ManageDependenciesTool, QueryDependenciesTool (backlinks + get)
tools/workflow/ — AdvanceItemTool, ClaimItemTool, GetNextStatusTool, GetNextItemTool, GetBlockedItemsTool, GetContextTool
tools/compound/ — CreateWorkTreeTool, CompleteTreeTool
service/ — RoleTransitionHandler, NoteSchemaService, CascadeDetector, WorkTreeExecutor
service/search/ — FtsQuerySanitizer, RrfFusion
infrastructure/
database/schema/ — WorkItemsTable, NotesTable, DependenciesTable, RoleTransitionsTable
database/schema/management/ — DirectDatabaseSchemaManager, FlywayDatabaseSchemaManager, SchemaManagerFactory
repository/ — SQLite implementations, RepositoryProvider
config/ — YamlWorkItemSchemaService (typealias YamlNoteSchemaService), ApiAuthConfigLoader
interfaces/mcp/
CurrentMcpServer.kt, McpToolAdapter.kt
interfaces/api/v1/
auth/ — ApiAuthConfig, ApiPrincipal, ApiScope, ApiCapability, AuthenticationPlugin, AuthorizationPlugin, BearerTokenStore, JwksApiVerifier
cors/ — CorsConfig (env-driven CORS from CORS_ALLOWED_ORIGINS etc.)
dto/ — Dtos.kt (ItemDto, NoteDto, ActorClaimDto, VerificationDto, RoleTransitionDto, DependenciesDto, DependencyEdgeDto, BacklinkDto, PageDto, ErrorDto, SearchHitDto, config DTOs, request DTOs, AdvanceResponseDto)
etag/ — etagFor() — "v1-<modifiedAtMillis>" for items/notes
events/ — ApiEvent, ApiEventType constants, ApiEventBus (ring-buffer pub/sub with per-root filtering)
mapping/ — Domain → DTO mappers (.toDto() extensions)
pagination/ — pageParams(), buildPageDto()
redaction/ — AttributionRedactor (API_REDACT_NOTE_ATTRIBUTION, API_REDACT_ACTOR_PROOF)
audit/ — ApiAuditBridge (server-synthesized actor "api:<tokenId>", kind external)
routes/ — ItemRoutes, ItemWriteRoutes, NoteRoutes, NoteWriteRoutes, DependencyRoutes, DependencyWriteRoutes, TransitionRoutes, SearchRoutes, ConfigRoutes, ServiceRoutes, EventRoutes, WellKnownRoutes, WriteIdempotency
application/service/rest/
MergePatchApplier — RFC 7396 JSON Merge Patch
StatusGraphBuilder — status-transition graph builder for ConfigRoutes
WorkItemPatchProjection — projects existing item fields into a JsonObject base for merge-patch
infrastructure/security/
ConstantTimeCompare — timing-safe byte comparison (used by BearerTokenStore for SHA-256 digests)
JwksKeyCache — JWKS key material cache for JWKS auth mode
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 303 lines · 4,722 tokens per session scan C 28dfc2d5f1bf
task-orchestrator CLAUDE.md is an instructions file published in the GitHub repository jpicklyk/task-orchestrator (205 stars, last pushed 1mo ago), licensed MIT. It adds 4,722 tokens to every session, about $0.0236 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
claude-task-manager CLAUDE.md
Claude Code instructions for vibehat/claude-task-manager, covering claude code instructions, task master ai integration, critical rules, mandatory workflow and code reuse rules (violating any invalidates your response).
pneuma-skills AGENTS.md
AGENTS.md instructions for pandazki/pneuma-skills, covering pneuma skills, project overview, tech stack, cli commands and development.
mulch AGENTS.md
AGENTS.md instructions for jayminwest/mulch, covering agents.md, what this project is, tech stack at a glance, project layout and commands.
festival GEMINI.md
Gemini CLI instructions for Obedience-Corp/festival: Festival is a goal-oriented project management methodology for human and AI development workflows, driven by the fest and camp CLIs, installed and kept in sync by a third tool, festival. The skills imported below describe how to plan and execute festivals. Load them…
vibe-annotations CLAUDE.md
Claude Code instructions for RaphaelRegnier/vibe-annotations, covering vibe annotations — monorepo, repo structure, quick commands, how the pieces relate and package-specific context.
github-template-ai-agents CLAUDE.md
Claude Code instructions for d-o-hub/github-template-ai-agents, covering claude code features, sub-agents, skills, custom commands and metrics.