Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/sroberts/plumbline/claude-mdgit clone --depth 1 https://github.com/sroberts/plumblineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sroberts/plumbline/claude-md)<a href="https://agentmods.dev/instructions/sroberts/plumbline/claude-md"><img src="https://agentmods.dev/badge/instructions/sroberts/plumbline/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01706 | $0.01706 |
| Opus 5 | $0.00853 | $0.00853 |
| Sonnet 5 | $0.00341 | $0.00341 |
| Haiku 4.5 | $0.00171 | $0.00171 |
Grade A, and why
plumbline CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project status
Plumbline is implemented and shipping. It is a Go module
(github.com/sroberts/plumbline, Go 1.26.1) with a Cobra CLI, a Bubble Tea
TUI, a 22-signal detector catalog, GoReleaser packaging, and eight CI
workflows. It assesses itself at ACMM Level 5.
SPEC.md is the implementation contract — numbered sections, cited
throughout the source (SPEC.md §6 = signal model, §7 = scoring, §9 =
output formats). Read the relevant section before changing behavior it
pins. The ACMM paper is the model source; SPEC.md is what plumbline
actually does, and §6's "Deviations from the source paper" records where
the two diverge on purpose.
Build & test
make build # binary with version ldflags
make test # unit + E2E
make test-race # race detector
make lint # gofmt + go vet (golangci-lint if installed)
CONTRIBUTING.md has the full pre-PR checklist and the package-by-package
"where things live" map — read it rather than rediscovering the layout.
Architecture in brief
pkg/acmm— the public types. Anything here is--jsonsurface and part of the compatibility contract.internal/scanner— the single IO chokepoint. Signals read theRepoIndex, never the filesystem directly.internal/signals/lN/<id>.go— one file per detector, self-registering viainit(). The level packages are blank-imported fromcmd/plumbline/registrations.goandcmd/gen-signal-docs/main.go; a new level package needs adding to both.internal/signals.Fixer— an optional interface. Most signals don't implement it, andplumbline fix <id>correctly exits 2 for those. Don't add a fixer for a signal whose remedy needs real judgment (which monitoring SDK, which triage rules) — thefix_hintprose is the answer there.internal/fix— the only place plumbline writes inside a target repo. Refuses overwrite; in-repo paths only.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 102 lines · 1,706 tokens per session scan A a0e7564438a4
plumbline CLAUDE.md is an instructions file published in the GitHub repository sroberts/plumbline (6 stars, last pushed 4d ago), licensed MIT. It adds 1,706 tokens to every session, about $0.0085 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
docvet CLAUDE.md
Claude Code instructions for Alberto-Codes/docvet, covering claude.md, project overview, build & development, install in development mode and with optional griffe support.
plan-forge dapr.instructions.md
Dapr patterns for .NET — building blocks, component config, sidecar architecture, multi-tenant isolation, workflows, state management, secrets.
plan-forge testing.instructions.md
Testing rules for Plan Forge — vitest patterns, fake-timers vs tolerance, mocking conventions, and how to read test output without hallucinating failures. Auto-loads when editing test files.
plan-forge copilot-instructions.md
Copilot instructions for srnichols/plan-forge, covering instructions for copilot, architecture principles, core principles (non-negotiable), cost estimates and talking to forge-master.
plan-forge landing-zone.instructions.md
Azure Landing Zone baselines — identity, network, policy, management, security, tagging, subscription organization.
plan-forge policy.instructions.md
Azure Policy and Initiative compliance — definitions, assignment, compliance state, exemptions, remediation tasks.