Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/tma1-ai/devtap/claude-mdgit clone --depth 1 https://github.com/tma1-ai/devtapWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01633 | $0.01633 |
| Opus 5 | $0.00816 | $0.00816 |
| Sonnet 5 | $0.00327 | $0.00327 |
| Haiku 4.5 | $0.00163 | $0.00163 |
Grade B, and why
devtap CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **claudecode**: `.mcp.json` + optional Stop hook in `~/.claude/settings.json` How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Build & Test Commands
# Build
go build ./cmd/devtap
# Test (unit only)
go test ./...
# Test with race detection (as CI runs)
go test ./... -race -count=1
# Run a single test
go test ./internal/store/file/ -run TestDrain
# Integration tests (requires local GreptimeDB on gRPC :4001, MySQL :4002)
go test -tags=integration ./internal/store/greptimedb/
# Lint
golangci-lint run ./...
Architecture
devtap captures stdout/stderr from build/dev commands and delivers them to AI coding tools via MCP (Model Context Protocol).
Data Flow
devtap -- <cmd> → capture (runner/longrun) → store.Write() → fan-out to all adapters
AI tool ← MCP server (get_build_errors) ← store.Drain() ← per-adapter queue
Core Interfaces
Store (internal/store/store.go): Write/Drain/Status/Close. Two backends:
- File (default): JSONL at
~/.devtap/<session>/<adapter>/pending.jsonl, atomic rename for IPC - GreptimeDB (optional): SQL queries + watermark cursor,
tagis a reserved keyword and must be backtick-quoted in all SQL
Adapter (internal/adapter/adapter.go): Name/DiscoverSessions/Install. Five implementations:
- claudecode:
.mcp.json+ optional Stop hook in~/.claude/settings.json - codex:
.codex/config.toml - opencode:
opencode.json - gemini:
.gemini/settings.json - aider: lint wrapper script (no MCP)
Key Patterns
- Multi-adapter fan-out: Writers discover adapters via
store.DiscoverAdapters(), write to all. Each tool drains independently. - Multi-source drain: MCP server and drain command can read from up to 2 sources (local + configured remote).
resolveDrainSources()incmd/devtap/storefactory.goresolves sources and deduplicates when (backend, session) match. Messages are merged, deduplicated viamcp.DedupMessages(), and labeled with[host session]prefix in multi-source mode. - Drain budget unit:
Store.Drain(sessionID, maxLines)treatsmaxLinesas a message count (not line count). The multi-source loop tracks remaining budget in messages. Line-level truncation is a separate pass viamcp.TruncateMessages(). - Host field:
LogMessage.Hostis set via cachedos.Hostname()at capture startup. Used for multi-source origin labeling. GreptimeDB usesCOALESCE(host, '')for backward compat with pre-existing rows. - File store IPC:
pending.jsonl→ atomic rename topending.jsonl.draining→ read → delete. Leftover lines written back to prevent data loss. - Config merge:
.mcp.json/settings.json/opencode.jsonreads existing → upserts devtap entry → writes back. Never overwrites other tools' config. - Instruction injection: Appends `
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 119 lines · 1,633 tokens per session scan B 642ec7c628b4
devtap CLAUDE.md is an instructions file published in the GitHub repository tma1-ai/devtap (13 stars, last pushed 6mo ago), licensed MIT. It adds 1,633 tokens to every session, about $0.0082 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
snip CLAUDE.md
Instructions for edouard-claude/snip, covering claude.md, project overview, key concept, repository structure and architecture.
AgentsMesh CLAUDE.md
Claude Code instructions for AgentsMesh/AgentsMesh, covering claude.md, project overview, components, development environment and quick start.
open-forge AGENTS.md
Instructions for zhangqi444/open-forge, covering agents.md, what this project is, working on this repo — the rules, build / test / lint and versioning.
AgentsMesh AGENTS.md
AGENTS.md instructions for AgentsMesh/AgentsMesh: Read CLAUDE.md completely before changing this repository. It is the shared, detailed source for architecture, build, test, and development-environment rules; this file stays short so Codex does not truncate those instructions.
open-forge CLAUDE.md
Instructions for zhangqi444/open-forge, covering claude.md, what is open-forge, architecture — 3 layers, asked in 3 questions, file layout for the 3 layers and a fourth orchestration layer — bundles.
ait CLAUDE.md
Instructions for m24927605/ait, covering claude.md, project overview, tech stack, repository layout and how to run.