Crit is a local review tool for examining agent-generated plans, code changes, web applications, and static HTML. Developers use it to point to specific problems and send feedback back to their coding agent, with a different review interface for each type of output.
Borrowing it
Nothing to install: this file belongs to tomasz-tomczyk/crit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/tomasz-tomczyk/crit/main/AGENTS.mdgit clone --depth 1 https://github.com/tomasz-tomczyk/critWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/tomasz-tomczyk/crit/agents-md)<a href="https://agentmods.dev/instructions/tomasz-tomczyk/crit/agents-md"><img src="https://agentmods.dev/badge/instructions/tomasz-tomczyk/crit/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/tomasz-tomczyk/crit/agents-md"><img src="https://agentmods.dev/badge/instructions/tomasz-tomczyk/crit/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.09387 | $0.09387 |
| Opus 5.5 | $0.03755 | $0.03755 |
| Sonnet 5.5 | $0.01877 | $0.01877 |
| Haiku 4.5 | $0.00939 | $0.00939 |
Grade A, and why
crit AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- State-changing requests (POST/PUT/PATCH/DELETE) with a `Sec-Fetch-Site` header must be `same-origin`. Missing header is allowed (CLI/curl/agent). `cross-site` is rejected — CSRF defense against malicious pages posting How it starts
The opening of the file, as written. The whole thing — 440 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Crit — Development Guide
Single-binary Go CLI that opens a browser-based UI for reviewing code changes and markdown files with GitHub PR-style inline commenting. Multi-file review with git diff rendering and structured review file output for AI coding agents.
Project map
crit/
├── cmd/crit/ # package main — thin CLI (main.go, cli_*.go, wire.go)
├── internal/ # Core logic packages (daemon, server, session, github, share, vcs, …)
├── web/ # Embedded frontend assets (Go package webassets; embed.go)
│ ├── index.html # HTML shell — code-review OR live-mode script fork
│ ├── app.js # Code-review mode JS
│ ├── live-mode*.js # Live-mode modules
│ ├── crit-agent.js / agent-*.js / agent-marker.css # Injected iframe scripts
│ ├── crit-*.js # Shared renderer, SSE, draft, comment UI modules
│ ├── style.css / style-live.css / theme.css
│ ├── __tests__/ # Node.js unit tests (node --test)
│ ├── pierre/ # Vendored @pierre/diffs + Shiki (split ESM, gzip; scripts/build-pierre.mjs)
│ └── *.min.js # Vendored markdown-it, DOMPurify, mermaid, diff-match-patch
├── integrations/ # Drop-in config files for AI coding tools (claude-code, cursor, aider, …)
├── test/ # Test harnesses, E2E, roundtrip docs, shared fixtures
├── Makefile
├── package.json
└── copy-deps.js # Copies npm deps into web/ for embedding
Key architecture decisions
- All frontend assets embedded via Go's
embed.FS— produces a true single binary - No frontend build step — vanilla JS, no npm/webpack/framework. npm is only for fetching vendor libs.
- Two modes: "git" mode (auto-detect from git) and "files" mode (explicit file arguments)
- markdown-it for parsing — chosen because it provides
token.map(source line mappings per block) - Block-level splitting — lists, code blocks, tables, blockquotes split into per-item/per-line/per-row blocks so each source line is independently commentable
- Diff rendering is
@pierre/diffs— the review list (git and files mode) is one PierreCodeView: virtualization, sticky headers, Shiki highlighting in a worker pool, word diffs, split/unified, context expansion. Crit supplies the file header, comments/forms as annotations, keyboard focus and jumps. Rendered markdown (Document view) is Crit's line-block document inside a Pierre item. Story chapters use PierreFileDiff. Seedocs/frontend-js.md. - Comments reference source line numbers — stored in
~/.crit/reviews/<key>.jsonwith per-file sections - Real-time output — review file written on every comment change (200ms debounce)
- File watching — git mode polls
git status --porcelain; files mode polls mtimes; reloads via SSE - Localhost by default — server binds to
127.0.0.1(no CORS headers needed). Non-loopback--host/CRIT_HOST/ globalhost, or anypublic_url, require--allow-unauthenticated-network/CRIT_ALLOW_UNAUTHENTICATED_NETWORK=1(Crit has no network auth). - Two-level config —
~/.crit.config.json(global) merged with.crit.config.json(project), CLI flags override both.agent_cmd,auth_token,share_url, andplan_approve_modeare global-only (prevents malicious repos from hijacking agent commands, redirecting share requests, or weakening Claude Code permissions) - Headless CLI comment —
crit commentwrites directly to the review file without starting the server; SSE notifies any running server - Comment threading — comments support nested replies and a
resolvedboolean. Review file schema nests replies inside each comment'srepliesarray. - Centralized review storage —
~/.crit/reviews/<key>.jsonkeyed by cwd + branch (git mode) or cwd + args (file mode) - VCS abstraction —
vcs.godefines a backend interface;git_vcs.go,sapling.go, andjj.goare the implementations. Auto-detected, overridable via--vcsflag orvcsconfig key. Subcommands not yet threaded through (see TODO atmain.go:1826). - Pluggable renderers —
web/crit-renderers.jsregistry; two registration kinds:kind: 'fence'(by info string,langs) andkind: 'file'(by glob,paths,<label> / Sourcetoggle,viewMode: 'rendered'). Built-in mermaid (crit-renderer-mermaid.js) covers```mermaid,*.mermaid,*.mmd, and injectsmermaid.min.jsonly on the first diagram (not inindex.html). New renderers ship inweb/(no external script loading). Seedocs/renderers.md. - Focus mode — sub-views over the file list: file focus, range focus (
--range A..B), stacked focus (range layer in a stacked PR). Lives infocus_*.goand/api/focus.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +93 tokens per session 0e13055ad269
- 13d ago Changed · +1 lines · +269 tokens per session fca317d82cd5
- 16d ago Changed · +1 lines · +145 tokens per session 8bfcda015a5d
- 22d ago Changed · +1 lines · +35 tokens per session dbd3d5b5c8b2
- 23d ago Changed · +1 lines · +28 tokens per session b89b2aedaffa
- 28d ago Changed · +2 lines · +148 tokens per session 2731f03a8ed7
- 1mo ago Changed · +4 lines · +360 tokens per session 6596bbea6930
- 1mo ago Changed · +1 lines · +79 tokens per session 8de34f288fa6
- 1mo ago Changed · +1 lines · +82 tokens per session 040b84a2a046
- 1mo ago First seen · 428 lines · 8,148 tokens per session scan A aef75fc3a1ad
crit AGENTS.md is an instructions file published in the GitHub repository tomasz-tomczyk/crit (1,257 stars, last pushed 3d ago), licensed MIT. It adds 9,387 tokens to every session, about $0.0375 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.