Crit is a local review tool for examining agent-generated plans, code changes, web applications, and static HTML. Developers use it to point to specific problems and send feedback back to their coding agent, with a different review interface for each type of output.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/tomasz-tomczyk/critWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/tomasz-tomczyk/crit/frontend-js)<a href="https://agentmods.dev/rules/tomasz-tomczyk/crit/frontend-js"><img src="https://agentmods.dev/badge/rules/tomasz-tomczyk/crit/frontend-js/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/tomasz-tomczyk/crit/frontend-js"><img src="https://agentmods.dev/badge/rules/tomasz-tomczyk/crit/frontend-js.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00516 |
| Opus 5.5 | $0.00000 | $0.00206 |
| Sonnet 5.5 | $0.00000 | $0.00103 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
frontend-js scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend JS Rules (semantic — ESLint handles syntax/style)
DOM & Events
- Use
addEventListener, not inlineonclickhandlers in new code. - Cache repeated DOM queries into const variables.
State Management
- When async operations can be triggered from multiple sources, add dedup guards (e.g.,
reloadInFlightpromise pattern). - Reset ALL navigation/UI state when context changes (scope change, session reload, comment delete).
- When implementing UI state logic that counts comments, account for ALL comment types (file-scoped AND review-level).
Persisted Settings (cookies, not localStorage)
- Use cookies for any setting that should persist across
critinvocations. Crit defaults to a random port (port=0), and localStorage is scoped per origin (scheme + host + port), so localStorage settings reset every run. Cookies are host-scoped and survive port changes. - Persisted settings live in a single
crit-settingsJSON cookie viagetSetting(key, fallback)/setSetting(key, value). The exception iscrit-templates, which stays in its own cookie because it's user-defined and can be longer. - localStorage is fine for transient per-session data (e.g.,
crit-draft-*autosave keys that are review-specific anyway). - Before adding persistence to a setting, ask whether it should be sticky. Transient view state (active filter, sort order on a list) usually shouldn't be — users coming back to a new review with "resolved-only" active would miss new open comments. Persist preferences (theme, width, hide-resolved), not transient views.
Error Handling
- Always check
response.okafterfetch()calls. Throw on unexpected statuses. - Every async operation must have error recovery that restores interactivity (re-attach listeners, undo optimistic UI).
- Never call
.remove()directly on elements with CSS exit animations. Use class toggle + animationend listener.
Accessibility (axe-core in E2E catches missing aria-labels, dialog roles, tab roles)
- Never call
.blur()on interactive elements — it breaks keyboard navigation. axe-core catches the effect (no focus indicator) but not the cause.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 34 lines · 0 tokens per session scan A 2feeb9b79da7
frontend-js is a cursor rule published in the GitHub repository tomasz-tomczyk/crit (1,223 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 516 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
templates
Tera template variables, blocks, and theme conventions.
features
Built-in site features (highlighting, homepage content, math, diagrams, search).
shortcodes
Built-in and custom shortcodes for markdown content.
seo-requirements
SEO and GEO requirements every page template must meet (meta tags, JSON-LD, feeds).
governor
Governor — context hygiene and tool-output filtering.
apollo-content-agent
✍️ God Agent Apollo — Content Agent — Content & Copywriting. Invoke for: pantheon, content, copywriting, seo.