Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add abdul-hamid-achik/codemap --skill using-codemapgit clone --depth 1 https://github.com/abdul-hamid-achik/codemapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/abdul-hamid-achik/codemap/using-codemap)<a href="https://agentmods.dev/skills/abdul-hamid-achik/codemap/using-codemap"><img src="https://agentmods.dev/badge/skills/abdul-hamid-achik/codemap/using-codemap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/abdul-hamid-achik/codemap/using-codemap"><img src="https://agentmods.dev/badge/skills/abdul-hamid-achik/codemap/using-codemap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03331 |
| Opus 5.5 | $0.00026 | $0.01332 |
| Sonnet 5.5 | $0.00013 | $0.00666 |
| Haiku 4.5 | $0.00007 | $0.00333 |
Grade A, and why
using-codemap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Calling codemap
If codemap_* tools are in your tool list, use them. Otherwise run the CLI from
the repository: every codemap_ below is codemap <tool> --json with
underscores turned into dashes (codemap_file_impact is codemap file-impact --json),
codemap_context_batch is codemap context <a> <b> --json, and the MCP path
parameter is -C <dir>. If neither the tools nor the codemap binary are available,
say so plainly instead of guessing: the one-time setup is to install codemap, then run
codemap agent skill (this skill, for every detected harness) and optionally
codemap agent setup <harness> (the MCP server).
Before the first question in a repository, check the index with
codemap status --json. When registered is false, indexed is false, or nodes
is 0, run codemap index; when a result says stale, reindex first. Check
codemap coverage --json before trusting exact callers on a partly covered repo:
status's per-language precise flag is all-or-nothing, while coverage is per file.
Add --precise for exact TypeScript/JavaScript/Python call edges when its cost is
justified and the language server is installed; for one symbol, prefer
codemap_callers/codemap_callees with precise:true first.
If codemap_explore or codemap_task_context reports lexical mode or a semantic-owner error, semantic retrieval is unavailable, not empty: treat seeds as keyword/name matches and name the remediation from the error (for vecgrep, build its project index). If a helper is a nested arrow const or local closure that find/impact cannot address by bare name, resolve its file:line with codemap_symbol_at and work from the enclosing symbol.
CLI exit codes: 0 answered, 2 not found, 3 index missing, 6 a review/risk gate failed.
For structural code questions — who calls X, what breaks if I change Y, where do I start reading, what tests cover this — reach for codemap before grep or opening files: if answering would mean reading more than 2 files, call codemap_context (or codemap_context_batch) first. codemap is a precomputed code graph fused with semantic search, exposed as codemap_context, codemap_impact and friends over MCP (and as codemap … --json on the CLI).
Map the loop to the tools:
- orient on a repo -> codemap_read_order (entrypoints + hubs, ranked)
- locate -> codemap_semantic (by meaning) · codemap_find (by name) · codemap_grep (exact text: a literal, error string, route, env var) · codemap_explore (fuzzy intent → oriented structure)
- resolve a file:line -> codemap_symbol_at (a stack trace / diff hunk / grep hit → a selector; batch positions:[…] for a whole trace)
- orient on a file -> codemap_file_context (symbol outline + file impact + related files in one call)
- understand -> codemap_context, codemap_impact, codemap_source
- before a risky edit -> codemap_risk, codemap_file_impact, codemap_dependencies, codemap_related_files
- after every edit -> codemap_review (it names the tests to run and folds one risk band)
- calibrate trust -> codemap_coverage (per-file precise call-graph coverage)
Trust the honesty signals on every result: stale (reindex first), call_graph (resolved/name/unresolved/none), resolution, and the *_total caps. When a name is ambiguous the response already carries candidates:[…] and accepts a selector, so pick one definition from those instead of a second lookup. Prefer codemap_index --precise for exact call edges — it is the only complete call graph for TypeScript and JavaScript (the default index has same-file and imported-binding candidates only) and the only call graph for Python. On a large, partly covered repo, scope trust with codemap_coverage and use one-off precise codemap_callers/codemap_callees for the symbol in question before paying for a full precise reindex.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +28 lines 65176aaa8db3
- 18d ago Changed · +16 lines · +20 tokens per session 908a147fdb4b
- 19d ago Changed · +2 lines dcd18bf3b3a8
- 23d ago Changed · +5 lines a8c7b1432b20
- 1mo ago First seen · 150 lines · 46 tokens per session scan A 4aa96ffe5ea6
using-codemap is a skill published in the GitHub repository abdul-hamid-achik/codemap (2 stars, last pushed 7d ago), licensed MIT. It adds 66 tokens to every session and 3,331 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…
cwv-optimizer
Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages. Goes deeper than generic CWV advice by understanding EDS-specific performance patterns including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and…
incident-response-incident-response
Coordinate production incident triage, mitigation, investigation, recovery, and follow-up. Use when responding to outages or other incidents that require structured operational coordination.
ci-fixer
CI failures - read error, minimal fix, verify.