What is tinker-review?

A graph-based pull-request review tool for Apache TinkerPop, an open-source graph-processing project. It examines changed source code and creates an HTML report with supporting evidence.

Reviewing a TinkerPop pull request by number, enriching its code graph, and optionally running functional tests.

It organizes a large code change into connected relationships so reviewers can find structural and domain-specific issues more easily.

tinker-review — Skill by apache

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/apache/tinkerpop/tinker-review

Any agent

npx skills add apache/tinkerpop --skill tinker-review

Clone the repo

git clone --depth 1 https://github.com/apache/tinkerpop

Made for: Claude Code, Codex.

Per session 59 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,893 The whole file, excluding the scripts and references it only reads on demand.

Security scan C 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00059	$0.03893
Opus 5	$0.00030	$0.01946
Sonnet 5	$0.00012	$0.00779
Haiku 4.5	$0.00006	$0.00389

Measured 2d ago against content hash 3de0fd3f9986, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

tinker-review scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 33 executable files (scripts/discovery/discussions.js, scripts/enrichment/api.js, scripts/enrichment/cli.js, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf /tmp/pr-review-<pr>

.skills/tinker-review/SKILL.md · 298 lines

How it starts

The opening of the file, as written. The whole thing — 298 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Graph Review Skill

Prerequisites

Docker running (for Gremlin Server)
upstream remote pointing to [email protected]:apache/tinkerpop.git (fetch only)
Node.js 20+ with dependencies installed in .skills/tinker-review/

References (load on demand)

Read references/schema.md when you need to understand what vertices, edges, or properties exist in the knowledge graph (typically during enrichment or when writing raw Gremlin)
Read references/interfaces.md when you need the exact function signatures or data type definitions for a module
Read references/enrichment-cli.md when you need to know what an enrichment CLI command does and when to reach for it (the command names below are terse; this is where their meaning lives)
Read references/functional-testing.md when you run the optional functional test (step 4) — what functional/cli.js does, how the built server is configured, and how to drive it from the subagent

Execution Sequence

When invoked with /review <pr-number>:

The run has two phases (see DESIGN.md). Phase 1 (step 1) is deterministic and builds the graph. Phase 2 (steps 3–5) is agent-driven — enrichment, an optional functional test, then the report. Step 2 chooses the playbooks that guide Phase 2; step 6 tears down.

1. Setup + Phase 1 (deterministic)

Run the review script. This handles everything mechanical:

npm install --prefix .skills/tinker-review  # only needed once
node .skills/tinker-review/scripts/review.js <pr-number> <repo-path>

This performs: fetch PR → create worktree → start Gremlin Server → extract structure via Tree-sitter → populate knowledge graph → discover discussions (JIRA, dev list, proposals, PR comments) → run pattern checks (completeness, coverage gaps, centrality, blast radius, cluster analysis) → write evidence JSON.

Output: /tmp/pr-review-<pr>/evidence.json Server: remains running (the agent needs it for enrichment) Worktree: available at /tmp/pr-review-<pr>/src/

Read the full file on GitHub · 298 lines

Files

What ships with it

49 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 298 lines · 59 tokens per session scan C 3de0fd3f9986

Subscribe to this mod's changes

tinker-review is a skill published in the GitHub repository apache/tinkerpop (2,144 stars, last pushed 4d ago), licensed Apache-2.0. It adds 59 tokens to every session and 3,893 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Git and workflow graph graph-database graphdb gremlin gremlin-server tinkerpop

code-graph

This skill should be used when understanding code structure, finding dependencies between functions/classes, tracing call graphs, or exploring code relationships. Trigger phrases include 'code graph', 'call graph', 'who calls', 'what calls', 'find dependencies', 'code structure', 'inheritance', 'find paths'.

FalkorDB/code-graph · 64 tokens

memgraph-storage-reviewer

Review code changes in Memgraph's storage layer, including MVCC, concurrency patterns, WAL, recovery, DDL operations, index/constraint management, delta chains, and skip list operations. Invoke for pull requests or changes to src/storage/v2/.

memgraph/memgraph · 56 tokens

cognee-permissions

Use when working with cognee's permission system — understanding or changing how users, roles, and tenants get access to datasets, how ACL grants work, where permissions are enforced in add/cognify/search/delete, and how the grant records surface in the memory-provenance view.

topoteretes/cognee · 62 tokens

cognee-cli

Use when the user wants to drive cognee from the terminal with cognee-cli — remember/recall/forget/improve memory commands, managing datasets and config, or database migrations.

topoteretes/cognee · 42 tokens

cognee-community

Use when the user needs something that ships outside cognee core — community database adapters (Qdrant, Milvus, Weaviate, Redis, Pinecone, FalkorDB, Memgraph, DuckDB, NetworkX, …), data-source connectors (Slack, Gmail, Notion, Confluence, Google Drive), custom tasks/pipelines/retrievers (Exa, ScrapeGraph, codify)…

topoteretes/cognee · 106 tokens

cognee-install

Use when the user wants to install cognee and run their first remember → recall flow with the Python SDK — fresh setup, virtual env, extras selection, or a minimal working example.