Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dvcdsys/code-index/cixnpx skills add dvcdsys/code-index --skill cixgit clone --depth 1 https://github.com/dvcdsys/code-indexWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.02304 |
| Opus 5 | $0.00060 | $0.01152 |
| Sonnet 5 | $0.00024 | $0.00461 |
| Haiku 4.5 | $0.00012 | $0.00230 |
Grade A, and why
cix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Index (cix) — Semantic Code Search & Navigation
cix is a semantic code index that understands code via embeddings + AST
parsing. You reach it through the cix_* MCP tools (no shell, no CLI). The
right reflex is "cix when you don't have a pointer; read/grep when you do."
This connection talks to a cix SERVER, not a single project. One server may
hold many indexed repositories, and nothing is inferred from a working directory
— there is no "current project." Every per-repo tool needs an explicit
project (a repository's host_path). So the first move is always to discover
what's indexed.
First, orient
Before any per-repo call:
- Call
cix_list_projectsto see the indexed repositories. Each row has ahost_path(e.g./Users/me/acme-apiorgithub.com/acme/api@main). - Pick the
host_pathof the repo the user means, and pass it as theprojectargument to every per-repo tool below.
If the repo the user is asking about is not in cix_list_projects, this
skill cannot index it — indexing is server-side. Tell the user to index it (via
the cix dashboard, or cix init on the machine running the cix server), then
retry.
You don't have to memorize host_paths: if you call a per-repo tool with a
missing or unknown project, the server replies with an error that lists the
valid projects, so you can self-correct in one step.
(Multi-server: cix_list_servers lists configured servers; every tool takes an
optional server argument. Omit it for the default — most setups have one
server. Only pass server when the user names a specific backend; never guess a
name — call cix_list_servers.)
When to use which
Reach for cix first when:
- The starting point is open-ended ("how does indexing work?", "find the authentication middleware", "where is the main entry point?")
- You need cross-file navigation (definitions / references / callers)
- You're searching by meaning, not an exact string (
"JWT validation"should findverifyTokeneven without that phrase) - You're exploring an unfamiliar package or repo
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 192 lines · 119 tokens per session scan A a9681a576489
cix is a skill published in the GitHub repository dvcdsys/code-index (29 stars, last pushed 5d ago), licensed MIT. It adds 119 tokens to every session and 2,304 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
optimize-accuracy-first
Diagnose, design, implement, and validate system optimizations while treating correctness, retrieval quality, bounded behavior, and avoided downstream work as primary outcomes. Use for performance, latency, CPU, memory, storage, indexing, search, retrieval, caching, batching, concurrency, tokenizer, database, or…
using-jambavan
Use when Jambavan MCP tools (jambavanindex, jambavancontext, jambavanmemory) are available in the current session, or when you see .jambavan/ in the project root.
vibhishana-niti
Activate Vibhishana Niti — a severe senior-engineer discipline for shipping the minimum correct change. Use when the user asks for the smallest/simplest fix, a minimal diff, root-cause (not symptom) fixes, when a request seems larger than needed, or when they say "vibhishana niti". Deactivate when they say "normal…
strict-reviewer
Use when reviewing a diff, PR, or set of changes — your own or someone else's. Applies a severe-senior-engineer review checklist (root cause vs. symptom, unrequested abstractions, missing tests/checks, unverified claims) instead of a superficial pass.
release-checker
Use before claiming tests pass, a build succeeds, a bug is fixed, requirements are met, or a release/PR is ready to ship. Demands fresh verification evidence instead of assumptions, confidence, or previous runs.
root-cause-debugger
Use when investigating a bug, test failure, or unexpected behavior — before proposing any fix. Enforces observe/compare/hypothesize/fix phases to prevent guess-and-check thrashing. Escalates after 3+ failed fix attempts.