ast-grep

ast-grep is a skill for Claude Code, Codex from fmind/dot. It costs 43 tokens per session (1,115 once invoked), scanned A, original, MIT.

A code search and rewrite tool that understands a program’s structure rather than matching plain text. It uses patterns with placeholders to find code while ignoring formatting, comments, and strings.

In plain words
What is it for?
Use it to search code by syntax, define lint rules, preview changes, apply bulk refactors, and produce machine-readable results.
Why use it?
It avoids false matches from text search and makes broad code changes more precise across many files or call sites.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/fmind/dot/ast-grep
Any agent
npx skills add fmind/dot --skill ast-grep
Clone the repo
git clone --depth 1 https://github.com/fmind/dot

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ast-grep

README.md
[![agentmods](https://agentmods.dev/badge/skills/fmind/dot/ast-grep.svg)](https://agentmods.dev/skills/fmind/dot/ast-grep)
Your own site
<a href="https://agentmods.dev/skills/fmind/dot/ast-grep"><img src="https://agentmods.dev/badge/skills/fmind/dot/ast-grep.svg" alt="Measured on agentmods" height="20"></a>
Per session 43 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,115 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00043 $0.01115
Opus 5 $0.00022 $0.00558
Sonnet 5 $0.00009 $0.00223
Haiku 4.5 $0.00004 $0.00112

Measured yesterday against content hash 0762aa76e687, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ast-grep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ast-grep/SKILL.md · 57 lines

How it starts

The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ast-grep

Structural code search and rewrite: a pattern is real code with meta-variables, matched against the syntax tree, so it ignores formatting and never matches inside strings or comments. Use it where rg gives false positives and where a refactor must touch every call site exactly once; plain text search stays with rg.

Commands

ast-grep run -p 'print($A)' -l python                                          # search; run is the default subcommand
ast-grep run -p 'console.log($$$ARGS)' -r 'logger.info($$$ARGS)' -l ts         # dry run: prints the diff, changes nothing
ast-grep run -p 'console.log($$$ARGS)' -r 'logger.info($$$ARGS)' -l ts --update-all   # apply after reviewing the dry run (-i to confirm per hunk)
ast-grep run -p 'func _() { os.Getenv($K) }' --selector call_expression -l go  # Go calls need a function context (see Gotchas)
ast-grep run -p 'print($A)' -l python --json=compact                           # structured output; --json=stream gives one object per line
ast-grep scan                                                                  # every rule in sgconfig.yml
ast-grep scan -r rules/no-print.yml --format github                            # one rule file; GitHub annotations in CI

Workflow

  1. Write the pattern as code: $NAME matches one node, $$$NAME a sequence (arguments, statements), $_ a node without binding; always pass -l <lang> so the pattern parses in the right grammar, and use --debug-query=ast when a pattern that should match does not.
  2. Search first: run without -r, read the matches with -C 2 for context, and tune --globs or --no-ignore when files are skipped.
  3. Rewrite in two steps: add -r to see the diff, then --update-all (or -i for an interactive session); captured meta-variables are reused in the replacement.
  4. Promote to a rule: for a lint or a repeated refactor, ast-grep new project scaffolds sgconfig.yml and rules/; a rule file has id, language, rule (pattern, kind, inside, has, not), optional fix, severity, and message; ast-grep test runs its valid and invalid cases.
  5. Wire into the gate: run ast-grep scan inside check:lint (see mise) so hooks and CI apply the same rules.

Read the full file on GitHub · 57 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 57 lines · 43 tokens per session scan A 0762aa76e687

Subscribe to this mod's changes

ast-grep is a skill published in the GitHub repository fmind/dot (4 stars, last pushed today), licensed MIT. It adds 43 tokens to every session and 1,115 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.