Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hashgraph-online/awesome-codex-plugins --skill codegraphgit clone --depth 1 https://github.com/hashgraph-online/awesome-codex-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hashgraph-online/awesome-codex-plugins/codegraph)<a href="https://agentmods.dev/skills/hashgraph-online/awesome-codex-plugins/codegraph"><img src="https://agentmods.dev/badge/skills/hashgraph-online/awesome-codex-plugins/codegraph.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00811 |
| Opus 5 | $0.00028 | $0.00405 |
| Sonnet 5 | $0.00011 | $0.00162 |
| Haiku 4.5 | $0.00006 | $0.00081 |
Grade A, and why
codegraph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CodeGraph
用途
- 对已初始化的目标项目做本地代码图谱查询：符号搜索、callers/callees、impact、focused context。
- 在设计、执行和评审前补结构证据，减少依赖纯文本搜索造成的遗漏。
- 为
/team-plan、/team-execute、/team-review提供可追溯的 MCP-backed 影响面证据。
触发信号
- brownfield 项目需要快速回答“这个 symbol 在哪里”“谁调用它”“改它会影响谁”。
- 目标 agent 已通过 TSP 安装流程配置 CodeGraph MCP，且目标项目存在
.codegraph/。 - Graphify 的轻量结构证据不足，或者需要比 GitNexus 更贴近当前 agent MCP 工具面的本地查询。
默认工作流
- 先跑
npm run codegraph:doctor，确认 standalone CodeGraph binary、官方 installer 依赖和当前 target wrapper 可用。 - Claude 新项目会通过
SessionStart自动初始化索引；非 Claude 或关闭自动初始化时，在消费方目标项目根目录手动初始化：codegraph init -i - 通过 MCP 或 CLI 使用
search/context/callers/callees/impact/node/files/status查询。 - 把关键发现回落到主链：
- 规划阶段 ->
/team-plan的 Brownfield Context Snapshot 和 readiness 证据 - 执行阶段 ->
/team-execute的 story slice 影响面说明 - 评审阶段 ->
/team-review的风险、回归边界和放行建议
- 规划阶段 ->
输出约定
- CodeGraph 数据库由上游工具管理，通常写入目标项目
.codegraph/。 - TSP 侧只沉淀结论，不沉淀上游数据库：
- 分析目标
- 查询入口（MCP tool 或 CLI 命令）
- 核心发现
- 对
/team-*决策的影响 - 后续验证或回退建议
边界与禁用项
- TSP 安装时只运行
scripts/install-codegraph.jswrapper，不使用上游--target=auto。 - Claude
SessionStart可在新项目缺少.codegraph/codegraph.db时静默执行codegraph init -i <projectRoot>；用TSP_CODEGRAPH_AUTO_INIT=0可关闭。 - Codex / OpenCode 不做侵入式自动 hook，只依赖全局 MCP 配置、说明和 doctor 诊断。
- 不提交
.codegraph/数据库或将其作为 TSP artifact。 - CodeGraph 结论不能绕过
/team-plan、/team-review或验证门禁。
推荐组合
- 默认 brownfield 结构证据：
/team-help -> /update-codemaps -> npm run codegraph:doctor -> Claude 自动初始化或 codegraph init -i -> /team-plan - 快速影响面确认：
/team-execute -> CodeGraph impact/callers/callees -> /handoff -> /team-review - 深度多仓或许可证受限场景：按需选择 GitNexus 或 Graphify，并把结论统一回落到主链。
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 59 lines · 55 tokens per session scan A 261ad8141957
codegraph is a skill published in the GitHub repository hashgraph-online/awesome-codex-plugins (956 stars, last pushed today), licensed Apache-2.0. It adds 55 tokens to every session and 811 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
issue-root-resolution
Trigger: root audit, atacar la raíz, issue roots, backlog roots, mechanism map, deletion-driven fix, resolver issues de raíz, close outdated issues. Audit and resolve issue clusters by verified root cause.
search
Search 2500+ curated ChatGPT and LLM open-source repositories. Use when the user asks to find tools, libraries, or repos related to ChatGPT, LLMs, RAG, agents, langchain, NLP, AI development, or any open-source AI tooling.
review-prs
Triage open PRs — screen from the diff, delegate the admission judgment to audit-the-list, then merge or close on GitHub. Fire when the maintainer asks to review PRs, process the PR queue, or judge whether a specific PR should be merged.
preview-verdicts
Generate the interactive keep/drop verdict preview (HTML page with per-row feedback controls) whenever a prune sweep, batch entry edit, or restructure needs maintainer review before touching README.md — and process the feedback JSON the maintainer pastes back.
fact-checker
Anti-hallucination discipline for any code that names an external symbol you aren't certain exists — a library function, method, config key, package version, CLI flag, env var, or endpoint. Before you call it, cite it, or import it, confirm it's real: grep the codebase, read the installed package's actual signature…
check-mcp-json
Safely review, triage, repair, and merge ToolSDK MCP Registry package JSON pull requests. Use when an agent needs to validate files under packages/, detect duplicate registry keys, classify community PRs, make authorized fixes on contributor branches, close invalid or duplicate PRs, or squash-merge approved PRs.