Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HuginnIndustries/CodeCartographer --skill traversegit clone --depth 1 https://github.com/HuginnIndustries/CodeCartographerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huginnindustries/codecartographer/traverse)<a href="https://agentmods.dev/skills/huginnindustries/codecartographer/traverse"><img src="https://agentmods.dev/badge/skills/huginnindustries/codecartographer/traverse/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huginnindustries/codecartographer/traverse"><img src="https://agentmods.dev/badge/skills/huginnindustries/codecartographer/traverse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.01679 |
| Opus 5.5 | $0.00036 | $0.00672 |
| Sonnet 5.5 | $0.00018 | $0.00336 |
| Haiku 4.5 | $0.00009 | $0.00168 |
Grade A, and why
traverse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Traverse: the supervised change loop
You are working on a change that CodeCartographer is keeping records for. This
document is the procedure. It is prose, and prose is not enforcement — the
refusals described here live in core/engineering/, and this document can only
tell you what they are. If this text and the code ever disagree, the code wins
and this document is a bug.
What this loop is for
A change moves through a fixed shape: intake, plan, attempt, observe, review, accept. The records exist so that a session that dies in the middle can be picked up by a different agent, on a different machine, a week later, and reach the same next action. That only works if you write down what you did.
CodeCartographer never executes anything. It does not run your build, your tests, or your migration. You do. It records what you report and refuses conclusions the records do not support.
Intake
Before any work: a change record must exist, with a mode (fix, feature,
refactor, migration, investigation), a requested outcome in plain words,
and a baseline that identifies what you started from.
A fix asserts a defect exists. If you have not confirmed the defect — seen it
fail, not merely been told it fails — the honest mode is investigation.
Recording a fix for a defect nobody confirmed is how a change gets accepted for
solving a problem that was never there.
Readiness
The next step is decided by planTraverseStep in core/engineering/: from the
records and the bounds and capability you declare, it names one action. No
codecarto_change action and no Pi command calls it yet. Over MCP, read the
records with show and the gate's verdict with gate, and take the next action
in the order this document describes; a host that embeds the library calls the
planner directly. Either way, before you take a step, check what the loop needs
against what you actually have:
- Bounds. The loop refuses to plan at all unless you declare
max_attempts(a positive integer) andmax_wall_clock_ms(a positive finite number). There is no default. A loop that picks a limit for you hides that you never picked one — and a bound that cannot bound is worse than a missing one, because it reads as a limit in the step you get back.NaN,Infinity, zero and negatives are refused. - Execution. If you cannot run the work, say so (
can_execute: false) and the loop stops instead of asking you to attempt something you cannot do. - A human. If you have no way to reach a person for a decision, say so
(
can_obtain_human_decision: false). The loop will stop at the point a human is required rather than proceeding without one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +5 lines 8c5e28d93a05
- 24d ago First seen · 139 lines · 90 tokens per session scan A 95338bebd57a
traverse is a skill published in the GitHub repository HuginnIndustries/CodeCartographer (6 stars, last pushed 9d ago), licensed MIT. It adds 90 tokens to every session and 1,679 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-22.
Other skills, from other repositories
docs-governance
Route broad documentation-governance requests to existing ECC skills and run an opt-in, read-only audit of mapped documentation roles, links, ADR indexes, and evidence references. Use when a user asks for documentation governance, project-knowledge organization, documentation integrity, or a deterministic docs audit…
meeting-action-items
Turn meeting notes into cited decisions, owners, tickets.
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
coordinator
Take over as coordinator of the current LangWatch drive: read the live state from disk (the lane roster, the newest handover, the shape counters), report it, then work the handover's next action by writing manifests and spawning lanes. Replaces pasting a brief out of a handover document - the state is read, never…
company-employee
The protocol every employee of a PenguinHarness organization follows — read the handbook first, act on [orgtrigger] work runs, schedule tickets from the desk session and do the work in ticket sessions, block instead of idling, ask the board in the all-hands channel before anything heavy, costly, irreversible or…
company-ceo
Run a PenguinHarness organization as its CEO — turn the mission into a ticket tree, hire HR and finance first, partition the shared workspace, schedule the calendar, open a channel per stream, review tickets and report to the board in the all-hands channel.