Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/iliaal/codesage/codesage-retrievalnpx skills add iliaal/codesage --skill codesage-retrievalgit clone --depth 1 https://github.com/iliaal/codesageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iliaal/codesage/codesage-retrieval)<a href="https://agentmods.dev/skills/iliaal/codesage/codesage-retrieval"><img src="https://agentmods.dev/badge/skills/iliaal/codesage/codesage-retrieval.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.01016 |
| Opus 5 | $0.00036 | $0.00508 |
| Sonnet 5 | $0.00015 | $0.00203 |
| Haiku 4.5 | $0.00007 | $0.00102 |
Grade B, and why
codesage-retrieval scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
The CodeSage MCP is registered globally outside this plugin. Do not add per-project or per-tool entries to `~/.codex/config.toml`. After upgrading CodeSage, start a fresh Codex thread if the current session does not expo How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodeSage Retrieval
Establish the project boundary
Run from the repository under work:
test -f .codesage/index.db && codesage status
Use CodeSage only when both checks succeed. Otherwise use rg, or ask whether to onboard the repository when indexing would materially improve the task.
Resolve the repository root to an absolute path and pass that path as project on every CodeSage MCP call. Do not pass a parent workspace. For work spanning multiple repositories, make separate calls per repository. If the scope is unclear, establish the target repository before searching; never fan out across all indexed projects.
The CodeSage MCP is registered globally outside this plugin. Do not add per-project or per-tool entries to ~/.codex/config.toml. After upgrading CodeSage, start a fresh Codex thread if the current session does not expose newly added tools.
Choose the retrieval path
Use CodeSage for semantic and code-graph questions: behavior discovery, definitions, callers, imports, dependencies, feature ownership, blast radius, history-derived coupling, risk, and test selection.
Use rg for exact literal strings, error messages, configuration keys, test names, documentation, and generated files. Prefer the smallest query that answers the question; do not export a broad context bundle when a symbol or dependency lookup is enough.
Route MCP calls
- Start unfamiliar-project orientation with
mcp__codesage__project_overviewwhen its combined language, freshness, feature, risk, and convention summary replaces several narrower calls. - Use
mcp__codesage__find_symbolfor exact definitions andmcp__codesage__find_referencesfor callers, imports, inheritance, and type uses. - Use
mcp__codesage__searchfor intent, behavior, or symptoms when the symbol name is unknown. - Use
mcp__codesage__list_featuresto discover mapped behavior slices andmcp__codesage__find_featureto identify the slice owning a file. - Use
mcp__codesage__feature_bundleafter feature discovery when the entrypoint, owned files, tests, and context for one slice are needed together. - Use
mcp__codesage__export_contextfor a curated bundle around a free-form query or symbol when no mapped feature is the right anchor. - Use
mcp__codesage__list_dependenciesfor immediate imports and importers. Usemcp__codesage__impact_analysisbefore renames, broad changes, or API-contract edits to inspect downstream blast radius. - Use
mcp__codesage__find_couplingfor historical co-change context. Readresponse.coupled; an empty list plusnotecan mean no history, no pair above the threshold, or a path mismatch. - Use
mcp__codesage__assess_riskfor one file,mcp__codesage__assess_risk_batchfor an explicit file set, andmcp__codesage__assess_risk_difffor a patch. Inspecttop_symbolswhen present. Treat clustered directories and cycles touching the patch as evidence to investigate, not proof the patch introduced them. - Use
mcp__codesage__session_startbefore substantive edits when a structural baseline is useful, thenmcp__codesage__session_endbefore completion to check for new cycles or top-risk-file drift. - Use
mcp__codesage__recommend_testsafter edits to select focused tests from changed files. Run the relevant tests; recommendations are not verification.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 67 lines · 73 tokens per session scan B 86372e8051ec
codesage-retrieval is a skill published in the GitHub repository iliaal/codesage (20 stars, last pushed 5d ago), licensed MIT. It adds 73 tokens to every session and 1,016 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codemeridian-context
Gather minimal, graph-grounded CodeMeridian context before implementation, refactoring, deletion, debugging, or test planning.
human-cognitive-seed
Preserve and strengthen the user's independent reasoning during design, strategy, learning, interpretation, hypothesis work, and consequential decisions, and preserve justified durable context with explicit provenance when supported. Use when a task benefits from human-led judgment, model-building, productive…
memtrace-decision-memory
Use Cortex decision memory through the normal Memtrace MCP tools. Trigger for free-text questions about what was decided, chosen, rejected, banned, or established as a convention; for why a symbol exists or which contracts constrain it; for whether a known decision held, drifted, or was violated; and for the…
memtrace-index
Index a source-code repo into the Memtrace knowledge graph and poll the job to completion. Use when the user asks to index, parse, ingest, reindex, watch, or prepare a source-code repo for Memtrace analysis, when code exploration needs an index, or when searches return 0/partial results for source paths under an…
memtrace-session-continuity
Catch up on everything that changed in an indexed source-code repo since the last session, using stored session anchors and Memtrace change memory. Use when the user asks to continue, catch up, resume, see what changed while away, recover prior context, or orient at session start without guessing timestamps. Do not…
memtrace-continuous-memory
Keep the Memtrace index fresh while editing by watching a repo for live, incremental re-indexing. Use when the user asks to keep Memtrace fresh while editing, watch a repo, enable live or incremental indexing, set up always-on memory (meaning Memtrace index watching, not generic agent memory), or make just-saved…