agent-eval

A set of tools for testing AI agents for answer quality, safety, citation accuracy, tracing, and cost.

In plain words
What is it for?
Use it while building or shipping agents to record runs, score outputs, inspect history, check research citations, and measure usage costs.
Why use it?
It helps reveal incomplete or unsafe answers, personal-data leaks, prompt injection, unsupported claims, and requests that exceed a spending limit.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/iris-eval/mcp-server/agent-eval
Any agent
npx skills add iris-eval/mcp-server --skill agent-eval
Clone the repo
git clone --depth 1 https://github.com/iris-eval/mcp-server

Made for: Claude Code, Codex.

Per session 96 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 687 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00096 $0.00687
Opus 5 $0.00048 $0.00344
Sonnet 5 $0.00019 $0.00137
Haiku 4.5 $0.00010 $0.00069

Measured 2d ago against content hash ebe212ba9261, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

agent-eval scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

claude-plugin/skills/agent-eval/SKILL.md · 53 lines

How it starts

The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agent Eval with Iris

Iris is an MCP server for agent evaluation. If this plugin is installed, its nine tools are already available — no setup needed. If the tools are missing, the server starts with npx -y @iris-eval/mcp-server in any MCP client config.

Core workflow (eval loop)

  1. Log the agent execution: log_trace with spans, tool calls, token usage, and cost. This builds the record everything else reads.
  2. Score the output: evaluate_output runs 13 built-in rules across completeness, relevance, safety (19 PII patterns, 37 injection patterns, 25 hallucination markers), and cost. Heuristic, deterministic, free. Pass input so the hallucination signals can cross-check the output against the material the agent was given.
  3. Judge semantically when heuristics aren't enough: evaluate_with_llm_judge (templates: accuracy, helpfulness, safety, correctness, faithfulness). Requires the user's own API key in IRIS_ANTHROPIC_API_KEY or IRIS_OPENAI_API_KEY — Iris never proxies.
  4. Verify citations in research/RAG outputs: verify_citations extracts citations, fetches sources (SSRF-guarded, opt-in), and checks each claim.
  5. Inspect history: get_traces with filters; costs aggregate across agents and time windows.

Custom rules

deploy_rule registers a custom eval rule (Zod schema) that fires on every matching evaluate_output. list_rules enumerates; delete_rule removes. Use custom rules to encode product-specific quality bars — a required disclaimer, banned phrases, output length bands, expected coverage terms.

Patterns worth suggesting

  • Quality gate before ship: evaluate representative outputs; treat any safety-rule failure as blocking. Cost rules catch budget regressions.
  • Eval-driven development: write rules first (the quality spec), then iterate the agent until they pass — the eval loop is the test suite.
  • Regression tracking: log traces in CI runs; compare score drift across versions to catch silent quality decay (eval drift).

Read the full file on GitHub · 53 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 53 lines · 96 tokens per session scan A ebe212ba9261

Subscribe to this mod's changes

agent-eval is a skill published in the GitHub repository iris-eval/mcp-server (7 stars, last pushed 8d ago), licensed MIT. It adds 96 tokens to every session and 687 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.