al-code-review

al-code-review is a skill for Claude Code, Codex from microsoft/BCQuality. It costs 44 tokens per session (881 once invoked), scanned A, original, MIT.

A skill that reviews Microsoft Dynamics 365 Business Central AL code using BCQuality rules. AL is the programming language used to customise Business Central.

In plain words
What is it for?
Use it to review AL changes, a working-tree diff, a branch, or one AL file when BCQuality is installed.
Why use it?
It gives pull requests, diffs, branches, and individual files a focused review against Business Central-specific quality rules.

Skill for Claude CodeCodex

About the project

microsoft/BCQuality is a structured knowledge base and skills library for Microsoft Business Central development. It records Business Central-specific rules and platform behaviors that coding agents or developers might otherwise get wrong. The catalogue entries provide the agents and skill that consume this guidance.

microsoft/BCQuality · 206 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/microsoft/bcquality/al-code-review
Any agent
npx skills add microsoft/BCQuality --skill al-code-review
Clone the repo
git clone --depth 1 https://github.com/microsoft/BCQuality

Made for: Claude Code, Codex.

Its marketplace also offers this one on its own, as the plugin bcquality/plugin install bcquality after adding the marketplace above.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for al-code-review

README.md
[![agentmods](https://agentmods.dev/badge/skills/microsoft/bcquality/al-code-review.svg)](https://agentmods.dev/skills/microsoft/bcquality/al-code-review)
Your own site
<a href="https://agentmods.dev/skills/microsoft/bcquality/al-code-review"><img src="https://agentmods.dev/badge/skills/microsoft/bcquality/al-code-review.svg" alt="Measured on agentmods" height="20"></a>
Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 881 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00044 $0.00881
Opus 5 $0.00022 $0.00441
Sonnet 5 $0.00009 $0.00176
Haiku 4.5 $0.00004 $0.00088

Measured 2d ago against content hash b0db3f49fdb1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

al-code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/al-code-review/SKILL.md · 70 lines

How it starts

The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AL code review

This is BCQuality's host-native adapter for standalone plugin installations. It is not a BCQuality action skill and contains no review or routing policy. Its only responsibility is to translate the caller's request into an Entry task context and execute the resulting dispatch.

Execute

  1. Resolve PLUGIN_ROOT to the directory containing this plugin's root plugin.json. This file is PLUGIN_ROOT/skills/al-code-review/SKILL.md; when the host does not expose the plugin root, resolve it two levels above this file.
  2. Build the task-context required by PLUGIN_ROOT/skills/entry.md:
    • Copy the caller's actual request verbatim into goal; do not replace a focused request such as "review performance" with a generic full-review goal.
    • Set inputs-available to the inputs actually available to the review, normally pr-diff for changes or file-path for one file.
    • Set technologies: [al] when the input is known to be AL.
    • Pass bc-version, countries, and application-area only when supplied or reliably determined.
    • If BCQUALITY_ENABLED_LAYERS is set, split its comma-separated value and pass the trimmed, non-empty entries as enabled-layers; otherwise omit the field and let Entry apply its default.
    • If BCQUALITY_DISABLED_SKILLS is set, split its comma-separated value and pass the trimmed, non-empty entries as disabled-skills; otherwise omit the field.
  3. Read and execute PLUGIN_ROOT/skills/entry.md exactly as written, including its Preparation step. Entry is authoritative for index freshness, routing, defaults, and failure behavior; this adapter must not duplicate or weaken those rules. Entry is written for a checkout whose root is the current directory, so resolve every repo-relative path it names against PLUGIN_ROOT rather than the caller's working directory, which is the user's own project. In particular, run Preparation's index build as pwsh PLUGIN_ROOT/tools/Build-KnowledgeIndex.ps1: the generator resolves its own root and writes PLUGIN_ROOT/knowledge-index.json, which is not shipped and is therefore absent on a fresh install. If pwsh is unavailable or the build fails, continue — READ falls back to path-based discovery — but do not treat a failed build as a failed review.
  4. Follow Entry's How the agent uses the dispatch instructions. Invoke only the returned action skills, pass each dispatch entry's exact input subset, and read PLUGIN_ROOT/skills/read.md and PLUGIN_ROOT/skills/do.md on demand. When a dispatched super-skill requests isolated leaf execution and the host supports child contexts, use them.
  5. Return each dispatched action skill's findings report unchanged. If Entry returns no-match or failed, return its dispatch record unchanged.

Read the full file on GitHub · 70 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 70 lines · 44 tokens per session scan A b0db3f49fdb1

Subscribe to this mod's changes

al-code-review is a skill published in the GitHub repository microsoft/BCQuality (206 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 881 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens