Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Pharaoh-so/pharaoh-mcp --skill reviewgit clone --depth 1 https://github.com/Pharaoh-so/pharaoh-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pharaoh-so/pharaoh-mcp/review)<a href="https://agentmods.dev/skills/pharaoh-so/pharaoh-mcp/review"><img src="https://agentmods.dev/badge/skills/pharaoh-so/pharaoh-mcp/review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pharaoh-so/pharaoh-mcp/review"><img src="https://agentmods.dev/badge/skills/pharaoh-so/pharaoh-mcp/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.03861 |
| Opus 5.5 | $0.00046 | $0.01544 |
| Sonnet 5.5 | $0.00023 | $0.00772 |
| Haiku 4.5 | $0.00012 | $0.00386 |
Grade A, and why
review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 299 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review with Pharaoh
The definitive code review, for any codebase. Architecture-aware, branch-aware, multi-agent, adversarial. Five phases that combine Pharaoh's knowledge graph with parallel specialized reviewers and an independent second opinion. Every phase works without Pharaoh too; Pharaoh makes the architecture picture exact and cheap where it maps the repo.
Final verdict: SHIP / SHIP WITH CHANGES / BLOCK
When to Use
Before merging any branch. Before opening any PR. When reviewing changes that touch shared modules, export new functions, modify core data flows, or claim to implement a spec.
Phase 0 — Git Context
Goal: Know exactly what changed and where you are. This phase is mandatory and runs before anything else.
-
Detect the current environment:
git rev-parse --show-toplevel # repo root (may be a worktree) git worktree list # detect if running in a worktree git branch --show-current # current branch name git log --oneline -1 # latest commit -
Determine the base (where this branch diverged from the branch it merges into). The target is the first of these that resolves:
TARGET=$(gh pr view --json baseRefName --jq '"origin/" + .baseRefName' 2>/dev/null) # the open PR's target branch [ -n "$TARGET" ] || TARGET=$(git symbolic-ref -q --short refs/remotes/origin/HEAD) # the default branch, set by git clone [ -n "$TARGET" ] || for b in origin/main origin/master main master; do git rev-parse -q --verify "$b" >/dev/null && TARGET=$b && break done BASE=$(git merge-base HEAD "$TARGET") && echo "base: $BASE"If no base comes out, stop and ask which branch this merges into. An empty base makes every diff below come out empty, and the review would report no changes. If your shell doesn't keep variables between commands, set
BASEto the printed commit at the start of each one. -
Collect the full changeset from the base:
: "${BASE:?no base: ask which branch this merges into}" # stops here rather than diff HEAD against itself git diff --name-only "$BASE"...HEAD # all changed files git diff --stat "$BASE"...HEAD # summary stats git log --oneline "$BASE"..HEAD # all commits on this branch
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 299 lines · 115 tokens per session scan A 9fe090b1d166
review is a skill published in the GitHub repository Pharaoh-so/pharaoh-mcp (2 stars, last pushed 2d ago), licensed MIT. It adds 115 tokens to every session and 3,861 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-21.
Other skills, from other repositories
codespaces
Build and query architecture-aware code search, dependency graphs, call flows, impact analysis, and belief maps for Python, TypeScript, TSX, Rust, C#, Java, Go, Ruby, and Ruby on Rails repositories. Use before non-trivial code changes to find module boundaries, blast radius, architecture violations, and the minimal…
pull-request-automation
Audits and improves the pull request workflow for a GitHub repository. Covers PR description templates, auto-labelling, CODEOWNERS, PR size checks, and branch protection rules. Invoked when the user asks to improve the PR process, set up PR automation, or add a PR template.
codebase-intelligence
Query the codebase-intelligence CLI to understand TypeScript architecture, dependencies, blast radius, and risk before reading files. Use for any "how is this structured", "what breaks if I change X", "where is the complexity" question.
pull-request-review-gate
Use when independently reviewing a concrete pull request, merge request, commit range, patch, or repository diff for merge readiness: apply repository instructions, documented contracts, applicable ArcForge domain rules, and current candidate evidence; identify correctness, security, compatibility, regression, test…
dotnet-analyzer-code-quality
Detect code quality issues, architecture rule violations, code smells, technical debt, dead code, and performance problems in .NET projects using Roslyn-powered MCP tools. Use when the user asks to check code quality, detect code smells, measure technical debt, generate quality reports, check architecture rules, find…
spec-dogfood
Hands-off, diff-scoped browser QA of the active branch or PR. Use when a branch needs autonomous user-flow dogfooding before review or shipping: map changed flows, drive agent-browser, fix small breakages with regression tests, record human-decision blockers, and write a durable report. Do not use for collaborative UI…