Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ruvnet/metaharness/validate-harnessnpx skills add ruvnet/metaharness --skill validate-harnessgit clone --depth 1 https://github.com/ruvnet/metaharnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ruvnet/metaharness/validate-harness)<a href="https://agentmods.dev/skills/ruvnet/metaharness/validate-harness"><img src="https://agentmods.dev/badge/skills/ruvnet/metaharness/validate-harness.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.00410 |
| Opus 5 | $0.00025 | $0.00205 |
| Sonnet 5 | $0.00010 | $0.00082 |
| Haiku 4.5 | $0.00005 | $0.00041 |
Grade A, and why
validate-harness scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
validate-harness
Codex skill that runs the 5 release-readiness gates from
harness validate.
What it checks
| # | Check | What it does |
|---|---|---|
| 1 | doctor |
File shape + manifest sha256 + at-least-one host artifact |
| 2 | verify |
Witness manifest signature (Ed25519) — skipped if no witness yet |
| 3 | path-guard |
Scans your TS/JS/Rust files for hardcoded /tmp/, C:\, /Users/, /home/ — the original Windows /tmp bug regression class |
| 4 | mcp |
.mcp/servers.json entries have name + command |
| 5 | secrets |
gcloud auth list + project + NPM_TOKEN exist in GCP Secret Manager |
Each check reports PASS / FAIL / WARN with a one-line detail. Exits 1 if any FAIL.
Usage from Codex
/validate-harness
/validate-harness path=./my-harness
/validate-harness path=./my-harness skip_gcp=true
/validate-harness secret=NPM_TOKEN_DEV
Equivalent CLI
harness validate ./my-harness --skip-gcp --secret=NPM_TOKEN_DEV
Why this exists
Before iter 20, you needed to remember to run harness doctor, harness verify, harness secrets check, and node scripts/path-guard.mjs separately. This is the single release-readiness gate.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 40 lines · 50 tokens per session scan A a2850a64ffc7
validate-harness is a skill published in the GitHub repository ruvnet/metaharness (630 stars, last pushed yesterday), licensed MIT. It adds 50 tokens to every session and 410 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-performance-benchmarker
Agent skill for performance-benchmarker - invoke with $agent-performance-benchmarker.
agent-quorum-manager
Agent skill for quorum-manager - invoke with $agent-quorum-manager.
agent-agent
Agent skill for agent - invoke with $agent-agent.
agent-benchmark-suite
Agent skill for benchmark-suite - invoke with $agent-benchmark-suite.
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
agent-performance-monitor
Agent skill for performance-monitor - invoke with $agent-performance-monitor.