A command-line system for running A/B tests, which compare different versions of an app with separate groups of users, on live production traffic.

Use it to create app versions from branches, split traffic between variants and a control, roll out changes gradually, and query experiment results with SQL.

It lets teams compare a code change with the current version using assigned traffic and recorded output instead of relying only on local tests.

statespace — Skill for Claude Code and Codex by statespace-tech

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add statespace-tech/statespace --skill statespace

Clone the repo

git clone --depth 1 https://github.com/statespace-tech/statespace

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/statespace-tech/statespace/statespace/github.svg)](https://agentmods.dev/skills/statespace-tech/statespace/statespace)

Your own site

<a href="https://agentmods.dev/skills/statespace-tech/statespace/statespace"><img src="https://agentmods.dev/badge/skills/statespace-tech/statespace/statespace/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/statespace-tech/statespace/statespace"><img src="https://agentmods.dev/badge/skills/statespace-tech/statespace/statespace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,569 The whole file, excluding the scripts and references it only reads on demand.

Security scan D 3 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00055	$0.04569
Opus 5.5	$0.00022	$0.01828
Sonnet 5.5	$0.00011	$0.00914
Haiku 4.5	$0.00006	$0.00457

Measured yesterday against content hash 96ec540e4747, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade D, and why

statespace scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

`/var/run/docker.sock` and run as root.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -fsSL https://statespace.com/install.sh | bash

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -fsSL https://statespace.com/install.sh | bash

skills/statespace/SKILL.md · 461 lines

How it starts

The opening of the file, as written. The whole thing — 461 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Statespace

Statespace runs commits of an app on small shares of live traffic and counts what happens to their subjects.

An app is one running copy of a service, such as shop-prod. A proxy is in front of it.
An experiment compares commits in one app. Its table in statespace.toml defines it, such as [experiment.checkout].
An arm is one commit in one experiment, with an exact share of the app's subjects, such as a1b2c3d=0.05. The commit is the arm's ID.
No arm is special. To compare a change with what runs now, add the live commit as an arm.
Live gets every request that no experiment takes. Statespace never counts live or overrides.
Each start begins a new version. Evidence is per version.
Settings and experiment definitions are in statespace.toml. They change only by commits. The file in the build that live runs applies.
The evidence is on each arm's commit, as the commit status statespace/<app>/<experiment>, and in ssp experiment show.

Statespace never starts an experiment by itself. A person or an agent with permission on the GitHub repository starts it. Add --json to each ssp command to get one JSON document. With --json, an error is {"error": "..."} on standard error, with exit status 1. No command asks a question, except ssp login.

Credentials

The CLI uses the first credential that it finds:

STATESPACE_TOKEN.
The session of ssp login.
A GitHub user token in GH_TOKEN or GITHUB_TOKEN (gho_, ghp_, ghu_, github_pat_).
In GitHub Actions, the job's OIDC token. The job needs permissions: id-token: write.

Check the credential first:

ssp whoami --json

If it fails and you have no GitHub token, ask the user to run ssp login. This command opens a browser, so the user must run it.

A new workspace starts as pending. Until Statespace staff activate it, every command fails with <workspace> is pending: Statespace is reviewing your access. Tell the user, and stop. Retrying does not help.

Read the full file on GitHub · 461 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed · -22 lines 96ec540e4747
3d ago Changed · +55 lines scan C → D 3f916641597d
4d ago Changed · +46 lines 3eb915113cc6
6d ago Changed 67c75c56136c
7d ago Changed · +111 lines 77574dd9f4ab
8d ago Changed · +85 lines · +1 tokens per session 081f92c81c06
13d ago Changed · +21 lines 4f9d04afcb1c
16d ago Changed · +19 lines 984b04c79c87
18d ago Changed · +13 lines · -1 tokens per session 3ab7ea97e9ef
22d ago First seen · 133 lines · 55 tokens per session scan C 633246aa40e1

Subscribe to this mod's changes

statespace is a skill published in the GitHub repository statespace-tech/statespace (1 stars, last pushed yesterday), licensed Apache-2.0. It adds 55 tokens to every session and 4,569 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.

Analytics and metrics ab-testing ai-agents cli cloud-run continuous-delivery docker

statespace next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
statespacestatespace-tech/statespace	Skill	1	yesterday	Apache-2.0	D	55	Claude Code, Codex
harbor-daytonaav/harbor	Skill	3.3k	6d ago	Apache-2.0	A	67	Claude Code
boost-modulesav/harbor	Skill	3.3k	6d ago	Apache-2.0	A	0	Claude Code, Codex
agentbox-setupmadarco/agentbox	Skill	570	1mo ago	MIT	B	38	Claude Code
kastell-opskastelldev/kastell	Skill	59	1mo ago	Apache-2.0	A	53	Claude Code
kastell-carefulkastelldev/kastell	Skill	59	1mo ago	Apache-2.0	A	26	Claude Code
ilometio/ilo	Skill	21	3d ago	0BSD	B	181	Claude Code

statespace