Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/synaptixs/spine/understand-codebasenpx skills add synaptixs/spine --skill understand-codebasegit clone --depth 1 https://github.com/synaptixs/spineWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00185 | $0.01671 |
| Opus 5 | $0.00093 | $0.00835 |
| Sonnet 5 | $0.00037 | $0.00334 |
| Haiku 4.5 | $0.00018 | $0.00167 |
Grade A, and why
understand-codebase scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Understand a codebase with Spine
Spine reads a repository's Product Knowledge Graph — a deterministic, no-LLM index of its
modules, types, functions, call sites, and blast radius, with every fact grounded to file:line.
It covers Python, Java, TypeScript, C#, C, C++, Go and SQL.
These MCP tools turn that graph into decisions, not just lookups: what a change breaks, what's
untested, where work lands. They're read-only, need no credentials, and take a local
repo_path (default: the current repository).
Use them before grepping or guessing about an unfamiliar repo — they're faster and more accurate, and they cite their sources.
Which tool for which question
| You want to… | Call |
|---|---|
| get oriented in a repo you don't know | map_repo — languages, components, call-hotspots, test-coverage gaps, prioritized recommendations |
| know what changing a symbol will affect | blast_radius(symbol=…) — direct callers + the cross-layer set a change ripples into, each file:line |
| understand one symbol | explain_symbol(symbol=…) — kind, location, who calls it, what it calls, what it contains |
| find where a feature/ticket lands | investigate(title=…, problem=…) — the real symbols to start from |
| pin a bug from a stack trace | localize(trace=…) — resolve each frame to the repo symbol; the likely fault site |
| see what a change could break silently | regression_gaps(symbol=… or trace=…) — blast-radius symbols with no covering test |
| root-cause a bug (hypotheses + fix approach) | root_cause(bug=…) — fault site, ranked hypotheses with evidence, regression surface, fix approach; deterministic (add use_llm=true for richer hypotheses) |
| find which docs describe code (or how documented it is) | docs_for(symbol=…) — the doc pages that mention a symbol; call with no symbol for a doc-coverage summary + top drift. Ingests .md/.rst/.txt/PDF |
| ask any of the above across several repositories | blast_radius(repos=…) / investigate(repos=…) — pass a .spine/repos.yaml instead of repo_path |
| see or sanity-check the cross-repo topology | pkg_joins(config=…, mode="propose"|"check") — read-only; it never writes a config |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 100 lines · 185 tokens per session scan A ccd42db62569
understand-codebase is a skill published in the GitHub repository synaptixs/spine (8 stars, last pushed 4d ago), licensed MIT. It adds 185 tokens to every session and 1,671 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review
Use when reviewing a code change or diff for correctness, security, missing tests, and convention violations before opening or approving a PR. Review independently and adversarially, then fix high-confidence issues.
tech-spec
Use when a task is under-specified and needs a written technical specification BEFORE any code is written or changed. This skill only researches and documents — it never edits source files. Do not invoke for implementing, reviewing, or simplifying existing code.
design-restore
后台管理系统还原设计标准（restore 模式专用）。以"与效果图的还原度 Fidelity" 为唯一验收口径，替代 frontend-design 的"原创性 Originality"。提供还原契约 结构、三层裁定模型、Fidelity 6 维评分标准与校准示例、电力企业后台设计锚点。 供 restore-planner 与 frontend-evaluator（restore 分支）使用。.
restore
你是 restore orchestrator。你的职责是协调 restore-planner、frontend-generator（restore 分支）、frontend-evaluator（restore 分支），把效果图高保真还原成一个可运行的后台管理系统 demo。.
simplify
Use after writing or modifying code to improve its clarity, reuse, simplicity, and efficiency without changing behavior. Not for finding correctness bugs — that is code review.
ai-integration
Guidelines for building AI-powered features into applications. Covers tool-use agent patterns, Anthropic API integration, prompt engineering for app-internal agents, and best practices. Referenced by planner and generators. Not directly user-invocable.