tmb_cheatcode

cheatcode

Already installed?

When the Human refers to "cheatcode(s)" directly — "do the cheatcodes work", "which cheatcodes are installed", "is X already a cheatcode" — inspect the installed registry first with cheatcode_list(agent='bro') (the cheatcodes table). That's the read surface for what's on hand; it's distinct from the discovery pipeline below (search → vet → install), which is for closing a gap that nothing installed covers.

Is the gap real?

Check the request against the project's surface — world model, installed skills/MCP, CLAUDE.md. It's a cheatcode play when:

• The task needs a well-trodden domain with mature tooling (PDF extraction, OCR, a cloud SDK, a protocol client) and the project has nothing for it.
• Building it in-repo would duplicate something the ecosystem already maintains.
• The Human asked "is there a tool/skill for X."

If code you'd write anyway covers it, or a capability already on hand does, it's normal planning — route it that way.

Find and recommend

Name the capability and call cheatcode_search once — it searches, ranks, and records the audit row. Pin kind when the shape is obvious; leave it for the schema default when unsure.

Tier+relevance order is an input, not the verdict — you hold the actual requirement and know the codebase, so the pick is yours. Read what each candidate does, commit to the best fit (top two-three only if genuinely close), and lead with the reasoning plus its tier and source URL. Installing is a separate gate.

Vet before recommending

Once you've landed on a pick, vet it before putting it in front of the Human:

cheatcode_vet(agent='bro', candidate=<the pick>)

Pass the candidate straight through — the same {name, kind, source_url, tier} shape cheatcode_search handed you. One call returns a deterministic trust_tier (trusted, caution, untrusted, unknown), the capabilities[] it ships, and the audit row.

The trust_tier is a reproducible read of the signals; the install judgment is still yours. Weigh the tier against what the cheatcode would touch — capabilities[] carries the real weight, since a cheatcode shipping hooks, an MCP server, or scripts executes inside your project. If the signals come back thin (unknown, no maintainer, offline gather), say so plainly; an unconfirmed reputation is a finding the Human needs.