# Agentscan

> Use when auditing or changing agent config — hooks, skills, MCP, AGENTS.md, skills-lock.json. Run before editing hooks or claiming a guard is in place.

- Skill: `simaalexandru99/agentscan` (Agent Skill)
- Install (CLI): `npx skillmds@latest add simaalexandru99/agentscan`
- Raw SKILL.md: https://api.skillmd.com/api/skills/simaalexandru99/agentscan/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: SimaAlexandru99 (https://skillmd.com/u/simaalexandru99)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/simaalexandru99/agentscan

---


# agentscan

Read-only linter for agent config. Findings are facts.

## When

- Hook, skill, MCP, or `AGENTS.md` work
- Someone says a guard is on and you have not verified the script
- A PR touches `.claude/`, `.commandcode/`, `.agents/`, `.grok/`, `.devin/`, `.windsurf/`, `.codex/`, `.mcp.json`, or `skills-lock.json`

## Do

From the repo root:

```bash
npx @chimix/agentscan@latest --output prompt
```

`--output prompt` is the handoff for the agent that fixes. Do not skip `claude.hook.missing-script` (error).

No project handy:

```bash
npx @chimix/agentscan@latest demo
```

`demo` builds a throwaway fixture, prints the report, and deletes the fixture.

## Don't

- Write the scanned tree
- Guess with the model whether a hook is valid
- Compare a skill's frontmatter `name` to its directory, or validate model ids