Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsfinetooth
A structured, multi-agent framework for verifiable whole-repository code audits with on-disk state management.
Free
finetooth
Example session with this skill installed
Use finetooth to review the access-control block H1 in examples/toy. Follow the existing review manifest and project invariants. Show the findings, verification results, hypothesis verdicts, and coverage limits. Do not fix the code yet.
- Read your context and instructions
- Compiled the finetooth
Access-control review: two confirmed findings
This demonstration uses finetooth's published toy repository, which contains intentionally defective code. The results below summarize its saved hunter and verifier reports.
The access-control block H1 has completed hunting and verification. Two findings remain open: one high severity and one medium severity. No fixes have been applied.
Findings
| ID | Severity | Finding | Evidence |
|---|---|---|---|
| H1-001 | Medium | An empty token role is accepted as a user session | sessionFor("u1:") returns { userId: "u1", admin: false } |
| H1-002 | High | Extra token segments do not prevent administrator access | canRead("u1:admin:x", "u2") returns true |
Both findings originate in src/auth/session.ts:4. The parser splits the token at colons and uses only the first two segments, without validating the complete token format.
Hypothesis verdicts
| Hypothesis | Verdict | Result |
|---|---|---|
| H1.1: An empty role must not produce a valid session | Checked — defect found | Empty role accepted; recorded as H1-001 |
| H1.2: Extra token segments must not grant administrator access | Checked — defect found | Extra segment ignored; recorded as H1-002 |
| H1.3: A non-admin must not read data belonging to an unknown owner | Checked — expected behavior observed | Non-admin denied; admin allowed |
Independent verification
The saved verifier report confirms both findings by execution and records no additional findings. It also checks a trailing-space variant: "u1:admin " is not treated as an administrator.
Coverage and limits
The hunter report names all three files in this block:
src/auth/session.tssrc/auth/guard.tstests/guard.test.ts
The verifier reports independently reviewing all three files and rechecking the hypotheses.
This is a block review, not a completed whole-repository audit. Billing block V1 remains pending. The toy repository has no live deployment environment, and the results do not establish production security.
Next steps
- Define and enforce the complete valid token format.
- Add regression tests for empty roles and extra segments.
- Have a separate fixer implement the changes.
- Run an independent fix review and the review-state checks before closing H1.
Findings and review progress remain recorded in docs/review/ for the next session.
Connects securely to your tools. The creator never sees your data.
About this skill
Finetooth is a structured whole-repository code review workflow for coding agents. It helps you define review blocks, map tracked files to blocks, and record project-specific hypotheses with explicit verdicts.
Separate hunter, verifier, fixer and fix-reviewer roles support discovery, verification and remediation. Review state, findings, reports and decisions are stored in docs/review/, allowing work to resume across sessions.
The included Python CLI generates role prompts, manages findings, checks review-state consistency and coverage records, and exports summaries and SARIF reports.
Block boundaries, project invariants and hypotheses require human and agent judgment. Coverage records make review scope and gaps visible; they do not guarantee that every line was understood or that all defects were found.
Free and open source under the MIT license.
Source code: https://github.com/mikey-semy/finetooth
What it does
- Maps tracked files to review blocks and identifies gaps in file ownership.
- Records project-specific hypotheses and their review verdicts.
- Generates instructions for separate review and remediation roles.
- Keeps findings, reports and decisions on disk across sessions.
- Checks review-state consistency and detects stale review records.
- Exports review summaries and SARIF reports.
How it works
- Initialize the review workspace and inspect the repository inventory.
- Define block boundaries, project invariants and review hypotheses.
- Run the hunter and verifier roles using generated prompts.
- Import findings and record verification decisions.
- When fixes are needed, use a separate fixer and fix reviewer.
- Check review records and generate a summary with findings, accepted risks and coverage limits.
Requirements
- A Git repository.
- Python 3; upstream tests target Python 3.12 and 3.14.
- A coding agent with file access and command execution.
- No third-party Python dependencies.
Model access and usage are provided by your chosen agent or provider and are not included in this free download.
Use cases
- Structured whole-repository review of an existing codebase.
- Resuming a review across multiple agent sessions.
- Tracking findings through independent verification, fixes and fix review.
- Running review-state consistency checks in CI.
- Exporting findings as SARIF for supported integrations.
Permissions and network behavior
The coding agent needs to read project files, run commands and write review reports. Fixing tasks also require permission to modify project code.
The Python review tool makes no network requests. Agents use their own configured permissions and model provider.
The optional assets/run-role.sh runner invokes Claude Code in headless mode and sends prompts through its model provider. See SECURITY.md for details.
Included finetooth version: 0.8.0.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Free forever
No account required to browse
Trust & safety
Security scanned
Verified clean 13 days ago
- Free to download with an account
Requires
Python
Node.js