.claude/agents/security-guard.md
- Role
- Security reviewer
- Tools
- Read, Search, Shell
- Output
- findings-v1
One agent role, three independent reviewers
Experiment
Built to find out whether independent agents on separate model CLIs produce a review worth reading. They do. I am not developing it further for now — it is here for what it explored, and it still runs.
Paused, not broken
The thesis One model can miss.Three models can disagree. Both outcomes are useful.
I stopped looking for the best model. I look for models that fail differently.
The arena
The arena.
Independent first. Adversarial after.
| Grok | Codex | Claude | Judge | |
|---|---|---|---|---|
| Round 1 Independent audit | G-01 authorization boundary — src/auth.py:84 | C-01 retry race — tests/retry_test.py:112 | A-01 validation gap — src/validate.py:57 | — |
| Round 2 Cross-critique | C-01 Keep tests/retry_test.py:112 A-01 Adopt src/validate.py:57 G-02 New src/rate_limit.py:33 | G-01 Keep src/auth.py:84 A-01 Withdraw src/validate.py:57 C-02 New src/backoff.py:21 | G-01 Keep src/auth.py:84 C-01 Adopt tests/retry_test.py:112 A-02 New src/parse.py:91 | — |
| Round 3 Movement check | positions changed: 2 continue: yes | positions changed: 2 continue: yes | positions changed: 1 continue: yes | — |
| Round 4 Convergence check | positions changed: 0 converged: stop | positions changed: 0 converged: stop | positions changed: 0 converged: stop | G-01 Verified C-01 Verified A-02 Rejected G-02 Merged C-02 Verified |
Status key KeepKeep as is
WithdrawWithdraw claim
AdoptAdopt from others
NewNew claim
Scoreboard
Illustrative run. Only findings that survive code verification reach the score.
| Verified | Adopted | Withdrawn | Score | |
|---|---|---|---|---|
| Grok | 6 | 2 | 1 | 7 |
| Codex | 7 | 2 | 1 | 8 |
| Claude | 5 | 1 | 2 | 3 |
One arena run
Timeline.
-
Audit independently
Each model inspects the codebase alone.
-
Cross-critique
Exchange claims and apply statuses: keep, withdraw, adopt, new.
-
Continue while positions move
Engine repeats rounds until positions stop moving.
-
Judge disputed claims
Judge checks real files and marks outcomes: verified, rejected, merged.
-
Rank verified findings
Scoreboard includes only verified findings.
Findings contract
Claims enter. Evidence leaves.
A model assertion, in whatever shape it arrives.
file · line · severitycategory · descriptionproposed fix
The claim is read against the code it names.
Code-grounded. Only these reach the scoreboard.
The scoreboard counts only what survived verification.
install and run
claude ▸
/plugin marketplace add serdardb/multi-agent
claude ▸
/plugin install multi-agent@multi-agent
claude ▸
/reload-plugins
required the first time
claude ▸
/arena
pick agent, models, rounds, judge; watch in /workflows
claude ▸
/multi-agent security-guard codex "review the webhook subsystem"
Host optional.arena-v1 out.
the engine, headless
$
python3 plugin/arena.py list
usable models + available agents, as JSON
$
python3 plugin/arena.py suggest-mode --topic "audit the webhooks"
asks a model which approach fits
$
python3 plugin/arena.py once --model grok --agent security-guard
one model, one pass, arena-v1 out
$
python3 plugin/arena.py run --agent security-guard --models grok,codex,claude --judge
the full pipeline, host optional
Independent review is not free.
More models → more turnsMore rounds → more timeEvery round waits for the slowest model
One core, one adapter per CLI
core.py never learns about a specific model: it normalizes your agent into a portable form, maps its tools onto a neutral capability vocabulary, and each adapter maps those onto its CLI's own tool names. Tools with no mapping are reported, never silently dropped. Adding a CLI is one adapter file; the core changes only for new features. Every spawned process starts in its own group and dies as a tree, no orphans.Findings are a contract
Whatever a model produces is normalized into
findings-v1: file, line, severity from critical to low, category, description and a proposed fix. Cross-model findings stay unverified claims until the judge confirms them against the real files, and the scoreboard only counts what survived that check.Costs, stated plainly
A full adversarial run is heavy: many model turns, several rounds, minutes to tens of minutes, real token spend. Each round waits for the slowest model. For quick work use fewer models and rounds, or the single-model /multi-agent. Roadmap: Codex and Grok native wrappers, and an MCP server exposing the arena to any MCP-capable CLI.
Do not ask one model twice.Ask another model once.
/plugin marketplace add serdardb/multi-agent
3 sample agents · test fixtureMIT / experimentPython 3, stdlib only. No API keys.