DietrichGebert/ponytail

What it claims

Ponytail 5 is a rewrite of a single prompt (skills/ponytail/SKILL.md) that tells a coding agent to write only what a task needs, reuse what the repo and platform already provide, and never cut trust-boundary validation, data-loss handling, security or accessibility. Beyond the headline deltas in the summary, the page reports two further results. In a blind comparison, Ponytail 5's replies beat the previous Ponytail's 110 to 67. On six security tasks (SQL injection, path traversal, forged tokens, rate limiting, malformed CSV rows, caching), it passed all 30 runs.

How it works

The prompt works in this order:

1. Read the code the change touches and trace the real flow first.
2. Only then pick a "rung" on a ladder of solutions, preferring existing components and platform features over new code. The page's example is a date picker: 335 lines without Ponytail, versus 10 lines using the repo's Input component and the browser's native date picker.

The prompt also sets these rules:

• Tests: logic with a branch, loop, parser, money or security must leave one small test.
• End-of-reply report: every reply ends with what was skipped or not checked, plus any risks.
• Shortcut comments: deliberate shortcuts are marked with shortcut: comments. /ponytail-debt collects them into a ledger, and the marker word can be changed via CLAUDE.md/AGENTS.md and /ponytail-debt <your word>.

The commands:

• /ponytail-review reads the surrounding code, not just the diff. It checks bugs, security, load, missing tests, speed and cuts, and each finding includes what the code does, the failure, the fix, and the consequence of not fixing it.
• /ponytail-audit maps the whole repo first (entry points, data flow, expected load), then ranks findings by fix order.
• Levels are switchable, including /ponytail ultra.

How to use it

Claude Code, entered as two separate prompts:

/plugin marketplace add DietrichGebert/ponytail
/plugin install ponytail@ponytail

Codex:

codex plugin marketplace add DietrichGebert/ponytail
codex plugin add ponytail@ponytail

In Codex you then open /hooks, trust its two lifecycle hooks, and start a new thread. Commands are namespaced there, e.g. $ponytail:ponytail-review.

For other agents, copy AGENTS.md into the project, or install SKILL.md as a skill. Per-tool steps are in INSTALL.md.

Configuration is optional: ~/.config/ponytail/config.json or the PONYTAIL_DEFAULT_MODE env var sets the default level.

The cost/token band:

• Requires Claude Code 2.1.290 or later, in the terminal or the desktop app.
• /ponytail band toggles it on and off.
• Data stays local in ~/.config/ponytail/band/.
• /ponytail band import backfills past Claude Code sessions into the board.

Licence: MIT.

Limits

• Benchmark scope: the benchmark covers one agent and one model (Claude Code, Opus 5.5), 39 tasks, 5 runs each. Method, per-task tables and stated limits are in benchmarks/results/2026-10-07-agentic.md, which was not part of the fetched text.
• Where the band doesn't appear: the VS Code chat panel, cloud sessions, and claude -p.
• Commands need a skill-capable host: Claude Code, Codex, Devin CLI, OpenCode, Gemini, Antigravity CLI, pi, Hermes Agent, Qoder, or Grok Build.
• Partial support: Cursor with hooks gets only /ponytail level switching, typed as a plain message.
• Rules only, no commands: Cursor's rule file, Windsurf, Cline, Copilot, Kiro, and the Antigravity AGENTS.md fallback load the always-on rules without any commands.
• Supply-chain warning from the author: install only from DietrichGebert/ponytail on GitHub or @dietrichgebert/ponytail on npm. The project never ships .exe or .dll files, so a copy that does is not genuine.