Ponytail: one YAGNI prompt, loaded into a dozen coding agents

Everything in the repo exists to load one SKILL.md

Ponytail is one prompt: skills/ponytail/SKILL.md. A compact version of the same rules sits in AGENTS.md for agents that read a rules file instead of skills. The rest of the repository is delivery plumbing, which is why the top level is crowded with agent-specific folders: .claude-plugin/, .codex-plugin/, .cursor/, .windsurf/, .kiro/, .opencode/, .qoder/, .grok-plugin/, .kimi-plugin/, .devin-plugin/, .clinerules/ and a pi-extension/ directory, plus gemini-extension.json and opencode.json.

The npm package @dietrichgebert/ponytail (version 5.3.3) ships only AGENTS.md, hooks/, skills/, .opencode/, .qoder/, .qoder-plugin/, pi-extension/ (minus its tests), two scripts (uninstall.js and cursor-hooks.js) and the LICENSE. Its main export points at ./.opencode/plugins/ponytail.mjs, and a pi block registers ./pi-extension/index.js and the ./skills folder. In practice this means the behaviour you get is the prompt; the per-agent folders only decide how it is injected. If you want to know what the agent will be told, read SKILL.md, not the plugin code.

The ladder runs after the agent has read the code

The rule is not fewest tokens. It is: write only what the task needs, and never cut validation, error handling, security or accessibility. Ponytail describes a ladder of solutions that the agent climbs only after it understands the problem. It reads the code the change touches and traces the real flow before picking a rung, so the laziness applies to the solution and not to reading.

The date picker example shows the effect. Asked for a date picker, an agent without Ponytail installs a library or builds a calendar by hand, 335 lines. With Ponytail 5 it notices the repo already has an Input component and that every browser ships a native date picker, and combines them in 10 lines. The examples/ folder holds more cases: csv-sum, debounce, deep-clone, email-validation, group-by, infinite-scroll, modal-dialog, number-formatting, rate-limit, react-countdown and url-params.

Two guardrails keep this from turning into code golf. Logic with a branch, a loop, a parser, money or security leaves one small test behind. And every reply ends with what was skipped or not checked, plus any risk you should know about.

/ponytail-review reads past the diff, /ponytail-audit maps the repo first

Before version 5, /ponytail-review only looked for code to cut. Now it reads the code your change touches, not just the diff, and checks bugs, security, real load, missing tests, speed, and what to cut. Each finding states what the code does, what goes wrong, how to fix it, and what happens if you do not.

/ponytail-audit runs the same checks across the whole repository. It first maps entry points, how data moves and what load the project expects, then ranks findings and says what to fix first. The older audit only produced a list of deletions.

The consequence for readers upgrading from an older Ponytail is that review output is no longer a short list of removals. Expect findings about bugs and load alongside the cuts, and budget review time accordingly. For heavier pressure there is /ponytail ultra, a mode the project jokes exists for when the codebase has wronged you personally; startup and mode-change text shows which mode is active.

Claude Code and Codex install as plugins, everything else copies a file

In Claude Code the install is two separate prompts, entered one after the other:

/plugin marketplace add DietrichGebert/ponytail

/plugin install ponytail@ponytail

Codex uses its own plugin commands:

codex plugin marketplace add DietrichGebert/ponytail
codex plugin add ponytail@ponytail

Codex needs one more manual step: open /hooks, trust Ponytail's two lifecycle hooks, and start a new thread. If you skip the trust step, the hooks do not run, so do not judge the plugin from the thread you installed it in.

For Copilot, Cursor, OpenCode, Gemini and other agents, the path is to copy AGENTS.md into your project or ask the agent to install skills/ponytail/SKILL.md as a skill, with per-agent steps in INSTALL.md. Agents that only take AGENTS.md get the compact rules rather than the full SKILL.md, so if your agent can load skills, the full file is the closer match to what was benchmarked.

The band only renders in terminal and desktop Claude Code

Version 5.3 added the band, a strip above the Claude Code prompt that shows what the current task costs, its tokens and agent time, how often the agent reused existing code instead of writing new code, and whether tests passed after the last change. Its buttons switch the level, run /ponytail-review or /ponytail-audit, copy the task as Markdown, and fold the band into one line. /ponytail band hides it and the same command brings it back.

The band needs Claude Code 2.1.290 or later, in the terminal or the desktop app. It does not show in the VS Code chat panel, in cloud sessions, or in claude -p. If your team runs Claude Code mostly from VS Code or in headless claude -p jobs, you get the prompt and the commands but none of the cost and reuse telemetry, and Codex, Cursor and the other agents do not get the band at all.

Board keeps session history in a local folder

Board opens a local page listing every task across your projects: cost, agent time and tokens over time, each session with its tests, and the days you worked. By default the data stays on your machine in ~/.config/ponytail/band/. Running /ponytail band import pulls your past Claude Code sessions into it with their cost, agent time and tokens.

Because the store is a per-machine folder, Board is a personal view. Moving between laptops or wiping that directory means the history does not follow you unless you copy the folder yourself, and sessions from agents other than Claude Code are not part of the import.

The headline savings come from one harness

Ponytail 5 claims 53% less code, 41% less time, 26% lower cost and 45% fewer tokens, with 98% of risky logic shipping with a test against 68% without the skill. Those figures come from Claude Code running Opus 5.5, with and without the skill, across 39 tasks including a real FastAPI and React repository, five runs each. In a blind comparison, Ponytail 5's replies beat the previous Ponytail's 110 to 67, and on six security tasks (SQL injection, path traversal, forged tokens, rate limiting, malformed CSV rows, caching) it passed all 30 runs. Method, per-task tables and stated limits are in benchmarks/results/2026-10-07-agentic.md.

No figures are published for Codex, Cursor, Copilot or the AGENTS.md path. If you run Ponytail anywhere other than Claude Code with Opus 5.5, the percentages are not evidence for your setup, and you need to measure on your own tasks before quoting them to anyone.

Install only from the two official sources

The project warns that Ponytail should only be installed from DietrichGebert/ponytail on GitHub or @dietrichgebert/ponytail on npm, and that it never ships .exe or .dll files. A download claiming to be Ponytail that contains a Windows binary is not the real package. The project is MIT licensed and moving fast: v5.3.1 and v5.3.2 both landed on 2026-10-16, v5.3.3 followed on 2026-10-29, and the last push to main was the same day. Pin a version if you need stable review behaviour across a team, since the prompt itself is what changes between releases.

Editorial conclusion

Ponytail suits developers whose agents keep reaching for new libraries and hand-built abstractions when the repo already has the parts, and who want a /ponytail-review that reads past the diff. Claude Code users get the most, since the band and Board live there. Skip it if you need the band in the VS Code chat panel, cloud sessions or claude -p, where it does not render. Before adopting it, confirm your Claude Code version is 2.1.290 or later and rerun a few of your own tasks, because the published savings come from one Claude Code and Opus 5.5 harness.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes