Undercut for Tabnine

Tabnine CLI already has a native Agent Skills loader. Give it one that stops overpaying.

Undercut is a free, MIT-licensed routing policy you drop straight into the SKILL.md discovery path Tabnine's own CLI docs describe — cheap tier first, escalate only on evidence, never on a vibe. Tabnine Agent has no built-in per-task cost dial of its own to compare against; this exists because the same overpay-by-default pattern we measured elsewhere in the agent ecosystem (see the Claude Code page) shows up anywhere an agent defaults every task to its strongest model.

Install for Tabnine See the benchmarks
CLI-specific feature

Agent Skills, the mechanism this page targets, is documented under Tabnine CLI specifically — Tabnine's docs don't say whether it also applies inside the VS Code or JetBrains IDE extensions. If you drive Tabnine only through an IDE plugin rather than the standalone CLI, the Agent Guidelines path below (.tabnine/guidelines/) is the one confirmed to apply broadly across IDE, CLI, and chat. Source: Tabnine's Agent Skills docs.

Works anywhere a routing policy can be read
Claude Code Codex Cursor Copilot OpenCode Gemini CLI Tabnine

How this maps onto Tabnine

Agent Skills is Tabnine CLI's documented, first-class SKILL.md mechanism.

Per Tabnine's own Agent Skills reference, Tabnine CLI discovers skills from a defined six-level precedence — built-ins, installed extensions, a personal ~/.tabnine/agent/skills/<name>/SKILL.md, its alias ~/.agents/skills/<name>/SKILL.md, a project-level <project>/.tabnine/agent/skills/<name>/SKILL.md, and its alias <project>/.agents/skills/<name>/SKILL.md (workspace beats user, alias paths take highest precedence). Each entry is a SKILL.md file with a YAML frontmatter block — name and description are the two documented required fields, the same shape Undercut already ships — found "at the root level or one subdirectory deep." Tabnine's agent reads every skill's name and description up front and calls an internal activate_skill tool to load the full body only when a request matches, the same progressive-disclosure model as Claude Code's own Skills.

That's a genuinely good fit: of every client this site covers, Tabnine CLI is one of the few with a documented, native SKILL.md-shaped discovery path rather than a repurposed rules file. Tabnine separately documents Agent Guidelines — plain markdown files in .tabnine/guidelines/ (home directory or per-project) that are "injected automatically at the start of every agent session," across IDE, CLI, and chat. Tabnine's own framing draws the same line other Skill-native tools do: Guidelines are for always-on custom system prompts, workflow rules, and team standards; a Skill is a reusable capability the agent activates when the request matches its description. Undercut's routing rubric is a reusable workflow the agent chooses to apply to matching work, not a standing house rule, so the Skills path is the better-fitting home for it — with a Guidelines append as a belt-and-suspenders option below for when you want it always in context instead.

Undercut's tier names — cheap, standard, frontier, apex — are generic on purpose. Tabnine lets teams and enterprises choose from several backing models, so models.md gives a rule of thumb rather than a fixed slug: cheap resolves to the smallest/fastest model your Tabnine workspace has enabled, standard to the default agent model, frontier to the highest-reasoning model on offer, and apex to a single batched tie-break call. Nothing here sits between the agent and its model backend — it's plain markdown text Tabnine reads into context, no proxy, no network hop, nothing to route around if you remove the folder.

Install for Tabnine

Free. MIT. Nothing installs, nothing proxies your traffic.

Option 1 — Tabnine's own skills installer (fastest, confirmed path)

Tabnine CLI ships its own installer that pulls a skill straight from a subdirectory of a Git repo — per Tabnine's Agent Skills docs, tabnine skills install <git-url> --path <path> is the documented syntax for exactly this case. Run it from your project root for workspace scope:

$ tabnine skills install https://github.com/undercutsh/firstpass.git --path skills/firstpass --scope workspace

Swap --scope workspace for --scope user to install once for every project instead of just this one. Note that skills.sh, the picker other client pages on this site link to, does not list Tabnine as an install target — this command is Tabnine's own, not skills.sh's.

Option 2 — copy it by hand

If you'd rather not run an installer, the directory shape is documented directly: a folder named after the skill, containing a file named exactly SKILL.md, under one of Tabnine's six discovery locations. This drops it into the project-level path:

$ mkdir -p .tabnine/agent/skills/firstpass && curl -fsSL https://raw.githubusercontent.com/undercutsh/firstpass/main/skills/firstpass/SKILL.md -o .tabnine/agent/skills/firstpass/SKILL.md && curl -fsSL https://raw.githubusercontent.com/undercutsh/firstpass/main/skills/firstpass/models.md -o .tabnine/agent/skills/firstpass/models.md

Prefer it available in every repo instead of just this one? Use ~/.tabnine/agent/skills/firstpass (personal scope) instead of the project path above.

Option 3 — also add it to Agent Guidelines

Belt-and-suspenders: if you'd rather the rubric read as a standing rule injected into every session rather than a workflow the agent has to choose to invoke, append the same text to .tabnine/guidelines/, which Tabnine's Agent Guidelines docs say is "injected automatically at the start of every agent session" — across IDE, CLI, and chat, not just the CLI's Skills path.

$ mkdir -p .tabnine/guidelines && curl -fsSL https://raw.githubusercontent.com/undercutsh/firstpass/main/skills/firstpass/SKILL.md -o .tabnine/guidelines/firstpass.md

What's still unverified: we have confirmed the six-level discovery precedence, the SKILL.md shape, and the tabnine skills install syntax (including its --path and --scope flags) directly against Tabnine's own docs, but we have not run any of these commands against a live Tabnine CLI session ourselves. skills.sh does not list Tabnine as an install target, so the generic npx skills add undercutsh/firstpass referenced on other pages of this site does not apply here — use Option 1 or 2 above instead. We also have not independently confirmed whether Agent Skills apply inside Tabnine's IDE plugins (VS Code, JetBrains) or only the standalone CLI — Tabnine's docs describe this feature exclusively under "Tabnine CLI," see the banner above — nor how reliably the agent self-invokes this skill versus waiting to be asked by name.

Validate it yourself

  1. 1Read the published results — testing/README.md and the raw JSON in testing/results/
  2. 2Reproduce for free, no API key, no spend: node src/main.js --mock
  3. 3Run tabnine skills list to confirm it discovered firstpass, then describe a batch of mechanical work and check which tier it names — a single smoke test is pennies

Zero lock-in. It's a folder the agent reads — run tabnine skills uninstall firstpass (or delete the folder) and you're back to status quo.

How it works

The Undercut Rubric · v1

Six flags assign a tier. Three triggers are the only way up.

This is a named, versioned spec — not internal logic we could quietly change. When the rubric changes (a new flag, a different cap), the version number moves and the changelog says why.

Every unit of work gets scored against six flags, then assigned the cheapest tier that can plausibly handle it. It only moves up a tier when something objective proves it needs to — a failed check, a measured disagreement, an explicit uncertainty flag. It never moves up on a guess, and it never moves back down mid-task.

unit of work
6-flag rubric
0 flags
cheap~90% of units land here ✓
1–2
standard
3+/own
frontier
↑ escalate +1 tier only on: fail ×2 · two runs disagree · tagged "uncertain" residue only — never redoes the batch
See the rubric

Step 1 — Base tier, six-flag rubric

Unverifiable — can output be checked mechanically? (tests, schema, diff, grep)
Ambiguous — one right answer, or several defensible ones?
Blast — reversible? touches money, auth, user data, production, deletes?
Cross-cutting — one file/source, or reasoning across many?
Novel — pattern-following, or genuinely new design?
Format-strict — must output match an exact schema?

0 flags → cheap · 1–2 → standard · 3+ or any ownership/judgment call → frontier. Apex only when you can write one sentence stating why the marginal intelligence pays for the cost.

The override — single biggest lever

Cheap-to-verify ⇒ cheap-to-generate. If output can be checked mechanically, it starts at the lowest tier regardless of how hard it looks — verification catches failure. Only unverifiable work needs to start high.

Step 2 — Escalate exactly one tier, on evidence only

  • Verification fails twice at the current tier
  • Two cheap-tier runs disagree on ambiguous-flagged work
  • The worker tags an item "uncertain"

Residue-only handoff

The next tier up gets only the failed or uncertain items, plus verification notes. It resolves the residue — it never redoes the batch.

Hysteresis — guardrails

Never de-escalate mid-task. Max one retry per tier. Anything still unresolved goes to a single batched apex tie-break call. One hard file in a 700-file job doesn't drag the other 699 up a tier.

 unit of work
      |
  6-flag rubric
      |
  +---+----+
  | 0 flags|--> cheap
  | 1-2    |--> standard
  | 3+/own |--> frontier
  +---+----+
      | fail x2 / disagree / uncertain
      v
  escalate +1 tier
  (residue only)
      |
  still unresolved?
      v
  single batched
  apex tie-break

Why it holds up

Flags steer. Verification and escalation decide.

Even when the rubric flags are scored imperfectly, the escalator still routes work to the right tier almost every time — because a wrong flag only ever costs one extra cheap attempt, never a wrong answer or a big bill.

See the data

A stock dispatcher model reproduces the rubric flags imperfectly — Haiku hits 90% agreement, Sonnet 93%. The weakest flag (format-strict) is only 60%. None of that matters: under the shipped policy, both dispatchers still route 100% of units to the correct tier. A wrong flag changes the ladder cap, never the base tier — worst case, one extra cheap attempt.

Haiku dispatcher
90% flag agreement
100% tier-match
Sonnet dispatcher
93% flag agreement
100% tier-match

The rules are about the work, not the model.

Every rule is a property of the unit of work — verifiable, ambiguous, blast-radius — never a specific model's known weakness. Vendor cards go stale as models change; work properties don't. It's also hard-won — a format-strict rule that worked on Anthropic backfired on Gemini, which is exactly why the rubric no longer encodes per-vendor behavior.

Honest limits

What this doesn't do.

Not a proxy, not a gateway, doesn't auto-flag in production (Tabnine's agent scores the flags itself — measured robust to getting them wrong, see above), and doesn't promise a dollar figure for your workload. It also doesn't prove your number until you run it — every figure here is an observation from our tasks and our graders, not a guarantee about yours. We've confirmed the discovery precedence, the SKILL.md shape, and the tabnine skills install syntax against Tabnine's own docs, but we haven't run any of these commands against a live Tabnine CLI session ourselves, we haven't confirmed Agent Skills apply inside Tabnine's IDE plugins rather than just the CLI, and skills.sh doesn't list Tabnine at all — see the install callout above for the specifics. Full list, with the finance/procurement note and the paid-tier disclosure, is on the main page.

Undercut the top tier. Not the quality bar.

Nothing about this page expires. What does keep happening is the token bill, one session at a time, on whatever Tabnine's agent is currently doing with mechanical work.

View on GitHub