AGENTS.md examples from real projects

garrytanPipes a download into a shellAGENTS.md

gbrain

garrytan/gbrain/AGENTS.md

false`, set by `src/cli.ts`) from **untrusted agent-facing callers** (`remote = true`, set by `src/mcp/server.ts`). Security-sensitive operations like `file_upload` tighten filesystem confinement when `remote = true` and default to strict

conductor-ossAGENTS.md

conductor

conductor-oss/conductor/AGENTS.md

higher versions are always welcome — use one of two lowercase prefixes instead: ```groovy // Security: CVE-2025-12183 — lz4-java minimum patched version // Compat: commons-lang3 3.18.0+ required by Testcontainers/commons-compress ``` - `// Security

OpenAIAGENTS.md

openai-python

openai/openai-python/AGENTS.md

handwritten policy, automation, tests, and examples small; alter exported APIs only when explicitly required. ## Security requirements for coding agents Read and apply [contributor security requirements](CONTRIBUTING.md#security-requirements-for-contributions

No other project uses it yet

FujiwaraChokiReads credentialsAGENTS.md

MoneyPrinterV2

FujiwaraChoki/MoneyPrinterV2/AGENTS.md

description. - Mark not-ready PRs with `WIP` and remove it when ready for review. ## Security & Configuration Tips - Treat `config.json` as environment-specific; do not commit real API keys or private

dragonflydbAGENTS.md

dragonfly

dragonflydb/dragonfly/AGENTS.md

basic), < 5.1 (epoll fallback) - Check: `uname -r` - Force epoll: `--proactor_type=epoll` - Docker: `--security-opt seccomp=unconfined` **FreeBSD**: Supported (kqueue backend) **macOS**: Not supported for production (use Docker/Linux) **For complete

LangChainAGENTS.md

deepagents

langchain-ai/deepagents/AGENTS.md

labels, and troubleshooting. - [LangChain contributing guide](https://docs.langchain.com/oss/python/contributing/overview) — general contribution policy. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool

No other project uses it yet

ComposioHQAGENTS.md

composio / python

ComposioHQ/composio/python/AGENTS.md

filesystem path, use `composio.utils.safe_path.secure_join(root, *components)`. For an untrusted filename, use `secure_basename_join(base, filename, root=root)` so ordinary extensions remain valid while the write stays anchored

No other project uses it yet

netbirdioAGENTS.md

netbird

netbirdio/netbird/AGENTS.md

user-before) - [Quick reference](#quick-reference) - [Structure](#structure) - [Where to look](#where-to-look) - [Security](#security) - [Agent conventions](#agent-conventions) - [Repo-wide principles](#repo-wide-principles) - [Type safety](#type-safety

No other project uses it yet

OpenAIAGENTS.md

openai-agents-python

openai/openai-agents-python/AGENTS.md

that can observably diverge. | | Findings | State a supported trigger and concrete caller-visible, compatibility, security, persistence, or lifecycle consequence. Omit speculative defects, aesthetic preferences, unrelated cleanup, and symmetry without

QwenLMAGENTS.md

qwen-code

QwenLM/qwen-code/AGENTS.md

been through roughly **5 review rounds**, land only Critical fixes — correctness, security, data loss, regressions — and defer remaining Suggestions to a follow-up issue or PR. Record each deferral

InfisicalReads credentialsAGENTS.md

infisical

Infisical/infisical/AGENTS.md

only resolve package versions published at least 7 days ago, as a supply-chain security measure. The backend installs with the npm bundled in Node 26 (11.x), which skips

helmAGENTS.md

helm

helm/helm/AGENTS.md

exception to the above is where incompatible changes are needed to fix a security vulnerability, where minimal breaking changes may be made to address the issue. ### Code standards - Use table

kestra-ioAGENTS.md

kestra

kestra-io/kestra/AGENTS.md

Kestra cannot boot in the worktree. The script is idempotent — safe to re-run. ### Security Considerations - Use tenant isolation for multi-tenant features - Implement proper authorization with `@HasAnyPermission` - Handle secrets

aishwaryanrAGENTS.md

awesome-generative-ai-guide / topics

aishwaryanr/awesome-generative-ai-guide/topics/agents.md

Everyone](../free_courses/openclaw_mastery_for_everyone/README.md)** ⭐ 📖 (2026) certified: configure and run your own personal AI assistant. ## 🏗️ Build 301 - **[Securing Agentic AI Systems](../resources/securing_agentic_ai_systems.md)** ⭐ 📖 (2026): attack vectors and defenses (shared with [Safety and Security](safety-security.md

sampottsAGENTS.md

plyr

sampotts/plyr/AGENTS.md

Plyr: guidance for AI coding agents Plyr is deprecated and receives security updates only. Its creator now works on [Video.js 10](https://videojs.org?utm_source=plyr), which combines Plyr, Vidstack

No other project uses it yet

apolloconfigAGENTS.md

apollo

apolloconfig/apollo/AGENTS.md

against `apolloconfig/apollo` and fill the template with real content (not the raw template text). ## Security & Configuration Notes - Apollo supports H2 in-memory for local development and MySQL for production; prefer

AgriciDanielAGENTS.md

claude-seo

AgriciDaniel/claude-seo/AGENTS.md

demand 2. **Industry Detection**: Auto-detect SaaS, e-commerce, local, publisher, agency 3. **Security**: All scripts call `validate_url()` for SSRF protection 4. **Config location**: `~/.config/claude-seo/` for API credentials

bigintReads credentialsAGENTS.md

hey

bigint/hey/AGENTS.md

hooks: pre-commit runs `biome` and type checks; ensure both pass locally before pushing. ## Security & Configuration - Copy `.env.example` to `.env` in `apps/web` and `apps/api`. Never commit secrets. - Validate envs

envoyproxyAGENTS.md

envoy

envoyproxy/envoy/AGENTS.md

entry in `source/extensions/extensions_build_config.bzl` (or `contrib/contrib_build_config.bzl` for contrib extensions) - An entry in `source/extensions/extensions_metadata.yaml` (status, security posture, categories) - `CODEOWNERS` entries listing the two proposed extension reviewers - Docs and a `new_features` release

celeryAGENTS.md

celery

celery/celery/.github/Agents.md

including "Reporting Bugs" - [What reviewers check](.github/copilot-instructions.md): docs versioning, scope, backward compatibility, and tests. - [Security policy](SECURITY.md): never report a vulnerability in public