AGENTS.md examples from real projects

OpenAIReads credentialsAGENTS.md

openai-python

openai/openai-python/AGENTS.md

inputs/compiler and regenerate; never update inventory hashes to accept a handwritten patch. ## Security requirements for coding agents - Never commit real API or admin keys, bearer tokens, webhook secrets, cloud credentials

dragonflydbAGENTS.md

dragonfly

dragonflydb/dragonfly/AGENTS.md

basic), < 5.1 (epoll fallback) - Check: `uname -r` - Force epoll: `--proactor_type=epoll` - Docker: `--security-opt seccomp=unconfined` **FreeBSD**: Supported (kqueue backend) **macOS**: Not supported for production (use Docker/Linux) **For complete

garrytanPipes a download into a shellAGENTS.md

gbrain

garrytan/gbrain/AGENTS.md

false`, set by `src/cli.ts`) from **untrusted agent-facing callers** (`remote = true`, set by `src/mcp/server.ts`). Security-sensitive operations like `file_upload` tighten filesystem confinement when `remote = true` and default to strict

ComposioHQAGENTS.md

composio / python

ComposioHQ/composio/python/AGENTS.md

filesystem path, use `composio.utils.safe_path.secure_join(root, *components)`. For an untrusted filename, use `secure_basename_join(base, filename, root=root)` so ordinary extensions remain valid while the write stays anchored

No other project uses it yet

LangChainAGENTS.md

deepagents

langchain-ai/deepagents/AGENTS.md

labels, and troubleshooting. - [LangChain contributing guide](https://docs.langchain.com/oss/python/contributing/overview) — general contribution policy. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool

netbirdioAGENTS.md

netbird

netbirdio/netbird/AGENTS.md

user-before) - [Quick reference](#quick-reference) - [Structure](#structure) - [Where to look](#where-to-look) - [Security](#security) - [Agent conventions](#agent-conventions) - [Repo-wide principles](#repo-wide-principles) - [Type safety](#type-safety

No other project uses it yet

OpenAIAGENTS.md

openai-agents-python

openai/openai-agents-python/AGENTS.md

Project Structure Guide](#project-structure-guide) 4. [Operation Guide](#operation-guide) ## Policies & Mandatory Rules ### Security checklist Follow [SECURITY.md](SECURITY.md) for private vulnerability reporting and [CONTRIBUTING.md](CONTRIBUTING.md#security-checklist) for contributor

No other project uses it yet

helmAGENTS.md

helm

helm/helm/AGENTS.md

exception to the above is where incompatible changes are needed to fix a security vulnerability, where minimal breaking changes may be made to address the issue. ### Code standards - Use table

InfisicalReads credentialsAGENTS.md

infisical

Infisical/infisical/AGENTS.md

only resolve package versions published at least 7 days ago, as a supply-chain security measure. The backend installs with the npm bundled in Node 26 (11.x), which skips

InfisicalReads credentialsAGENTS.md

infisical / backend

Infisical/infisical/backend/AGENTS.md

them in. The one per-application field is `tokenExchangeAudience`, and it does the security work: without it, any token that issuer signed for anything in the estate is exchangeable. Enabling

kestra-ioAGENTS.md

kestra

kestra-io/kestra/AGENTS.md

Kestra cannot boot in the worktree. The script is idempotent — safe to re-run. ### Security Considerations - Use tenant isolation for multi-tenant features - Implement proper authorization with `@HasAnyPermission` - Handle secrets

No other project uses it yet

aishwaryanrAGENTS.md

awesome-generative-ai-guide / topics

aishwaryanr/awesome-generative-ai-guide/topics/agents.md

Everyone](../free_courses/openclaw_mastery_for_everyone/README.md)** ⭐ 📖 (2026) certified: configure and run your own personal AI assistant. ## 🏗️ Build 301 - **[Securing Agentic AI Systems](../resources/securing_agentic_ai_systems.md)** ⭐ 📖 (2026): attack vectors and defenses (shared with [Safety and Security](safety-security.md

sampottsAGENTS.md

plyr

sampotts/plyr/AGENTS.md

Plyr: guidance for AI coding agents Plyr is deprecated and receives security updates only. Its creator now works on [Video.js 10](https://videojs.org?utm_source=plyr), which combines Plyr, Vidstack

No other project uses it yet

simstudioaiAGENTS.md

sim

simstudioai/sim/AGENTS.md

never `crypto.randomUUID()`, `nanoid`, or `uuid`. Both use `crypto.getRandomValues()`, so they also work in non-secure (HTTP) browsers. For other randomness, `@sim/utils/random` (`randomInt`, `randomFloat`, `randomItem`, `generateRandomBytes`, `generateRandomHex`) — never `Math.random()` or `crypto.randomBytes

apolloconfigAGENTS.md

apollo

apolloconfig/apollo/AGENTS.md

against `apolloconfig/apollo` and fill the template with real content (not the raw template text). ## Security & Configuration Notes - Apollo supports H2 in-memory for local development and MySQL for production; prefer

bigintReads credentialsAGENTS.md

hey

bigint/hey/AGENTS.md

hooks: pre-commit runs `biome` and type checks; ensure both pass locally before pushing. ## Security & Configuration - Copy `.env.example` to `.env` in `apps/web` and `apps/api`. Never commit secrets. - Validate envs

envoyproxyAGENTS.md

envoy

envoyproxy/envoy/AGENTS.md

entry in `source/extensions/extensions_build_config.bzl` (or `contrib/contrib_build_config.bzl` for contrib extensions) - An entry in `source/extensions/extensions_metadata.yaml` (status, security posture, categories) - `CODEOWNERS` entries listing the two proposed extension reviewers - Docs and a `new_features` release

charmbraceletAGENTS.md

crush

charmbracelet/crush/AGENTS.md

native passphrase dialogs via loopback pinentry) sshaskpass/ Integrated SSH askpass: OpenSSH credential prompts and security key touches rendered as native dialogs and warnings skills/ Skill file discovery and loading shell

QwenLMAGENTS.md

qwen-code

QwenLM/qwen-code/AGENTS.md

been through roughly **5 review rounds**, land only Critical fixes — correctness, security, data loss, regressions — and defer remaining Suggestions to a follow-up issue or PR. Record each deferral

No other project uses it yet

BloopAIReads credentialsAGENTS.md

vibe-kanban

BloopAI/vibe-kanban/AGENTS.md

pass. If adding runtime logic, include lightweight tests (e.g., Vitest) in the same directory. ## Security & Config Tips - Use `.env` for local overrides; never commit secrets. Key envs: `FRONTEND_PORT`, `BACKEND