AGENTS.md examples from real projects

garrytanPipes a download into a shellAGENTS.md

gbrain

garrytan/gbrain/AGENTS.md

false`, set by `src/cli.ts`) from **untrusted agent-facing callers** (`remote = true`, set by `src/mcp/server.ts`). Security-sensitive operations like `file_upload` tighten filesystem confinement when `remote = true` and default to strict

No other project uses it yet

LangChainAGENTS.md

deepagents

langchain-ai/deepagents/AGENTS.md

labels, and troubleshooting. - [LangChain contributing guide](https://docs.langchain.com/oss/python/contributing/overview) — general contribution policy. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool

No other project uses it yet

ComposioHQAGENTS.md

composio / python

ComposioHQ/composio/python/AGENTS.md

filesystem path, use `composio.utils.safe_path.secure_join(root, *components)`. For an untrusted filename, use `secure_basename_join(base, filename, root=root)` so ordinary extensions remain valid while the write stays anchored

No other project uses it yet

netbirdioAGENTS.md

netbird

netbirdio/netbird/AGENTS.md

user-before) - [Quick reference](#quick-reference) - [Structure](#structure) - [Where to look](#where-to-look) - [Security](#security) - [Agent conventions](#agent-conventions) - [Repo-wide principles](#repo-wide-principles) - [Type safety](#type-safety

No other project uses it yet

OpenAIAGENTS.md

openai-agents-python

openai/openai-agents-python/AGENTS.md

that can observably diverge. | | Findings | State a supported trigger and concrete caller-visible, compatibility, security, persistence, or lifecycle consequence. Omit speculative defects, aesthetic preferences, unrelated cleanup, and symmetry without

helmAGENTS.md

helm

helm/helm/AGENTS.md

exception to the above is where incompatible changes are needed to fix a security vulnerability, where minimal breaking changes may be made to address the issue. ### Code standards - Use table

InfisicalReads credentialsAGENTS.md

infisical

Infisical/infisical/AGENTS.md

only resolve package versions published at least 7 days ago, as a supply-chain security measure. The backend installs with the npm bundled in Node 26 (11.x), which skips

aishwaryanrAGENTS.md

awesome-generative-ai-guide / topics

aishwaryanr/awesome-generative-ai-guide/topics/agents.md

Everyone](../free_courses/openclaw_mastery_for_everyone/README.md)** ⭐ 📖 (2026) certified: configure and run your own personal AI assistant. ## 🏗️ Build 301 - **[Securing Agentic AI Systems](../resources/securing_agentic_ai_systems.md)** ⭐ 📖 (2026): attack vectors and defenses (shared with [Safety and Security](safety-security.md

kestra-ioAGENTS.md

kestra

kestra-io/kestra/AGENTS.md

Kestra cannot boot in the worktree. The script is idempotent — safe to re-run. ### Security Considerations - Use tenant isolation for multi-tenant features - Implement proper authorization with `@HasAnyPermission` - Handle secrets

No other project uses it yet

sampottsAGENTS.md

plyr

sampotts/plyr/AGENTS.md

Plyr: guidance for AI coding agents Plyr is deprecated and receives security updates only. Its creator now works on [Video.js 10](https://videojs.org?utm_source=plyr), which combines Plyr, Vidstack

No other project uses it yet

apolloconfigAGENTS.md

apollo

apolloconfig/apollo/AGENTS.md

against `apolloconfig/apollo` and fill the template with real content (not the raw template text). ## Security & Configuration Notes - Apollo supports H2 in-memory for local development and MySQL for production; prefer

bigintReads credentialsAGENTS.md

hey

bigint/hey/AGENTS.md

hooks: pre-commit runs `biome` and type checks; ensure both pass locally before pushing. ## Security & Configuration - Copy `.env.example` to `.env` in `apps/web` and `apps/api`. Never commit secrets. - Validate envs

envoyproxyAGENTS.md

envoy

envoyproxy/envoy/AGENTS.md

entry in `source/extensions/extensions_build_config.bzl` (or `contrib/contrib_build_config.bzl` for contrib extensions) - An entry in `source/extensions/extensions_metadata.yaml` (status, security posture, categories) - `CODEOWNERS` entries listing the two proposed extension reviewers - Docs and a `new_features` release

celeryAGENTS.md

celery

celery/celery/.github/Agents.md

including "Reporting Bugs" - [What reviewers check](.github/copilot-instructions.md): docs versioning, scope, backward compatibility, and tests. - [Security policy](SECURITY.md): never report a vulnerability in public

QwenLMAGENTS.md

qwen-code

QwenLM/qwen-code/AGENTS.md

been through roughly **5 review rounds**, land only Critical fixes — correctness, security, data loss, regressions — and defer remaining Suggestions to a follow-up issue or PR. Record each deferral

No other project uses it yet

charmbraceletAGENTS.md

crush

charmbracelet/crush/AGENTS.md

native passphrase dialogs via loopback pinentry) sshaskpass/ Integrated SSH askpass: OpenSSH credential prompts and security key touches rendered as native dialogs and warnings skills/ Skill file discovery and loading shell

No other project uses it yet

BloopAIReads credentialsAGENTS.md

vibe-kanban

BloopAI/vibe-kanban/AGENTS.md

pass. If adding runtime logic, include lightweight tests (e.g., Vitest) in the same directory. ## Security & Config Tips - Use `.env` for local overrides; never commit secrets. Key envs: `FRONTEND_PORT`, `BACKEND

BloopAIReads credentialsAGENTS.md

vibe-kanban

BloopAI/vibe-kanban/docs/AGENTS.md

using 8.8.8.8 as DNS server ```javascript const config = { performance: { cache: true, timeout: 30000 }, security: { encryption: 'AES-256' } }; ``` ### Cards and columns for emphasising information Example of cards and card groups: Complete

OtterMindAGENTS.md

Chat2DB

OtterMind/Chat2DB/AGENTS.md

published listeners on loopback unless remote exposure is explicitly requested and documented with its security impact. Do not change the container's required internal `0.0.0.0` binding to enforce a host

bagistoAGENTS.md

bagisto

bagisto/bagisto/AGENTS.md

standards` owns the detail: worked examples, Blade, Laravel idiom, data access, localization and the security checklists. ## Database Compatibility Every query, migration and raw fragment has to work on **MySQL