AGENTS.md examples from real projects

BloopAIReads credentialsAGENTS.md

vibe-kanban

BloopAI/vibe-kanban/docs/AGENTS.md

using 8.8.8.8 as DNS server ```javascript const config = { performance: { cache: true, timeout: 30000 }, security: { encryption: 'AES-256' } }; ``` ### Cards and columns for emphasising information Example of cards and card groups: Complete

CodePhiliaXAGENTS.md

Chat2DB

CodePhiliaX/Chat2DB/AGENTS.md

published listeners on loopback unless remote exposure is explicitly requested and documented with its security impact. Do not change the container's required internal `0.0.0.0` binding to enforce a host

bagistoAGENTS.md

bagisto

bagisto/bagisto/AGENTS.md

standards` owns the detail: worked examples, Blade, Laravel idiom, data access, localization and the security checklists. ## Database Compatibility Every query, migration and raw fragment has to work on **MySQL

jlowinReads credentialsAGENTS.md

fastmcp

jlowin/fastmcp/AGENTS.md

python-tests` | | Write or revise a docs page | `docs` | | Evaluate a vulnerability report | `review-security-report` | | Cut a release | `release` | ## Core MCP Objects When modifying MCP functionality, changes typically need

alibabaAGENTS.md

druid

alibaba/druid/AGENTS.md

Maven 3.6+ ## Project Structure - `core/` — Main library: connection pool, SQL parser, filter chain, wall security, monitoring - `druid-spring-boot-starter/` — Spring Boot 2.x auto-configuration - `druid-spring-boot

OthmanAdiAGENTS.md

planning-with-files

OthmanAdi/planning-with-files/AGENTS.md

GitHub did not close. ## Formats - CHANGELOG: `## [X.Y.Z] - YYYY-MM-DD`, then `### Added|Fixed|Changed|Security`, then `### Thanks` with one line per contributor (first name or @handle, what they did, issue

No other project uses it yet

VercelAGENTS.md

ai

vercel/ai/AGENTS.md

type references ``` ### JSON parsing Never use `JSON.parse` directly in production code to prevent security risks. Instead use `parseJSON` or `safeParseJSON` from `@ai-sdk/provider-utils`. ### Type Checking Always run type checking

viratttReads credentialsAGENTS.md

dexter

virattt/dexter/AGENTS.md

compatibility. - Tests colocated as `*.test.ts`. - Run `bun test` before pushing when you touch logic. ## Security - API keys stored in `.env` (gitignored). Users can also enter keys interactively

promptfooReads credentialsAGENTS.md

promptfoo

promptfoo/promptfoo/AGENTS.md

Eval/result persistence models | `src/models/AGENTS.md` | | `src/prompts/` | Prompt loading & processors | `src/prompts/AGENTS.md` | | `src/providers/` | LLM providers | `src/providers/AGENTS.md` | | `src/redteam/` | Security testing | `src/redteam/AGENTS.md` | | `src/scheduler/` | Concurrency & rate limits | `src/scheduler/AGENTS.md` | | `src/server/` | Backend server | `src/server/AGENTS.md` | | `src/tracing/` | OpenTelemetry trace storage

No other project uses it yet

promptfooReads credentialsAGENTS.md

promptfoo

promptfoo/promptfoo/.github/AGENTS.md

AGENTS.md Guidance for AI agents working on GitHub Actions workflows. ## Workflow Security - Keep actions SHA-pinned. Never use floating tags (`@v4`) or branches (`@main`). - **Do not expose write-capable tokens

No other project uses it yet

rollupAGENTS.md

rollup

rollup/rollup/AGENTS.md

contents. The artefacts are served via rollupjs.org, so changing this gating is a security-relevant decision. - The testing-instructions comment wording and its install-location allowlist

vaporAGENTS.md

vapor

vapor/vapor/AGENTS.md

automated agents to claim, triage, or submit solutions to `good-first-issue` tickets.** ### Security Issues Security vulnerabilities must be reported by humans through our responsible disclosure process. Automated scanning tools

goauthentikAGENTS.md

authentik

goauthentik/authentik/AGENTS.md

self-hosted from a homelab to a large production cluster. The company is **Authentik Security, Inc.**; the product name is **always lowercase `authentik`**, even at the start of a sentence

No other project uses it yet

goauthentikAGENTS.md

authentik / website

goauthentik/authentik/website/AGENTS.md

correct working directory and ordering. ## Architecture ### Directory structure ``` website/ docs/ # Topics site (@goauthentik/docs-topics) add-secure-apps/ # Applications, providers, flows, stages, etc. core/ # Core concepts customize/ # Branding, blueprints, policies, theming developer

No other project uses it yet

zulipAGENTS.md

zulip

zulip/zulip/AGENTS.md

claude/skills/pr-description/SKILL.md`). ## When to Pause and Discuss Recommend pausing for discussion when: - The approach involves security-sensitive code - Database migrations are needed (See `docs/subsystems/schema-migrations.md`). - The change alters behavior in several subsystems

every-appAGENTS.md

open-seo

every-app/open-seo/AGENTS.md

edge case found only by reading the code; flag it instead. Security holes and significant billing abuse are the exception. - Search for existing implementations and installed libraries before creating

EveryIncAGENTS.md

compounding-engineering-plugin

EveryInc/compounding-engineering-plugin/AGENTS.md

both gates but still follow the merge policy above. - **PR disclosure:** `.github/pull_request_template.md` ends with `## Security Disclosure` and `## Agent Disclosure` sections. Fill both when opening a PR — including PRs authored

EveryIncAGENTS.md

every-marketplace

EveryInc/every-marketplace/AGENTS.md

both gates but still follow the merge policy above. - **PR disclosure:** `.github/pull_request_template.md` ends with `## Security Disclosure` and `## Agent Disclosure` sections. Fill both when opening a PR — including PRs authored

activepiecesDeletes or force-pushesAGENTS.md

activepieces

activepieces/activepieces/AGENTS.md

auto-discover. - **HTTP**: `POST` for all create/update mutations. `DELETE` for deletes. Never PUT/PATCH. - **Security**: Every endpoint needs `securityAccess` config. - **Side effects**: Separated into `*-side-effects.ts` files, called explicitly after mutations. - **Multi

No other project uses it yet

letta-aiAGENTS.md

letta

letta-ai/letta/AGENTS.md

historical reference only. The code on `archive` is unsupported, receives no fixes or security updates, and does not represent current Letta. The old `letta/letta` Docker image and the Python server