How real projects brief Codex, Cursor and every other agent that reads AGENTS.md.
GitHubAGENTS.mdgithub/gh-aw/AGENTS.md
flow, and command playbooks → `.github/skills/developer/SKILL.md` - Code organization, file structure, WASM stubs, string patterns → `.github/skills/developer-code-organization/SKILL.md` - Security best practices, template injection, shell script safety, supply chain → `.github/skills/developer-security/SKILL.md` - Compiler internals, validation architecture, safe
awarexoneAGENTS.mdawarexone/Agentic-Bug-Hunter/AGENTS.md
surface ranking from recon output + memory - `token-auditor` — fast meme coin/token rug pull and security analysis - `credential-hunter` — orchestrates wordlist-gen + osint-employees + breach-check; HARD STOPS at spray
iflytekAGENTS.mdiflytek/skillhub/AGENTS.md
across an organization. It provides a **REST API backend**, a **React web UI**, a **security scanner**, and a **ClawHub CLI compatibility layer**. ## Quick Reference | Item | Value | |------------|------------------------------------------------------------| | Backend | Spring Boot
VercelAGENTS.mdvercel/examples/rust/wait-until/AGENTS.md
durable agent loops or untrusted code: use Workflow (pause/resume/state) + Sandbox; use Vercel MCP for secure infra access
SaladDayAGENTS.mdSaladDay/cc-switch-cli/AGENTS.md
rounds. Ask the reviewer to independently inspect all current modifications and report correctness, regression, security, performance, UX, and test-coverage issues. - Validate every finding against the code. Make minimal fixes
tiannAGENTS.mdtiann/hapi/AGENTS.md
wide checks when explicitly requested as well. - Review this task's changes for correctness, security, and regressions. For local work, inspect unstaged/staged diffs (`git diff`, `git diff --cached
TabularisDBAGENTS.mdTabularisDB/tabularis/AGENTS.md
symbol — callers, callees, which execution flows it participates in — use `context({name: "symbolName"})`. - For security review, `explain({target: "fileOrSymbol"})` lists taint findings (source→sink flows; needs `analyze --pdg`). ## Never
clideyAGENTS.mdclidey/whodb/AGENTS.md
disjoint file ownership for parallel work. - Ask review-oriented agents to find correctness, regression, security, and missing-test issues first; summaries are secondary. ## Project Structure ``` core/ # Backend (Go) cmd/whodb/main.go # Entry
WaishnavAGENTS.mdWaishnav/devspace/AGENTS.md
terms precisely. In particular, do not use workspace, allowed root, checkout, and worktree interchangeably. ## Security boundaries Filesystem tools enforce approved-root containment. Shell commands run with the local user
AWSAGENTS.mdawslabs/aidlc-workflows/AGENTS.md
Markdown dependency, another block scanner, or a definition grammar. The security-sensitive `Bun.markdown.render` review-authority check is a deliberately separate code path. - The orchestrator skill (`harness/ /skills/aidlc/SKILL.md`) is per-harness
homeassistant-aiAGENTS.mdhomeassistant-ai/ha-mcp/AGENTS.md
repository is `homeassistant-ai/ha-mcp`; the package is `ha-mcp` on PyPI. ## Security Read [`SECURITY.md`](SECURITY.md) before changing authentication, OAuth, webhooks, network exposure, proxies, filesystem access, or trust boundaries
MicrosoftAGENTS.mdmicrosoft/fluentui-blazor/AGENTS.md
management - `.github/CODEOWNERS` - Code ownership (@vnbaaij @dvoituron) - `docs/contributing.md` - Contribution guidelines - `docs/unit-tests.md` - Detailed unit testing documentation ## Security Considerations - Do not commit sensitive data or credentials - Review the `SECURITY.md` file for security policies
u14appAGENTS.mdu14app/deep-research/AGENTS.md
developers) working on the **Deep Research** repository. Adhere to these patterns to ensure consistency, security, and maintainability. --- ## 🚀 Development Workflow & Commands The project uses **pnpm** as the primary package manager. ### Core
zebbernAGENTS.mdzebbern/claude-code-guide/skills/react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
JetBrainsAGENTS.mdJetBrains/koog/AGENTS.md
callLLM") assertNodes { askLLM withInput "Hello" outputs Message.Assistant("Hello!") } } } } ``` For comprehensive testing examples, see `agents/agents-test/TESTING.md`. ## Security ### API Key Management - **NEVER** commit API keys or secrets to the repository - Use environment variables
SupabaseAGENTS.mdsupabase/supabase-js/AGENTS.md
testing guide with Docker requirements per package - [`docs/RELEASE.md`](./docs/RELEASE.md) — release workflows and versioning strategy - [Security Policy](https://github.com/supabase/supabase-js/security/policy) — security policies and responsible disclosure - [`docs/JSR_PUBLISHING.md`](./docs/JSR_PUBLISHING.md) — JSR registry publishing
VercelAGENTS.mdvercel-labs/just-bash/packages/just-bash/AGENTS.md
ignores) - Dependencies that use wasm are not allowed (exception: sql.js for SQLite, approved for security sandboxing). Binary npm packages are fine - When you implement multiple tasks (such as multiple commands
archestra-aiAGENTS.mdarchestra-ai/archestra/platform/AGENTS.md
3000/settings> (lands on the first permitted tab; tabs: Organization, Service Accounts, Chat, LLM, MCP, Security, Knowledge, Environments, Users, Teams, Roles, GitHub, Identity Providers, Secrets) - **Personal Settings**: <http://localhost:3000/account> (personal
arcboxlabsAGENTS.mdarcboxlabs/arcbox/runtime/AGENTS.md
capabilities, or hook paths. Document what you rely on before treating it as a security boundary. ## Conventions & pitfalls - **ID schemes differ — not interchangeable.** `ContainerId::new` strips dashes and TRUNCATES
nolabs-aiAGENTS.mdnolabs-ai/nono/AGENTS.md
nono agent guide nono is a security-critical, capability-based sandbox for untrusted AI agents. It uses Landlock on Linux and Seatbelt on macOS. Treat every change as a security
An open format for instructions to coding agents, read by Codex, Cursor and others. Think of it as a README written for agents.
At the repository root, with more specific files in subdirectories. Agents read the one closest to the file they're editing.
Setup and test commands, code style, and the rules a new contributor would need to know.
Claude Code reads CLAUDE.md. A one-line CLAUDE.md that points at AGENTS.md covers both.
