AGENTS.md examples from real projects

AstralAGENTS.md

ty

astral-sh/ty/AGENTS.md

Repository ## Security reviews For reviews of this repository's GitHub automation, CI, and release process, use the [GitHub repository threat model](agents/references/repository-threat-model.md). The `ruff` submodule pins ty's Rust source

GoogleAGENTS.md

gvisor

google/gvisor/AGENTS.md

resolving gVisor issues #### Modifying gVisor kernel behavior Use the `gvisor-kernel-development` skill. #### Security first All changes are reviewed for security. gVisor's design and architecture ensures that a Sentry

sandboxie-plusAGENTS.md

Sandboxie

sandboxie-plus/Sandboxie/AGENTS.md

change guidelines - Treat `Sandboxie/core` with extreme caution: bugs can cause BSODs or sandbox-escape security holes. Prefer minimal, surgical patches there over refactors. - Verify builds, branches, and properties

No other project uses it yet

elizaOSAGENTS.md

eliza

elizaOS/eliza/AGENTS.md

desktop/mobile inspection. - Submit changes through a PR against `develop`. Report vulnerabilities privately through GitHub Security Advisories. The community plugin registry is retired; first-party catalog data lives in `packages/core/src/catalog/`. Getting

No other project uses it yet

agent0aiAGENTS.md

agent-zero / agents

agent0ai/agent-zero/agents/AGENTS.md

metadata and inherited prompt specifics. | | [developer/AGENTS.md](developer/AGENTS.md) | Software development specialist profile. | | [hacker/AGENTS.md](hacker/AGENTS.md) | Cyber security and penetration testing specialist profile. | | [researcher/AGENTS.md](researcher/AGENTS.md) | Research, data analysis, and reporting specialist profile. | | [tiny

No other project uses it yet

agent0aiReads credentialsAGENTS.md

agent-zero

agent0ai/agent-zero/AGENTS.md

variables before plugin setup. - LiteLLM and OpenAI pins must remain compatible. Retain shared dependency security floors and verify upgrades with installed-SDK HTTP tests in `tests/test_litellm_sdk.py` using the framework runtime

No other project uses it yet

agent0aiAGENTS.md

agent-zero / api

agent0ai/agent-zero/api/AGENTS.md

changing handler behavior. - For auth, CSRF, upload/download, tunnel, or file endpoints, run the nearest security regression tests. - Check file-level documentation coverage with a script or shell loop that verifies

No other project uses it yet

agent0aiAGENTS.md

agent-zero / extensions

agent0ai/agent-zero/extensions/AGENTS.md

repeatedly when the lifecycle point can fire multiple times. - Secret masking, auth, security, and persistence extensions must not be bypassed by convenience changes. ## Work Guidance - Keep extension code small

No other project uses it yet

agent0aiAGENTS.md

agent-zero / helpers

agent0ai/agent-zero/helpers/AGENTS.md

belong in `api/`, tool behavior in `tools/`, and plugin-local logic inside plugin directories. - Security, auth, settings, file access, plugin discovery, extension dispatch, notifications, state snapshots, scheduler, tunnel, and WebSocket

No other project uses it yet

agent0aiAGENTS.md

agent-zero / plugins

agent0ai/agent-zero/plugins/AGENTS.md

update flows from ZIP, Git, and Plugin Index. | | [_plugin_scan/AGENTS.md](_plugin_scan/AGENTS.md) | LLM-guided security scanner for third-party plugins. | | [_plugin_validator/AGENTS.md](_plugin_validator/AGENTS.md) | Plugin manifest, structure, convention, and security

No other project uses it yet

agent0aiAGENTS.md

agent-zero / references

agent0ai/agent-zero/skills/a0-create-plugin/references/AGENTS.md

handlers. - Keep local-only work separate from community publication and catalog discovery separate from security scanning. - Preserve authentication, scope, user authorization, and unrelated runtime state. ## Work Guidance - Prefer existing framework

No other project uses it yet

agent0aiAGENTS.md

agent-zero / a0-manage-plugin

agent0ai/agent-zero/skills/a0-manage-plugin/AGENTS.md

behavior, scan expectations, and activation semantics current. - Distinguish Index discovery from model-based security scans and installation; metadata is not verified capability or safety. - Handle missing/null Index fields and check

No other project uses it yet

agent0aiAGENTS.md

agent-zero / references

agent0ai/agent-zero/skills/a0-manage-plugin/references/AGENTS.md

handlers. - Keep local-only work separate from community publication and catalog discovery separate from security scanning. - Preserve authentication, scope, user authorization, and unrelated runtime state. ## Work Guidance - Prefer existing framework

No other project uses it yet

agent0aiAGENTS.md

agent-zero / tests

agent0ai/agent-zero/tests/AGENTS.md

Tests DOX ## Purpose - Own pytest regression, security, integration, and contract tests. - Keep tests focused on behavior that should remain stable across framework changes. ## Ownership - Test files live directly under `tests

No other project uses it yet

compiler-explorerReads credentialsAGENTS.md

compiler-explorer

compiler-explorer/compiler-explorer/AGENTS.md

hooks (`npm run check-frontend-imports`) - Violations will cause build failures and prevent commits ## Security Review Calibration - Internal, CE-controlled endpoints (e.g. the conan library server) are not hostile: treat

No other project uses it yet

eggjsDeletes or force-pushesAGENTS.md

egg

eggjs/egg/AGENTS.md

loader): ensure middleware order` - keep PR descriptions clear about motivation, scope, and test evidence ## Security And Config - review `SECURITY.md` before handling vulnerability-related work - do not commit secrets, credentials

wledDeletes or force-pushesAGENTS.md

WLED

wled/WLED/AGENTS.md

description - in addition to comments markers in the source code (see Comments section). ### Security Hardening When writing or reviewing code in `wled00/`, `usermods/`, `wled00/data/`, or `.github/workflows/`, consult `docs/hardening.instructions.md` (concise checklist

facebookAGENTS.md

yoga

facebook/yoga/AGENTS.md

just that platform. Choose the appropriate type: `[Breaking]`, `[Added]`, `[Changed]`, `[Deprecated]`, `[Removed]`, `[Fixed]`, or `[Security]`. If the change truly has no user-visible effect, such as a test-only

browser-useAGENTS.md

browser-harness

browser-use/browser-harness/AGENTS.md

routine PR gates. - First-time install / blocked Chrome: follow `install.md` (`chrome://inspect/#remote-debugging`). # Security - Do not commit secrets, Browser Use Cloud tokens, or session cookies. - Prefer the smallest change

No other project uses it yet

langbot-appReads credentialsAGENTS.md

LangBot

langbot-app/LangBot/AGENTS.md

suite session_summary` passing. - Code comments and docstrings must be English. - Keep compatibility and security in mind; LangBot is used in both self-hosted/community and toB deployments. - Commit message