AGENTS.md examples from real projects

jason5ng32AGENTS.md

MyIP

jason5ng32/MyIP/AGENTS.md

lookup, connectivity tests, WebRTC / DNS-leak detection, speed test, MTR, Whois, ASN profile, security checklist, browser fingerprint, anonymity checks, persona check, IP calculator, and more. Single repo, two halves

No other project uses it yet

jason5ng32AGENTS.md

MyIP / api

jason5ng32/MyIP/api/AGENTS.md

Periodic jobs wrap their tick in `server/sentry-cron.js`; `key` / `token` query params are redacted (`server/sentry-scrub.js`). ## Security & Boundaries ### Guards live in middleware, not handlers `server/guards.js`, attached in `backend-server.js`; handlers never repeat them

No other project uses it yet

Arize-aiAGENTS.md

phoenix

Arize-ai/phoenix/AGENTS.md

stale with every model release and miss aliases, deployment IDs, and proxied model names ### Security - GraphQL resolvers that perform side effects — outbound HTTP/RPC, "test connection" / credential validation, database writes, secret

dreamhunter2333AGENTS.md

cloudflare_temp_email

dreamhunter2333/cloudflare_temp_email/AGENTS.md

with Vite proxy to worker — required for WebAuthn (`navigator.credentials`) and `crypto.subtle` which need a secure context. Browser tests use `ignoreHTTPSErrors: true`. Key patterns for browser tests: - Frontend hashes passwords with

esphomeAGENTS.md

esphome

esphome/esphome/AGENTS.md

dataclass`, never in module-level mutable globals (see the `component-codegen` skill). * **Security:** Be mindful of security when making changes to the API, web server, or any other network-related

OpenRefineAGENTS.md

OpenRefine

OpenRefine/OpenRefine/AGENTS.md

Cypress tests on pull requests - **Server Tests**: `.github/workflows/pull_request_server.yml` - Runs server-side tests - **CodeQL Analysis**: Security scanning for Java and JavaScript ## Development Workflow ### Code Contributions 1. Fork the repository 2. Create

No other project uses it yet

TencentCloudAGENTS.md

Octop

TencentCloud/Octop/AGENTS.md

Agent registry (`manager.py`), harness runtime, providers, settings (`settings/`), workspace paths (`workspace/`), threads helpers (`threads/`), security, persona/MBTI, experts, plugins, teams, memory | `server.py`, `gateway/`, `api/routers/agents.py` | | `infra/backend/` | Workspace storage adapter, resolver, remote probe

jxxghpAGENTS.md

MoviePilot

jxxghp/MoviePilot/AGENTS.md

responses, errors | [09 Interfaces](docs/rules/09-external-response.md) | | Database, transactions, runtime configuration | [10 Persistence](docs/rules/10-data-and-persistent.md) | | Quality gates, security, vulnerability audits | [11 Quality and Security](docs/rules/11-quality-and-security.md) | | Git, CI decisions, versions, releases | [12 Collaboration](docs/rules/12-collaboration-and-distribution.md

No other project uses it yet

nasaAGENTS.md

fprime

nasa/fprime/docs/AGENTS.md

Prime works: architecture, framework concepts, GDS, design patterns, build system, security. | | `docs/how-to/` | Task-oriented | Step-by-step recipes for one specific job, grouped under `develop/`, `integrate/`, `operate/`, `test/`. | | `docs/reference/` | Information

No other project uses it yet

CloudflareAGENTS.md

cloudflare-os / configurator-ui

cloudflare/cloudflare-os/packages/configurator-ui/AGENTS.md

HTML document: the minified runtime, its Tailwind/Kumo CSS, and the module, under a content security policy that admits only those scripts by hash and allows no network access. - Kumo

CloudflareAGENTS.md

cloudflare-os / workshop-frontend

cloudflare/cloudflare-os/packages/workshop-frontend/AGENTS.md

block already says. Comments are appropriate for gotchas, non-obvious invariants, external constraints, security or performance reasoning, and deliberate departures from a convention. Explain why the surprising choice is necessary

WordPressAGENTS.md

gutenberg

WordPress/gutenberg/AGENTS.md

reads, read `docs/contributors/documentation/copy-guide.md` — it covers terminology, capitalization, and how to word an error message. - **Security**: before writing PHP that prints data into HTML, accepts input or exposes data, follow

MicrosoftAGENTS.md

presidio

microsoft/presidio/AGENTS.md

dataset); support it as an explicit, documented opt-in, never as the default behavior. - **Security**: never log PII values; validate untrusted inputs before use (user-supplied regexes before compilation, file

betaflightAGENTS.md

betaflight

betaflight/betaflight/AGENTS.md

give a reason in one line. - *No value*: give the reason only. 3. **Security and data loss.** Do not give a security or data-loss finding the level *No value

pi-holeAGENTS.md

docker-pi-hole

pi-hole/docker-pi-hole/AGENTS.md

many systems. - The correct project spelling is "Pi-hole" (capital P, lowercase h, hyphen). ## Security considerations - Secrets can be supplied via Docker secrets as well as environment variables; never

No other project uses it yet

grafanaAGENTS.md

pyroscope

grafana/pyroscope/AGENTS.md

commit changes to `node_modules/` or generated code without source changes ## Security Considerations 1. **Input Validation**: Always validate and sanitize user input 2. **Path Traversal**: Validate object keys before storage

No other project uses it yet

apereoAGENTS.md

cas

apereo/cas/AGENTS.md

skill fits. | Skill | Read when the work touches | |---|---| | [`cas-actuators`](.claude/skills/cas-actuators/SKILL.md) | Actuator endpoints, management security | | [`cas-attribute-consent`](.claude/skills/cas-attribute-consent/SKILL.md) | `support/cas-server-support-consent*` | | [`cas-build-ci`](.claude/skills/cas-build-ci/SKILL.md) | Gradle build logic, `.github/workflows`, `ci/` scripts

QuipNetworkAGENTS.md

ethereum-sdk

QuipNetwork/ethereum-sdk/AGENTS.md

WalletFactory` keeps `_authorizeUpgrade` with its other internals near the file end. Rationale: on these security contracts, adjacency of each override and its helpers keeps the code auditable and preserves

OpenAIAGENTS.md

openai-node

openai/openai-node/AGENTS.md

meaningful public JSDoc. Preserve documentation URLs/import paths; examples must run with documented environments/dependencies. ## Security and lifecycle correctness Read and apply [contributor security requirements](.github/CONTRIBUTING.md#security-requirements) for credentials/synthetic fixtures, browser

No other project uses it yet

TEN-frameworkAGENTS.md

ten-framework

TEN-framework/ten-framework/AGENTS.md

them upfront. This gives you setup, architecture, code map, conventions, workflows, interfaces, gotchas, and security. 3. If a task needs more detail than L1 provides, follow links to L2 deep