AGENTS.md examples from real projects

jupyterlabAGENTS.md

jupyterlab

jupyterlab/jupyterlab/AGENTS.md

differs in a way that matters, and say how under "References" - Report a security vulnerability as described in the [security policy](https://github.com/jupyterlab/jupyterlab/security/policy), instead of opening an issue

apacheAGENTS.md

pulsar

apache/pulsar/AGENTS.md

human is in the loop and is accountable.** Every pull request and every security report must be submitted by a human contributor who has reviewed and verified the change

theonedevAGENTS.md

onedev

theonedev/onedev/AGENTS.md

session. Do not report continued access within the existing session as a security bug or require immediate revocation within that session. Run `./dev.sh prod` from repository root to start

experientiallabsAGENTS.md

experiential

experientiallabs/experiential/AGENTS.md

build that layer themselves, but this boundary must never compromise our gateway's performance, security, or maintainability. Public code, documentation, commit messages, PR descriptions, and comments must describe the standalone

prowler-cloudAGENTS.md

prowler

prowler-cloud/prowler/AGENTS.md

SKILL.md](skills/prowler-api/SKILL.md) | | `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) | | `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) | | `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) | | `prowler-test

No other project uses it yet

prowler-cloudAGENTS.md

prowler / api

prowler-cloud/prowler/api/AGENTS.md

extend_schema` for OpenAPI - NEVER: Raw SQL queries, business logic in views ### Row-Level Security (RLS) - ALWAYS: Use `rls_transaction(tenant_id)` context manager - NEVER: Query across tenants, trust client

No other project uses it yet

prowler-cloudAGENTS.md

prowler

prowler-cloud/prowler/docs/AGENTS.md

follow this text/communication style guide: # Prowler's Brand Voice Prowler is the open cloud security platform trusted by thousands of organizations automating security monitoring and compliance with hundreds of built

No other project uses it yet

prowler-cloudAGENTS.md

prowler / prowler

prowler-cloud/prowler/prowler/AGENTS.md

Skills Reference**: For detailed patterns, use these skills: > - [`prowler-sdk-check`](../skills/prowler-sdk-check/SKILL.md) - Create new security checks (step-by-step) > - [`prowler-provider`](../skills/prowler-provider/SKILL.md) - Add new cloud providers > - [`prowler-test-sdk`](../skills/prowler-test-sdk/SKILL.md

No other project uses it yet

alexta69AGENTS.md

metube

alexta69/metube/AGENTS.md

options()`) — or a note in the PR that it's deliberately direct-downloads-only. ## Security invariants User input and extractor-provided metadata (titles, playlist names, URLs) are untrusted

yusufkaraaslanReads credentialsAGENTS.md

Skill_Seekers

yusufkaraaslan/Skill_Seekers/AGENTS.md

FastMCP server skill-seekers-mcp # Or use the Python module python -m skill_seekers.mcp.server_fastmcp ``` ## Security Considerations - **API Keys:** Never commit API keys to version control. Use environment variables

NVIDIAAGENTS.md

TensorRT-LLM / kv_cache_manager_v2

NVIDIA/TensorRT-LLM/cpp/tensorrt_llm/batch_manager/kv_cache_manager_v2/AGENTS.md

digests over the reuse scope and the token sequence. They are a security boundary for cross-request reuse. Do not replace, truncate, or use a non-cryptographic hash unless prefix

maurosoriaReads credentialsAGENTS.md

dirsearch

maurosoria/dirsearch/AGENTS.md

titles. Use plain descriptive branch names and PR titles that fit the project history. ## Security & Configuration Tips Do not commit secrets, session artifacts, local virtualenv files, or cloud benchmark artifacts

logto-ioAGENTS.md

logto

logto-io/logto/AGENTS.md

Database Schema Core queries run as each tenant's database role under row-level security, which changes which indexes the planner can use. Before adding an index, a hot predicate

No other project uses it yet

kekingcnAGENTS.md

kkFileView

kekingcn/kkFileView/AGENTS.md

currently covers: - common preview smoke tests - Office smoke tests - archive smoke tests - basic security and performance checks ## CI / Deployment ### CI - `maven.yml` - builds on `push` to `master` - builds on PRs targeting

palmier-ioAGENTS.md

palmier-pro

palmier-io/palmier-pro/AGENTS.md

Agent surfaces. - Prioritize findings that can cause data loss, project corruption, crashes, hangs, races, security or privacy exposure, incorrect edits, broken undo, or misleading success. Then consider performance, maintainability

MicrosoftAGENTS.md

agent-framework / samples

microsoft/agent-framework/dotnet/samples/AGENTS.md

specific credential (e.g., ManagedIdentityCredential) to avoid // latency issues, unintended credential probing, and potential security risks from fallback mechanisms. AIAgent agent = new AIProjectClient(new Uri(endpoint), new DefaultAzureCredential()) .AsAIAgent(model: model

No other project uses it yet

MicrosoftAGENTS.md

agent-framework / ag-ui

microsoft/agent-framework/python/packages/ag-ui/AGENTS.md

minus a protected set: tool-approval state, history/context-provider namespaces, message-injection state, standalone FIDES security state, and provider-owned keys. When state is exposed to the model, keep

No other project uses it yet

MicrosoftReads credentialsAGENTS.md

agent-framework / core

microsoft/agent-framework/python/packages/core/AGENTS.md

exports ├── __init__.pyi # Public API typing surface for lazy root exports ├── security.py # Public security primitives, middleware, and tools ├── _agents.py # Agent implementations ├── _clients.py # Chat client base classes and protocols ├── _types.py # Core

MicrosoftAGENTS.md

agent-framework / devui

microsoft/agent-framework/python/packages/devui/AGENTS.md

bash # Run with auto-discovery devui ./agents # Run with specific entities devui --entities my_agent.py ``` ## Security Posture DevUI is a development-only sample app, not a production hosting surface. Authentication

No other project uses it yet

apacheAGENTS.md

dolphinscheduler

apache/dolphinscheduler/AGENTS.md

Agent Guide for dolphinscheduler This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. ## Security Security model: [SECURITY.md](./SECURITY.md) Agents that scan this