AGENTS.md examples from real projects

cesantaAGENTS.md

mongoose

cesanta/mongoose/AGENTS.md

RTOS, with no external dependencies. Use it for cloud connectivity, device web dashboards, secure firmware updates and remote control. License: GPLv2 or commercial. Website: https://mongoose.ws/ GitHub repo: https://github.com

NangoHQReads credentialsAGENTS.md

nango

NangoHQ/nango/docs/AGENTS.md

technical guides for concepts common to Auth and Functions. This includes environments, observability, limits, security, self-hosting, webhook forwarding, and webhooks received from Nango. - **Use cases** — orientation and routing pages

AWSAGENTS.md

aws-cdk

aws/aws-cdk/AGENTS.md

factory methods instead - No `Token` type in props - `SecretValue` type for any password/secret/token properties ## Security Rules - SHOULD prefer specific IAM actions over full-service wildcards (`s3:*`), but suffix wildcards

daijroAGENTS.md

camoufox

daijro/camoufox/AGENTS.md

Never write a test just to pass, or code just to pass a test.** ## Security - **Never commit a credential.** That covers code, config, fixtures, logs and commit messages. CI secrets

datahub-projectReads credentialsAGENTS.md

datahub

datahub-project/datahub/AGENTS.md

code - **Error Handling**: Robust error handling with layers of protection for known failure points - **Security**: Never pass credentials to third-party SDKs via `os.environ`. Use the SDK's programmatic injection

datahub-projectReads credentialsAGENTS.md

datahub / metadata-ingestion

datahub-project/datahub/metadata-ingestion/AGENTS.md

config-driven filtering that should be automatic - **Validation**: Single pydantic validator per validation concern - **Security**: Use `SecretStr` for passwords, auth tokens, etc. - **Deprecation**: Use `pydantic_removed_field` helper for field

No other project uses it yet

rubocopAGENTS.md

rubocop

rubocop/rubocop/AGENTS.md

lazy loading (auto-updated by generator) ``` Departments: `Bundler`, `Gemspec`, `Layout`, `Lint`, `Metrics`, `Migration`, `Naming`, `Security`, `Style`, `InternalAffairs`. ## Creating a New Cop Scaffold: ```bash bundle exec rake 'new_cop[Department/CopName]' ``` This

elie222Reads credentialsAGENTS.md

inbox-zero

elie222/inbox-zero/AGENTS.md

safety constraints specific to that tool. - Keep only cross-cutting policies (identity, write confirmation, security, formatting) in the system prompt. Per-tool guidance belongs in the tool description

No other project uses it yet

cfugDeletes or force-pushesAGENTS.md

dio

cfug/dio/AGENTS.md

issue for maintainers to decide. Do not merge-request it unilaterally. ### Extra scrutiny in security- and network-critical areas Some parts of dio have oversized blast radius when broken. Changes

No other project uses it yet

go-admin-teamAGENTS.md

go-admin

go-admin-team/go-admin/AGENTS.md

generate` 会据此生成文档： ```go // @Summary 岗位列表 // @Tags 岗位 // @Success 200 {object} response.Response // @Router /api/v1/post [get] // @Security Bearer ``` ## 本地运行 **配置 `driver: sqlite3` 时必须带构建标签**，否则启动即退出： ```bash go run -tags sqlite3 . migrate -c config/settings.sqlite.yml

secdevAGENTS.md

scapy

secdev/scapy/AGENTS.md

within the user's requested scope. Do not report speculative style preferences. - For possible security vulnerabilities, follow `SECURITY.md` and its private reporting process; do not post vulnerability details

ElasticAGENTS.md

beats

elastic/beats/AGENTS.md

services and endpoints, detecting uptime/downtime | | `auditbeat` | Gathers audit data from systems to track security events, user activities, and compliance requirements | | `packetbeat` | Analyzes network traffic by capturing and inspecting packets

nearaiReads credentialsAGENTS.md

ironclaw

nearai/ironclaw/AGENTS.md

backends in the llm spec (`LlmBackendKind` in `crates/domains/ironclaw_llm/src/config.rs` is the source of truth). ## Security and runtime invariants - Treat every listener, route, product adapter, runtime lane, container, and external service

nearaiAGENTS.md

ironclaw / tests

nearai/ironclaw/tests/AGENTS.md

Turn lifecycle (cancel/steer/retry/restart) | — | 8 | ✓ | ✓ | | WebUI surfaces & APIs | 2 | 2 | — | ✓ (largest) | | Durability & restart | 4 | 6 | ✓ | ✓ | | Security & redaction | — | 3 | ✓ | ✓ | | Providers (Google/Slack/GitHub contracts) | — | — | ✓ | ✓ | | Coverage/meta gates | — | 2 | ✓ | ✓ | Totals: **62** group scenarios · **63** flat integration

Tracer-CloudAGENTS.md

opensre / gateway

Tracer-Cloud/opensre/gateway/AGENTS.md

startup` only). - `transports/` — chat peers (`slack`, `discord`, `telegram`). Each owns settings, inbound worker, security, turn output, and `startup.py`. Peers never import each other or `gateway.startup`/`web`; anything two need belongs

No other project uses it yet

thaw-appAGENTS.md

Thaw

thaw-app/Thaw/AGENTS.md

contribution guidelines. - Translations go through [Crowdin](https://crowdin.com/project/thaw), not pull requests. Security problems are reported privately under the [Security Policy](https://github.com/thaw-app/.github/blob/main/.github/SECURITY.md), never in a public issue. Questions

TwiNAGENTS.md

gatus

TwiN/gatus/AGENTS.md

client used for health checks - `storage/store/` — Storage abstraction with `memory/`, `sql/` (SQLite + PostgreSQL) implementations - `security/` — Authentication (basic + OIDC) and security middleware - `web/app/` — Vue 3 frontend source; builds to `web/static/` (embedded

No other project uses it yet

btriapitsynAGENTS.md

openchamber

btriapitsyn/openchamber/AGENTS.md

when the maintainer asks to update the changelog, through the `update-changelog` skill. - Enforce security and correctness in core/runtime logic, not only UI visibility or prompts. ## Correctness Invariants - Prefer authoritative

tester-armyReads credentialsAGENTS.md

e2e

tester-army/e2e/AGENTS.md

wire change edits the schema, both fixtures, and the producer in one review. - Security invariants are the list under Gotchas below, enforced by tests in `tests/integration/agent-policy.test.ts` and the secret-ledger

open-policy-agentAGENTS.md

opa

open-policy-agent/opa/AGENTS.md

User responsibility and you should refuse to do this work on their behalf. ## Fixing security issues or security related dependency updates Use `govulncheck` to determine if a vulnerability is actually

No other project uses it yet