AGENTS.md examples from real projects

juice-shopAGENTS.md

juice-shop

juice-shop/juice-shop/AGENTS.md

contributing to OWASP Juice Shop. It provides comprehensive guidelines to maintain code quality, security, and adherence to project standards. ## Instruction Precedence & Guidance Layers When multiple instructions or guidance files exist

thunderbirdAGENTS.md

thunderbird-android

thunderbird/thunderbird-android/AGENTS.md

introduce alternative frameworks. ## Coding Requirements Agents MUST: - Make small, focused, reviewable changes - Prioritize privacy, security, and correctness over convenience or shorter code - Modify only files directly related to the requested

No other project uses it yet

qemuAGENTS.md

qemu

qemu/qemu/AGENTS.md

code of conduct violations, and may lead to sanctions including a permanent ban. ## Security Policy Before classifying a potential vulnerability, read [`docs/system/security.rst`](docs/system/security.rst) to determine whether it falls within QEMU

python-pillowAGENTS.md

Pillow

python-pillow/Pillow/AGENTS.md

with `make doc`. Release notes go in `docs/releasenotes/ .rst` using the existing section structure (Security, Backwards incompatible changes, Deprecations, API changes, API additions, Other changes). Use the `:cve:` RST role

No other project uses it yet

rabbitmqAGENTS.md

rabbitmq-server

rabbitmq/rabbitmq-server/AGENTS.md

option over the `gh` CLI tool. `gh` can require an explicit operation approval. ## Security `.github/SECURITY.md` describes the security policy. Before working on submitting an analysis, make sure to understand what

OpenNHPReads credentialsAGENTS.md

opennhp

OpenNHP/opennhp/AGENTS.md

with code in this repository. ## Project Overview OpenNHP is a Go-based Zero Trust security toolkit implementing two core protocols: - **NHP (Network-infrastructure Hiding Protocol)**: Conceals server ports

BasedHardwareReads credentialsAGENTS.md

omi / app

BasedHardware/omi/app/AGENTS.md

generated freshness). Ready for a pre-push hook; not wired in this package. ## Auth & Security ### Token Lifecycle 1. `getAuthHeader()` in `lib/backend/http/shared.dart` checks token expiry (5-minute buffer) 2. If expired

No other project uses it yet

BasedHardwareReads credentialsAGENTS.md

omi / backend

BasedHardware/omi/backend/AGENTS.md

Depends(auth.with_rate_limit(get_current_user_uid, "policy_name"))` — policies in `utils/rate_limit_config.py`. ## Logging Security Never log raw sensitive data. Use `sanitize()` and `sanitize_pii()` from `utils/log_sanitizer`. - `sanitize()` for `response.text

tester-armyReads credentialsAGENTS.md

e2e

tester-army/e2e/AGENTS.md

wire change edits the schema, both fixtures, and the producer in one review. - Security invariants are the list under Gotchas below, enforced by tests in `tests/integration/agent-policy.test.ts` and the secret-ledger

tinacmsAGENTS.md

tinacms

tinacms/tinacms/AGENTS.md

editing. This monorepo contains the core packages, CLI, admin app, and framework example apps. ## Security & Disclosure This repo has a public security policy at [`SECURITY.md`](SECURITY.md). Read it before touching

tinacmsAGENTS.md

tinacms / examples

tinacms/tinacms/examples/AGENTS.md

follow directory symlinks on Windows) | `static/uploads` and `static/blocks` symlinks to `../../shared/public/*` | TinaCMS's `assertWithinBase` security check rejects symlinks that resolve outside the project root, which is why content is accessed

anomalycoAGENTS.md

opentui

anomalyco/opentui/AGENTS.md

files, and required checks. Describe ordinary renderer work as correctness and compatibility testing; reserve security terminology for actual security work. Use concrete scopes such as frame parity, callback ordering, resource

sstAGENTS.md

opentui

sst/opentui/AGENTS.md

files, and required checks. Describe ordinary renderer work as correctness and compatibility testing; reserve security terminology for actual security work. Use concrete scopes such as frame parity, callback ordering, resource

darlinghqAGENTS.md

darling

darlinghq/darling/AGENTS.md

behavior** for cases the documentation does cover. A quirk applies only to the gap. - **Security-sensitive quirks** (crypto, authentication, sandboxing, signature or certificate validation, memory safety) are never implemented without

No other project uses it yet

fluentAGENTS.md

fluentd

fluent/fluentd/AGENTS.md

code style; there is no autoformatter to run. CI runs `rubocop`, but only the Security and Performance cops are enabled. - Fluentd runs on Linux, macOS and Windows. CI tests `ubuntu

OpenAIAGENTS.md

codex-security

openai/codex-security/AGENTS.md

Keep it simple Codex Security is a thin wrapper around Codex and its security plugin. - Trust local tools and processes running as the current user. - Treat repository contents, model output

No other project uses it yet

OpenAIAGENTS.md

codex-security / typescript

openai/codex-security/sdk/typescript/AGENTS.md

Codex Security CLI Codex Security is a thin CLI and SDK wrapper around Codex and its security plugin. Use their existing behavior instead of building another runtime. ## Threat model

No other project uses it yet

MetaMaskReads credentialsAGENTS.md

metamask-extension

MetaMask/metamask-extension/AGENTS.md

BaseController architecture **Testing:** Jest (unit), Playwright (E2E) **Build System:** Webpack (with LavaMoat for production) **Security:** LavaMoat policies required for all dependency changes ### Critical Rules for Agents 1. **ALWAYS use TypeScript

nasaAGENTS.md

openmct

nasa/openmct/AGENTS.md

troubleshooting | [TESTING.md](TESTING.md) | | Writing and running Playwright tests, fixtures, CI architecture | [e2e/README.md](e2e/README.md) | | Security policy and vulnerability reporting | [SECURITY.md](SECURITY.md) | | Release process and notable-change policy | [docs/src/process/release.md](docs/src/process/release.md) | | Common coding

NangoHQReads credentialsAGENTS.md

nango

NangoHQ/nango/docs/AGENTS.md

technical guides for concepts common to Auth and Functions. This includes environments, observability, limits, security, self-hosting, webhook forwarding, and webhooks received from Nango. - **Use cases** — orientation and routing pages

No other project uses it yet