AGENTS.md examples from real projects

darlinghqAGENTS.md

darling

darlinghq/darling/AGENTS.md

behavior** for cases the documentation does cover. A quirk applies only to the gap. - **Security-sensitive quirks** (crypto, authentication, sandboxing, signature or certificate validation, memory safety) are never implemented without

No other project uses it yet

fluentAGENTS.md

fluentd

fluent/fluentd/AGENTS.md

code style; there is no autoformatter to run. CI runs `rubocop`, but only the Security and Performance cops are enabled. - Fluentd runs on Linux, macOS and Windows. CI tests `ubuntu

tester-armyReads credentialsAGENTS.md

e2e

tester-army/e2e/AGENTS.md

wire change edits the schema, both fixtures, and the producer in one review. - Security invariants are the list under Gotchas below, enforced by tests in `tests/integration/agent-policy.test.ts` and the secret-ledger

MetaMaskReads credentialsAGENTS.md

metamask-extension

MetaMask/metamask-extension/AGENTS.md

BaseController architecture **Testing:** Jest (unit), Playwright (E2E) **Build System:** Webpack (with LavaMoat for production) **Security:** LavaMoat policies required for all dependency changes ### Critical Rules for Agents 1. **ALWAYS use TypeScript

nasaAGENTS.md

openmct

nasa/openmct/AGENTS.md

troubleshooting | [TESTING.md](TESTING.md) | | Writing and running Playwright tests, fixtures, CI architecture | [e2e/README.md](e2e/README.md) | | Security policy and vulnerability reporting | [SECURITY.md](SECURITY.md) | | Release process and notable-change policy | [docs/src/process/release.md](docs/src/process/release.md) | | Common coding

NangoHQReads credentialsAGENTS.md

nango

NangoHQ/nango/docs/AGENTS.md

technical guides for concepts common to Auth and Functions. This includes environments, observability, limits, security, self-hosting, webhook forwarding, and webhooks received from Nango. - **Use cases** — orientation and routing pages

No other project uses it yet

cesantaAGENTS.md

mongoose

cesanta/mongoose/AGENTS.md

RTOS, with no external dependencies. Use it for cloud connectivity, device web dashboards, secure firmware updates and remote control. License: GPLv2 or commercial. Website: https://mongoose.ws/ GitHub repo: https://github.com

No other project uses it yet

daijroAGENTS.md

camoufox

daijro/camoufox/AGENTS.md

Never write a test just to pass, or code just to pass a test.** ## Security - **Never commit a credential.** That covers code, config, fixtures, logs and commit messages. CI secrets

AWSAGENTS.md

aws-cdk

aws/aws-cdk/AGENTS.md

factory methods instead - No `Token` type in props - `SecretValue` type for any password/secret/token properties ## Security Rules - SHOULD prefer specific IAM actions over full-service wildcards (`s3:*`), but suffix wildcards

datahub-projectReads credentialsAGENTS.md

datahub

datahub-project/datahub/AGENTS.md

code - **Error Handling**: Robust error handling with layers of protection for known failure points - **Security**: Never pass credentials to third-party SDKs via `os.environ`. Use the SDK's programmatic injection

No other project uses it yet

datahub-projectReads credentialsAGENTS.md

datahub / metadata-ingestion

datahub-project/datahub/metadata-ingestion/AGENTS.md

config-driven filtering that should be automatic - **Validation**: Single pydantic validator per validation concern - **Security**: Use `SecretStr` for passwords, auth tokens, etc. - **Deprecation**: Use `pydantic_removed_field` helper for field

No other project uses it yet

elie222Reads credentialsAGENTS.md

inbox-zero

elie222/inbox-zero/AGENTS.md

safety constraints specific to that tool. - Keep only cross-cutting policies (identity, write confirmation, security, formatting) in the system prompt. Per-tool guidance belongs in the tool description

No other project uses it yet

rubocopAGENTS.md

rubocop

rubocop/rubocop/AGENTS.md

lazy loading (auto-updated by generator) ``` Departments: `Bundler`, `Gemspec`, `Layout`, `Lint`, `Metrics`, `Migration`, `Naming`, `Security`, `Style`, `InternalAffairs`. ## Creating a New Cop Scaffold: ```bash bundle exec rake 'new_cop[Department/CopName]' ``` This

cfugDeletes or force-pushesAGENTS.md

dio

cfug/dio/AGENTS.md

issue for maintainers to decide. Do not merge-request it unilaterally. ### Extra scrutiny in security- and network-critical areas Some parts of dio have oversized blast radius when broken. Changes

No other project uses it yet

go-admin-teamAGENTS.md

go-admin

go-admin-team/go-admin/AGENTS.md

generate` 会据此生成文档： ```go // @Summary 岗位列表 // @Tags 岗位 // @Success 200 {object} response.Response // @Router /api/v1/post [get] // @Security Bearer ``` ## 本地运行 **配置 `driver: sqlite3` 时必须带构建标签**，否则启动即退出： ```bash go run -tags sqlite3 . migrate -c config/settings.sqlite.yml

Tracer-CloudAGENTS.md

opensre / gateway

Tracer-Cloud/opensre/gateway/AGENTS.md

startup` only). - `transports/` — chat peers (`slack`, `discord`, `telegram`). Each owns settings, inbound worker, security, turn output, and `startup.py`. Peers never import each other or `gateway.startup`/`web`; anything two need belongs

No other project uses it yet

btriapitsynAGENTS.md

openchamber

btriapitsyn/openchamber/AGENTS.md

when the maintainer asks to update the changelog, through the `update-changelog` skill. - Enforce security and correctness in core/runtime logic, not only UI visibility or prompts. ## Correctness Invariants - Prefer authoritative

secdevAGENTS.md

scapy

secdev/scapy/AGENTS.md

within the user's requested scope. Do not report speculative style preferences. - For possible security vulnerabilities, follow `SECURITY.md` and its private reporting process; do not post vulnerability details

No other project uses it yet

ElasticAGENTS.md

beats

elastic/beats/AGENTS.md

services and endpoints, detecting uptime/downtime | | `auditbeat` | Gathers audit data from systems to track security events, user activities, and compliance requirements | | `packetbeat` | Analyzes network traffic by capturing and inspecting packets

nearaiReads credentialsAGENTS.md

ironclaw

nearai/ironclaw/AGENTS.md

backends in the llm spec (`LlmBackendKind` in `crates/domains/ironclaw_llm/src/config.rs` is the source of truth). ## Security and runtime invariants - Treat every listener, route, product adapter, runtime lane, container, and external service