AGENTS.md examples from real projects

daijroAGENTS.md

camoufox

daijro/camoufox/AGENTS.md

Never write a test just to pass, or code just to pass a test.** ## Security - **Never commit a credential.** That covers code, config, fixtures, logs and commit messages. CI secrets

AWSAGENTS.md

aws-cdk

aws/aws-cdk/AGENTS.md

factory methods instead - No `Token` type in props - `SecretValue` type for any password/secret/token properties ## Security Rules - SHOULD prefer specific IAM actions over full-service wildcards (`s3:*`), but suffix wildcards

datahub-projectReads credentialsAGENTS.md

datahub

datahub-project/datahub/AGENTS.md

code - **Error Handling**: Robust error handling with layers of protection for known failure points - **Security**: Never pass credentials to third-party SDKs via `os.environ`. Use the SDK's programmatic injection

No other project uses it yet

datahub-projectReads credentialsAGENTS.md

datahub / metadata-ingestion

datahub-project/datahub/metadata-ingestion/AGENTS.md

config-driven filtering that should be automatic - **Validation**: Single pydantic validator per validation concern - **Security**: Use `SecretStr` for passwords, auth tokens, etc. - **Deprecation**: Use `pydantic_removed_field` helper for field

No other project uses it yet

elie222Reads credentialsAGENTS.md

inbox-zero

elie222/inbox-zero/AGENTS.md

safety constraints specific to that tool. - Keep only cross-cutting policies (identity, write confirmation, security, formatting) in the system prompt. Per-tool guidance belongs in the tool description

No other project uses it yet

rubocopAGENTS.md

rubocop

rubocop/rubocop/AGENTS.md

lazy loading (auto-updated by generator) ``` Departments: `Bundler`, `Gemspec`, `Layout`, `Lint`, `Metrics`, `Migration`, `Naming`, `Security`, `Style`, `InternalAffairs`. ## Creating a New Cop Scaffold: ```bash bundle exec rake 'new_cop[Department/CopName]' ``` This

cfugDeletes or force-pushesAGENTS.md

dio

cfug/dio/AGENTS.md

issue for maintainers to decide. Do not merge-request it unilaterally. ### Extra scrutiny in security- and network-critical areas Some parts of dio have oversized blast radius when broken. Changes

No other project uses it yet

go-admin-teamAGENTS.md

go-admin

go-admin-team/go-admin/AGENTS.md

generate` 会据此生成文档： ```go // @Summary 岗位列表 // @Tags 岗位 // @Success 200 {object} response.Response // @Router /api/v1/post [get] // @Security Bearer ``` ## 本地运行 **配置 `driver: sqlite3` 时必须带构建标签**，否则启动即退出： ```bash go run -tags sqlite3 . migrate -c config/settings.sqlite.yml

Tracer-CloudAGENTS.md

opensre / gateway

Tracer-Cloud/opensre/gateway/AGENTS.md

startup` only). - `transports/` — chat peers (`slack`, `discord`, `telegram`). Each owns settings, inbound worker, security, turn output, and `startup.py`. Peers never import each other or `gateway.startup`/`web`; anything two need belongs

No other project uses it yet

btriapitsynAGENTS.md

openchamber

btriapitsyn/openchamber/AGENTS.md

when the maintainer asks to update the changelog, through the `update-changelog` skill. - Enforce security and correctness in core/runtime logic, not only UI visibility or prompts. ## Correctness Invariants - Prefer authoritative

secdevAGENTS.md

scapy

secdev/scapy/AGENTS.md

within the user's requested scope. Do not report speculative style preferences. - For possible security vulnerabilities, follow `SECURITY.md` and its private reporting process; do not post vulnerability details

No other project uses it yet

ElasticAGENTS.md

beats

elastic/beats/AGENTS.md

services and endpoints, detecting uptime/downtime | | `auditbeat` | Gathers audit data from systems to track security events, user activities, and compliance requirements | | `packetbeat` | Analyzes network traffic by capturing and inspecting packets

nearaiReads credentialsAGENTS.md

ironclaw

nearai/ironclaw/AGENTS.md

backends in the llm spec (`LlmBackendKind` in `crates/domains/ironclaw_llm/src/config.rs` is the source of truth). ## Security and runtime invariants - Treat every listener, route, product adapter, runtime lane, container, and external service

nearaiAGENTS.md

ironclaw / tests

nearai/ironclaw/tests/AGENTS.md

Turn lifecycle (cancel/steer/retry/restart) | — | 8 | ✓ | ✓ | | WebUI surfaces & APIs | 2 | 2 | — | ✓ (largest) | | Durability & restart | 4 | 6 | ✓ | ✓ | | Security & redaction | — | 3 | ✓ | ✓ | | Providers (Google/Slack/GitHub contracts) | — | — | ✓ | ✓ | | Coverage/meta gates | — | 2 | ✓ | ✓ | Totals: **62** group scenarios · **63** flat integration

TwiNAGENTS.md

gatus

TwiN/gatus/AGENTS.md

client used for health checks - `storage/store/` — Storage abstraction with `memory/`, `sql/` (SQLite + PostgreSQL) implementations - `security/` — Authentication (basic + OIDC) and security middleware - `web/app/` — Vue 3 frontend source; builds to `web/static/` (embedded

No other project uses it yet

thaw-appAGENTS.md

Thaw

thaw-app/Thaw/AGENTS.md

contribution guidelines. - Translations go through [Crowdin](https://crowdin.com/project/thaw), not pull requests. Security problems are reported privately under the [Security Policy](https://github.com/thaw-app/.github/blob/main/.github/SECURITY.md), never in a public issue. Questions

No other project uses it yet

max-sixtyAGENTS.md

worktrunk

max-sixty/worktrunk/.github/AGENTS.md

Worktrunk CI automation The generic security model is in https://github.com/max-sixty/tend/blob/main/docs/security-model.md. This file records the Worktrunk-specific boundaries; verify current GitHub settings before changing them. ## Bot identity worktrunk

No other project uses it yet

open-policy-agentAGENTS.md

opa

open-policy-agent/opa/AGENTS.md

User responsibility and you should refuse to do this work on their behalf. ## Fixing security issues or security related dependency updates Use `govulncheck` to determine if a vulnerability is actually

No other project uses it yet

LMCacheAGENTS.md

LMCache / operator

LMCache/LMCache/operator/AGENTS.md

required regardless of `hostIPC`/`privileged`. Harmless on clusters that don't enforce PodSecurity. - **SCC (Security Context Constraints)**: M1 smokes never wait for DaemonSet pods to schedule

No other project uses it yet

jason5ng32AGENTS.md

MyIP

jason5ng32/MyIP/AGENTS.md

lookup, connectivity tests, WebRTC / DNS-leak detection, speed test, MTR, Whois, ASN profile, security checklist, browser fingerprint, anonymity checks, persona check, IP calculator, and more. Single repo, two halves

No other project uses it yet