AGENTS.md examples from real projects

inventreeAGENTS.md

InvenTree

inventree/InvenTree/AGENTS.md

CONTRIBUTING.md](CONTRIBUTING.md) for codebase guidance. Security reports must follow the security policy in [SECURITY.md](docs/docs/SECURITY.md) and provide how they interact with the [threat model](docs/docs/concepts/threat_model.md). Do not open a pull

No other project uses it yet

OpenAIAGENTS.md

plugins / react-best-practices

openai/plugins/plugins/build-web-apps/skills/react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

OpenAIAGENTS.md

plugins / supabase-best-practices

openai/plugins/plugins/build-web-apps/skills/supabase-best-practices/AGENTS.md

Configuring connection pooling or scaling - Optimizing for Postgres-specific features - Working with Row-Level Security (RLS) ## Rule Categories by Priority | Priority | Category | Impact | Prefix | |----------|----------|--------|--------| | 1 | Query Performance | CRITICAL | `query

OpenAIAGENTS.md

plugins / react-best-practices

openai/plugins/plugins/vercel/skills/react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

midwayjsAGENTS.md

midway / openspec

midwayjs/midway/openspec/AGENTS.md

Make breaking changes (API, schema) - Change architecture or patterns - Optimize performance (changes behavior) - Update security patterns Triggers (examples): - "Help me create a change proposal" - "Help me plan a change" - "Help

markqvistAGENTS.md

Reticulum

markqvist/Reticulum/AGENTS.md

like RNS that updates continuously, sometimes daily, and has a track-record of shipping security updates mere hours after issues are discovered, would be crippled by packaging that makes every

No other project uses it yet

SupabaseAGENTS.md

realtime

supabase/realtime/AGENTS.md

example `feat(api)!: drop old endpoint`. It cuts a major release whatever the type. ## Security Follow the repository [security policy](https://github.com/supabase/realtime/security/policy). - Do not open Pull Requests

superdesigndevAGENTS.md

treg

superdesigndev/treg/AGENTS.md

treg-worker admin erase-archive`), never a side effect of the switch. See `docs/context/architecture/archive.md`. ### Security guards that look redundant on purpose `expose_dev_code` (dev OTP only on a local

kubernetes-sigsAGENTS.md

headlamp

kubernetes-sigs/headlamp/AGENTS.md

workflows - `Dockerfile`, `Dockerfile.plugins` - container definitions - `charts/` - Helm charts - `kubernetes-*.yaml` - Kubernetes manifests - `SECURITY.md`, `SECURITY_CONTACTS` - security policy files - `OWNERS`, `OWNERS_ALIASES` - maintainer lists (documented in `/OWNERS`) - `LICENSE`, `NOTICE` - license files

No other project uses it yet

evcc-ioAGENTS.md

evcc

evcc-io/evcc/AGENTS.md

Modbus, SunSpec, JS) | | [Web UI & API](docs/agents/web-ui-api.md) | REST API, WebSocket, Vue frontend, authentication | | [API Security](docs/agents/api-security.md) | Auth modes, JWT/API key/session, two-tier checks, credential storage | | [Provider Auth](docs/agents/provider-auth.md) | Third-party

Sequel-AceAGENTS.md

Sequel-Ace

Sequel-Ace/Sequel-Ace/AGENTS.md

call `NSArchiver`/`NSUnarchiver` or the deprecated `NSKeyedUnarchiver.unarchiveObject(with:)`. Use `SAArchiving` (`Source/Other/Extensions/SAArchiving.swift`) — it writes keyed+secure and reads keyed-first with a legacy non-keyed fallback. That fallback

condaAGENTS.md

conda

conda/conda/AGENTS.md

user-visible behavior, cross-platform/shell-specific behavior, external integrations (canary/proxy/SSL/plugins), high-risk regression paths, security-sensitive paths. - **Not QA-worthy:** pure docs/CI/typing, internal refactor with no user-observable change, fully

di-sukharevAGENTS.md

opencommit

di-sukharev/opencommit/AGENTS.md

dependency authorizes it. Never print or commit secrets or personal data. Never weaken security controls. Keep temporary files in the system temp directory and delete yours afterward. Use your

NVIDIA-NeMoAGENTS.md

Guardrails

NVIDIA-NeMo/Guardrails/AGENTS.md

stable), then a structured code review (for example `codex review` or `/code-review`) with a security pass for auth, input-handling, deserialization, or external-call changes. Treat findings as advisory: verify

No other project uses it yet

TencentAGENTS.md

AI-Infra-Guard

Tencent/AI-Infra-Guard/AGENTS.md

agent-scan/requirements.txt python agent-scan/main.py --repo /path/to/project --agent_provider /path/to/provider.yaml # Prompt Security pip install -r AIG-PromptSecurity/requirements.txt ``` ## 测试与校验要求 ### 必做校验（按改动范围执行） ```bash # Go 单测 go test ./... # YAML 规则格式校验

No other project uses it yet

sverweijAGENTS.md

dependency-cruiser

sverweij/dependency-cruiser/AGENTS.md

lite|full|ultra Stop: "stop caveman" or "normal mode" Auto-Clarity: drop caveman for security warnings, irreversible actions, user confused. Resume after. Boundaries: code/commits/PRs written normal. ## Module System - Use ECMAScript

No other project uses it yet

feast-devAGENTS.md

feast

feast-dev/feast/AGENTS.md

modifying - Do not put `pip install` commands in docstrings or code comments. Security scanners flag them as runtime package installs, which fail in air-gapped or mirror-only environments. Name

No other project uses it yet

telepresenceioAGENTS.md

telepresence

telepresenceio/telepresence/AGENTS.md

notarized to pass Gatekeeper verification. The signing process uses a protected GitHub Environment to secure the signing credentials. #### Environment Setup The `build-macos-pkg` job uses the `macos-signing` environment

No other project uses it yet

Serial-StudioAGENTS.md

Serial-Studio

Serial-Studio/Serial-Studio/AGENTS.md

selection, subscriptions with polling fallback, and project generation from the ticked tags (six security policies, `None` through `Aes256_Sha256_RsaPss`, Sign or Sign & Encrypt). - **User problem:** "My Siemens

gopasspwAGENTS.md

gopass

gopasspw/gopass/AGENTS.md

utility functions for creating and dealing with temp files. It attempts to be more secure than the normal temp file functions from the stdlib. Prefer those over the stdlib. - `/pkg/termio

No other project uses it yet