AGENTS.md examples from real projects

LMCacheAGENTS.md

LMCache / operator

LMCache/LMCache/operator/AGENTS.md

required regardless of `hostIPC`/`privileged`. Harmless on clusters that don't enforce PodSecurity. - **SCC (Security Context Constraints)**: M1 smokes never wait for DaemonSet pods to schedule

No other project uses it yet

jason5ng32AGENTS.md

MyIP

jason5ng32/MyIP/AGENTS.md

lookup, connectivity tests, WebRTC / DNS-leak detection, speed test, MTR, Whois, ASN profile, security checklist, browser fingerprint, anonymity checks, persona check, IP calculator, and more. Single repo, two halves

No other project uses it yet

jason5ng32AGENTS.md

MyIP / api

jason5ng32/MyIP/api/AGENTS.md

Periodic jobs wrap their tick in `server/sentry-cron.js`; `key` / `token` query params are redacted (`server/sentry-scrub.js`). ## Security & Boundaries ### Guards live in middleware, not handlers `server/guards.js`, attached in `backend-server.js`; handlers never repeat them

No other project uses it yet

dataelementDeletes or force-pushesAGENTS.md

bisheng

dataelement/bisheng/AGENTS.md

Backend Rules (P0) - **Architectural laws** (DDD layering / dual-DB / multi-tenancy / permissions / error codes / security) → [`docs/constitution.md`](docs/constitution.md) (C1–C7); enforced by `scripts/arch-guard.sh` + Constitution Check in `/sdd-review design`. - **Backend coding conventions

No other project uses it yet

Arize-aiAGENTS.md

phoenix

Arize-ai/phoenix/AGENTS.md

stale with every model release and miss aliases, deployment IDs, and proxied model names ### Security - GraphQL resolvers that perform side effects — outbound HTTP/RPC, "test connection" / credential validation, database writes, secret

mesheryReads credentialsAGENTS.md

meshery

meshery/meshery/AGENTS.md

ui/tests/e2e/connections.testmap.ts`). Contract docs: `docs/content/en/project/contributing/{cli/tests.md,build-and-release.md}`. "Connection Lifecycle" is the first such report. ## Security & Compliance - Report vulnerabilities: [security@meshery.io](mailto:security@meshery.io) — acknowledged in 10 business days. - Never commit secrets

No other project uses it yet

dreamhunter2333AGENTS.md

cloudflare_temp_email

dreamhunter2333/cloudflare_temp_email/AGENTS.md

with Vite proxy to worker — required for WebAuthn (`navigator.credentials`) and `crypto.subtle` which need a secure context. Browser tests use `ignoreHTTPSErrors: true`. Key patterns for browser tests: - Frontend hashes passwords with

esphomeAGENTS.md

esphome

esphome/esphome/AGENTS.md

dataclass`, never in module-level mutable globals (see the `component-codegen` skill). * **Security:** Be mindful of security when making changes to the API, web server, or any other network-related

OpenRefineAGENTS.md

OpenRefine

OpenRefine/OpenRefine/AGENTS.md

Cypress tests on pull requests - **Server Tests**: `.github/workflows/pull_request_server.yml` - Runs server-side tests - **CodeQL Analysis**: Security scanning for Java and JavaScript ## Development Workflow ### Code Contributions 1. Fork the repository 2. Create

No other project uses it yet

TencentCloudAGENTS.md

Octop

TencentCloud/Octop/AGENTS.md

Agent registry (`manager.py`), harness runtime, providers, settings (`settings/`), workspace paths (`workspace/`), threads helpers (`threads/`), security, persona/MBTI, experts, plugins, teams, memory | `server.py`, `gateway/`, `api/routers/agents.py` | | `infra/backend/` | Workspace storage adapter, resolver, remote probe

jxxghpAGENTS.md

MoviePilot

jxxghp/MoviePilot/AGENTS.md

responses, errors | [09 Interfaces](docs/rules/09-external-response.md) | | Database, transactions, runtime configuration | [10 Persistence](docs/rules/10-data-and-persistent.md) | | Quality gates, security, vulnerability audits | [11 Quality and Security](docs/rules/11-quality-and-security.md) | | Git, CI decisions, versions, releases | [12 Collaboration](docs/rules/12-collaboration-and-distribution.md

No other project uses it yet

MicrosoftAGENTS.md

presidio

microsoft/presidio/AGENTS.md

dataset); support it as an explicit, documented opt-in, never as the default behavior. - **Security**: never log PII values; validate untrusted inputs before use (user-supplied regexes before compilation, file

nasaAGENTS.md

fprime

nasa/fprime/docs/AGENTS.md

Prime works: architecture, framework concepts, GDS, design patterns, build system, security. | | `docs/how-to/` | Task-oriented | Step-by-step recipes for one specific job, grouped under `develop/`, `integrate/`, `operate/`, `test/`. | | `docs/reference/` | Information

No other project uses it yet

CloudflareReads credentialsAGENTS.md

cloudflare-os

cloudflare/cloudflare-os/AGENTS.md

rethink the design); and prefer reusing existing mechanisms over adding parallel ones. Capability-based security note: a resource becomes "ambient" (auto-injected) only by user/admin configuration — a gatekeeper must never

CloudflareAGENTS.md

cloudflare-os / configurator-ui

cloudflare/cloudflare-os/packages/configurator-ui/AGENTS.md

HTML document: the minified runtime, its Tailwind/Kumo CSS, and the module, under a content security policy that admits only those scripts by hash and allows no network access. - Kumo

CloudflareAGENTS.md

cloudflare-os / workshop-frontend

cloudflare/cloudflare-os/packages/workshop-frontend/AGENTS.md

block already says. Comments are appropriate for gotchas, non-obvious invariants, external constraints, security or performance reasoning, and deliberate departures from a convention. Explain why the surprising choice is necessary

WordPressAGENTS.md

gutenberg

WordPress/gutenberg/AGENTS.md

reads, read `docs/contributors/documentation/copy-guide.md` — it covers terminology, capitalization, and how to word an error message. - **Security**: before writing PHP that prints data into HTML, accepts input or exposes data, follow

BeehiveInnovationsReads credentialsAGENTS.md

zen-mcp-server

BeehiveInnovations/zen-mcp-server/AGENTS.md

Install GitHub CLI: `brew install gh` (macOS) or visit https://cli.github.com for other platforms. ## Security & Configuration Tips Store API keys and provider URLs in `.env` or your MCP client config

pestphpReads credentialsAGENTS.md

pest

pestphp/pest/AGENTS.md

that shows a secret, such as `env`, `printenv`, `set`, `cat .env`, `gh auth token`, `security find-generic-password` or `git config --get-regexp credential`. When you need only the names

betaflightAGENTS.md

betaflight

betaflight/betaflight/AGENTS.md

give a reason in one line. - *No value*: give the reason only. 3. **Security and data loss.** Do not give a security or data-loss finding the level *No value