AGENTS.md examples from real projects

apereoAGENTS.md

cas

apereo/cas/AGENTS.md

skill fits. | Skill | Read when the work touches | |---|---| | [`cas-actuators`](.claude/skills/cas-actuators/SKILL.md) | Actuator endpoints, management security | | [`cas-attribute-consent`](.claude/skills/cas-attribute-consent/SKILL.md) | `support/cas-server-support-consent*` | | [`cas-build-ci`](.claude/skills/cas-build-ci/SKILL.md) | Gradle build logic, `.github/workflows`, `ci/` scripts

QuipNetworkAGENTS.md

ethereum-sdk

QuipNetwork/ethereum-sdk/AGENTS.md

WalletFactory` keeps `_authorizeUpgrade` with its other internals near the file end. Rationale: on these security contracts, adjacency of each override and its helpers keeps the code auditable and preserves

spinabotReads credentialsAGENTS.md

brigade

spinabot/brigade/AGENTS.md

filesystem) + convex/ ├── config/ # brigade.json schema, io, validators ├── providers/ # model provider catalog + auth detection ├── auth/ · security/ # auth profiles, encryption (libsodium seal) ├── cron/ # scheduler + isolated-agent run executor ├── tui/ · ui/ # terminal client

No other project uses it yet

OpenAIAGENTS.md

codex-security

openai/codex-security/AGENTS.md

Keep it simple Codex Security is a thin wrapper around Codex and its security plugin. - Trust local tools and processes running as the current user. - Treat repository contents, model output

OpenAIAGENTS.md

codex-security / typescript

openai/codex-security/sdk/typescript/AGENTS.md

Codex Security CLI Codex Security is a thin CLI and SDK wrapper around Codex and its security plugin. Use their existing behavior instead of building another runtime. ## Threat model

No other project uses it yet

OpenAIReads credentialsAGENTS.md

openai-node

openai/openai-node/AGENTS.md

inputs/compiler and regenerate; never update inventory hashes to accept a handwritten patch. ## Security and lifecycle correctness - Never commit API keys, tokens, private keys, `.env` files, customer data, or other secrets

TEN-frameworkAGENTS.md

ten-framework

TEN-framework/ten-framework/AGENTS.md

them upfront. This gives you setup, architecture, code map, conventions, workflows, interfaces, gotchas, and security. 3. If a task needs more detail than L1 provides, follow links to L2 deep

bunkerityAGENTS.md

bunkerweb

bunkerity/bunkerweb/AGENTS.md

changes with maintainers and flag them clearly in both commit body and PR description. ## Security & Configuration Tips Never commit secrets—use sample files in `env/` or add new templates when

Model Context ProtocolReads credentialsAGENTS.md

inspector

modelcontextprotocol/inspector/AGENTS.md

merge, release notes (incl. reporter thanks), tag `origin/main`, publish, re-cut on failure | `/release` | | [`security-advisory`](.claude/skills/security-advisory/SKILL.md) | A privately reported vulnerability end to end: the draft card, who owns

tambo-aiAGENTS.md

tambo

tambo-ai/tambo/.github/AGENTS.md

GitHub Actions workflows: - **Pin actions to full commit SHA** with a version comment for security and reproducibility: ```yaml # Good - pinned to SHA with version comment - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

No other project uses it yet

LangChainAGENTS.md

open-swe

langchain-ai/open-swe/AGENTS.md

tests that do. - No speculative edge cases or the same behavior tested across layers. Security, authorization, data integrity, and tricky state transitions do deserve targeted coverage. - For bug fixes, prefer

chimuraiAGENTS.md

http-proxy-middleware

chimurai/http-proxy-middleware/AGENTS.md

markdown code block. NEVER include secrets, PII, or proprietary prompt content ## GitHub PR and Security Advisories - If the user asks you to open a GitHub PR or create a GitHub

nexmoeAGENTS.md

VidBee

nexmoe/VidBee/AGENTS.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

TencentCloudAGENTS.md

Octop

TencentCloud/Octop/AGENTS.md

Agent registry (`manager.py`), harness runtime, providers, settings (`settings/`), workspace paths (`workspace/`), threads helpers (`threads/`), security, persona/MBTI, experts, plugins, teams, memory | `server.py`, `gateway/`, `api/routers/agents.py` | | `infra/backend/` | Workspace storage adapter, resolver, remote probe

No other project uses it yet

apacheAGENTS.md

thrift

apache/thrift/AGENTS.md

code** (i.e., in the same directory) takes precedence on any conflict. --- ## 6. Security Work When assisting with security-sensitive changes (transport size limits, TLS configuration, authentication, serialization bounds, or anything

dotnetAGENTS.md

orleans

dotnet/orleans/AGENTS.md

Implementation principles Apply these principles during design, implementation, and validation, alongside correctness, security, compatibility, concurrency, and reliability. ## Priorities - Rank goals as correctness (including safety) > simplicity > performance > convenience; seek a design

dotnetAGENTS.md

orleans

dotnet/orleans/docs/AGENTS.md

Configure it with <xref:Orleans.Hosting.AzureTableSiloBuilderExtensions.AddAzureTableGrainStorage*?displayProperty=nameWithType>. ``` ## Documentation types Address relevant operational concerns: correctness, security, availability, upgrades, capacity, cost, and diagnosis under load. - **Architecture**: components, protocols, invariants, consistency, failure

47ngAGENTS.md

nuqs

47ng/nuqs/AGENTS.md

Workflow](.agents/docs/git-workflow.md)** — Conventional commits, semantic versioning, PR standards - **[Quality Standards](.agents/docs/quality-standards.md)** — Checklists, performance, security, anti-patterns --- ## Quick Reference: Common Tasks | Task | Guide | | ----------------------- | --------------------------------------------------------------------------------- | | Fix a bug | See [Testing Patterns](.agents/docs/testing.md) → Regression

go-vgoAGENTS.md

robotgo

go-vgo/robotgo/AGENTS.md

pure-Go `darwin/` backends). When reproducing bugs on darwin, verify System Settings → Privacy & Security first. - **Do not vendor**: `vendor/` is in `.gitignore`; also avoid `go mod vendor` (upstream note

mauticAGENTS.md

mautic

mautic/mautic/AGENTS.md

Unit + Functional tests │ ├── Unit/ │ └── Functional/ └── Views/ # Twig templates ``` ### Key Core Bundles - **CoreBundle**: Foundation (helpers, security, base classes) - **LeadBundle**: Contact/company management - **CampaignBundle**: Campaign builder & execution - **EmailBundle**: Email marketing - **FormBundle**: Form builder