AGENTS.md examples from real projects

grafanaAGENTS.md

pyroscope

grafana/pyroscope/AGENTS.md

commit changes to `node_modules/` or generated code without source changes ## Security Considerations 1. **Input Validation**: Always validate and sanitize user input 2. **Path Traversal**: Validate object keys before storage

No other project uses it yet

WhiskeySocketsReads credentialsAGENTS.md

Baileys

WhiskeySockets/Baileys/AGENTS.md

separately; bundle them in their own PR when possible. - **`package.json` `resolutions`** — these patch known security advisories. Removing entries reintroduces CVEs; check `yarn npm audit --recursive` before pruning. ## Testing expectations

No other project uses it yet

apereoAGENTS.md

cas

apereo/cas/AGENTS.md

skill fits. | Skill | Read when the work touches | |---|---| | [`cas-actuators`](.claude/skills/cas-actuators/SKILL.md) | Actuator endpoints, management security | | [`cas-attribute-consent`](.claude/skills/cas-attribute-consent/SKILL.md) | `support/cas-server-support-consent*` | | [`cas-build-ci`](.claude/skills/cas-build-ci/SKILL.md) | Gradle build logic, `.github/workflows`, `ci/` scripts

spinabotReads credentialsAGENTS.md

brigade

spinabot/brigade/AGENTS.md

filesystem) + convex/ ├── config/ # brigade.json schema, io, validators ├── providers/ # model provider catalog + auth detection ├── auth/ · security/ # auth profiles, encryption (libsodium seal) ├── cron/ # scheduler + isolated-agent run executor ├── tui/ · ui/ # terminal client

QuipNetworkAGENTS.md

ethereum-sdk

QuipNetwork/ethereum-sdk/AGENTS.md

WalletFactory` keeps `_authorizeUpgrade` with its other internals near the file end. Rationale: on these security contracts, adjacency of each override and its helpers keeps the code auditable and preserves

Model Context ProtocolReads credentialsAGENTS.md

inspector

modelcontextprotocol/inspector/AGENTS.md

merge, release notes (incl. reporter thanks), tag `origin/main`, publish, re-cut on failure | `/release` | | [`security-advisory`](.claude/skills/security-advisory/SKILL.md) | A privately reported vulnerability end to end: the draft card, who owns

OpenAIAGENTS.md

openai-node

openai/openai-node/AGENTS.md

meaningful public JSDoc. Preserve documentation URLs/import paths; examples must run with documented environments/dependencies. ## Security and lifecycle correctness Read and apply [contributor security requirements](.github/CONTRIBUTING.md#security-requirements) for credentials/synthetic fixtures, browser

No other project uses it yet

TEN-frameworkAGENTS.md

ten-framework

TEN-framework/ten-framework/AGENTS.md

them upfront. This gives you setup, architecture, code map, conventions, workflows, interfaces, gotchas, and security. 3. If a task needs more detail than L1 provides, follow links to L2 deep

LangChainAGENTS.md

open-swe

langchain-ai/open-swe/AGENTS.md

tests that do. - No speculative edge cases or the same behavior tested across layers. Security, authorization, data integrity, and tricky state transitions do deserve targeted coverage. - For bug fixes, prefer

bunkerityAGENTS.md

bunkerweb

bunkerity/bunkerweb/AGENTS.md

changes with maintainers and flag them clearly in both commit body and PR description. ## Security & Configuration Tips Never commit secrets—use sample files in `env/` or add new templates when

No other project uses it yet

tambo-aiAGENTS.md

tambo

tambo-ai/tambo/.github/AGENTS.md

GitHub Actions workflows: - **Pin actions to full commit SHA** with a version comment for security and reproducibility: ```yaml # Good - pinned to SHA with version comment - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

nexmoeAGENTS.md

VidBee

nexmoe/VidBee/AGENTS.md

Prefer simple conditionals over nested ternary operators - Group related code together and separate concerns ### Security - Add `rel="noopener"` when using `target="_blank"` on links - Avoid `dangerouslySetInnerHTML` unless absolutely necessary

chimuraiAGENTS.md

http-proxy-middleware

chimurai/http-proxy-middleware/AGENTS.md

markdown code block. NEVER include secrets, PII, or proprietary prompt content ## GitHub PR and Security Advisories - If the user asks you to open a GitHub PR or create a GitHub

apacheAGENTS.md

thrift

apache/thrift/AGENTS.md

code** (i.e., in the same directory) takes precedence on any conflict. --- ## 6. Security Work When assisting with security-sensitive changes (transport size limits, TLS configuration, authentication, serialization bounds, or anything

mauticAGENTS.md

mautic

mautic/mautic/AGENTS.md

Unit + Functional tests │ ├── Unit/ │ └── Functional/ └── Views/ # Twig templates ``` ### Key Core Bundles - **CoreBundle**: Foundation (helpers, security, base classes) - **LeadBundle**: Contact/company management - **CampaignBundle**: Campaign builder & execution - **EmailBundle**: Email marketing - **FormBundle**: Form builder

dotnetAGENTS.md

orleans

dotnet/orleans/AGENTS.md

Implementation principles Apply these principles during design, implementation, and validation, alongside correctness, security, compatibility, concurrency, and reliability. ## Priorities - Rank goals as correctness (including safety) > simplicity > performance > convenience; seek a design

No other project uses it yet

dotnetAGENTS.md

orleans

dotnet/orleans/docs/AGENTS.md

Configure it with <xref:Orleans.Hosting.AzureTableSiloBuilderExtensions.AddAzureTableGrainStorage*?displayProperty=nameWithType>. ``` ## Documentation types Address relevant operational concerns: correctness, security, availability, upgrades, capacity, cost, and diagnosis under load. - **Architecture**: components, protocols, invariants, consistency, failure

No other project uses it yet