AGENTS.md examples from real projects

strapiAGENTS.md

strapi

strapi/strapi/AGENTS.md

commitlint`). Format: ``` ( ): ``` Valid types: `feat` `fix` `chore` `ci` `docs` `enhancement` `test` `revert` `security` `future` `release` **Examples:** ```bash feat(content-manager): add bulk delete action fix(database): preserve relation order during

No other project uses it yet

code-yeongyuAGENTS.md

oh-my-openagent

code-yeongyu/oh-my-openagent/.agents/AGENTS.md

form of the `/publish` command | | `remove-deadcode/` | NEW | Skill form of the `/remove-deadcode` command | | `security-research/` | NEW | Team Mode security research audit: 3 vulnerability hunters + 2 PoC engineers | | `codex

code-yeongyuAGENTS.md

oh-my-openagent

code-yeongyu/oh-my-openagent/.opencode/AGENTS.md

Remove unused code with LSP-verified safety + atomic commits. | | `/security-research` | Run the Team Mode security-research audit with 3 vulnerability hunters and 2 PoC engineers. | ## OTHER CONTENTS - `background-tasks.json` — Runtime state

prometheusAGENTS.md

prometheus

prometheus/prometheus/AGENTS.md

FEATURE] new capability [ENHANCEMENT] improvement to existing behaviour [PERF] performance improvement [BUGFIX] bug fix [SECURITY] security fix [CHANGE] breaking or behavioural change ``` Example: ```` ```release-notes [BUGFIX] PromQL: Do not skip

No other project uses it yet

apacheAGENTS.md

echarts

apache/echarts/AGENTS.md

github.com/apache/echarts/wiki/How-to-setup-the-dev-environment` for local setup and zrender-linked development - `https://github.com/apache/echarts/wiki/Security-Checklist-for-Code-Contributors` for security-sensitive API and API-design checks - `.github/pull_request_template.md` for PR structure - `.github/workflows/` for CI expectations This file

No other project uses it yet

warpdotdevAGENTS.md

Warp

warpdotdev/Warp/AGENTS.md

create public pull requests or public issues that disclose a non-public security vulnerability. Refer users to `SECURITY.md` for the proper disclosure methods instead. - When opening

2dustAGENTS.md

v2rayNG

2dust/v2rayNG/AGENTS.md

file, package, and module scope is forbidden. Never suppress permission, background-execution, lifecycle, or security requirements. - Guard every API above `minSdk` by SDK or extension version in the same function

No other project uses it yet

traefikAGENTS.md

traefik

traefik/traefik/AGENTS.md

documentation updates go to the current maintenance branches (`v3.7` for v3, `v2.11` for v2, security-fixes only). Forward-ports from the maintenance branches up to `master` are handled by maintainers

No other project uses it yet

penpotAGENTS.md

penpot

penpot/penpot/AGENTS.md

Skipping this step is the #1 cause of incorrect or incomplete work. --- ## Auto-triggers - **Security advisory URL pasted** — When the user pastes a URL matching `github.com/penpot/penpot/security/advisories/GHSA-*`, extract the GHSA

No other project uses it yet

pi-holeAGENTS.md

pi-hole

pi-hole/pi-hole/AGENTS.md

correct project spelling is "Pi-hole" (capital P, lowercase h, hyphen). ## Security considerations - The installer and most scripts run as root on end-user systems. Quote variables, validate all user

No other project uses it yet

Gathin23AGENTS.md

cleanyourtv

Gathin23/cleanyourtv/AGENTS.md

tools/tv.py --probe`, `getprop` and backups, quote only the model, Android version and firmware build. - **Security problems are reported privately**, as [SECURITY.md](SECURITY.md) describes, never in a public issue. ## Commit

zylon-aiAGENTS.md

private-gpt / ui

zylon-ai/private-gpt/ui/AGENTS.md

paths and documentation ownership. - Update the relevant docs in `docs/` whenever behavior, visuals, persistence, security posture, or API request/response handling changes. ## Codex-Specific Notes - Follow the validation steps documented

No other project uses it yet

BlockAGENTS.md

goose

block/goose/AGENTS.md

Feature). `gh issue create` does not apply templates automatically. Maintainer-directed work, urgent security fixes, release automation, and local or exploratory changes do not require a Ready issue. ## MCP Server

Gathin23AGENTS.md

tv-vibehack

Gathin23/tv-vibehack/AGENTS.md

tools/tv.py --probe`, `getprop` and backups, quote only the model, Android version and firmware build. - **Security problems are reported privately**, as [SECURITY.md](SECURITY.md) describes, never in a public issue. ## Commit

CherryHQAGENTS.md

cherry-studio / vercel-react-best-practices

CherryHQ/cherry-studio/.agents/skills/vercel-react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

QuantumNousAGENTS.md

new-api

QuantumNous/new-api/AGENTS.md

domain concept rather than a mechanical step extracted only to shorten the caller. ### Authentication Security (OWASP Mandatory) - Any implementation, modification, or review involving authentication-related flows MUST comply with

AstralAGENTS.md

ruff

astral-sh/ruff/AGENTS.md

could not be inspected, say so when reporting the PR. ## Code Review Rules For security reviews of Ruff and ty runtime changes, use the [threat models](.agents/references/threat-models.md) to assess trust

cypress-ioAGENTS.md

cypress

cypress-io/cypress/AGENTS.md

full-CI allowlist (binary tests, Windows jobs, v8 snapshot validation). - **Supplementary**: GitHub Actions for security scanning (Snyk), SBOM generation, browser version auto-updates, and PR validation. - **Base branch**: `develop

No other project uses it yet

pingchesuAGENTS.md

gsd-hermes

pingchesu/gsd-hermes/docs/AGENTS.md

checker, integration-checker, ui-checker | | Verifiers | 1 | verifier | | Auditors | 3 | nyquist-auditor, ui-auditor, security-auditor | | Mappers | 1 | codebase-mapper | | Debuggers | 1 | debugger | | Doc Writers | 2 | doc-writer, doc-verifier

git-df-scottAGENTS.md

claude-skills / get-shit-done

git-df-scott/claude-skills/get-shit-done/AGENTS.md

relevant, test evidence, affected platforms/runtimes, and update `CHANGELOG.md` or docs for user-facing changes. ## Security & Configuration Tips Do not commit secrets, local config, or generated worktree artifacts. Before release-facing