AGENTS.md examples from real projects

cypress-ioAGENTS.md

cypress / system-tests

cypress-io/cypress/system-tests/AGENTS.md

during a local (non-CI) run, so `yarn test web_security --browser chrome` deletes the Firefox- and Electron-gated keys from `__snapshots__/web_security_spec.js`, and CI then fails those tests with

HKUDSAGENTS.md

nanobot

HKUDS/nanobot/AGENTS.md

Working on nanobot The Python gateway owns agent execution, sessions, tools, memory, and security policy. WebUI and TUI share that runtime; keep execution and policy out of the clients. WebUI/gateway

apacheAGENTS.md

airflow

apache/airflow/AGENTS.md

tests --use-xdist --test-type ` (types: `airflow_aux`, `airflow_core`, `apiserver`, `dagprocessor`, `other`, `redis`, `security`, `statsd`, `webserver`) - **Run other suites of tests** `breeze testing ` (test groups: `airflow-ctl-tests`, `docker

No other project uses it yet

apacheAGENTS.md

airflow / providers

apache/airflow/providers/AGENTS.md

commit messages, so most PRs do not need to touch the changelog at all. ## Security: Connection extras must not be forwarded blindly to hooks/operators **Never pass the whole `Connection.extra` dict

No other project uses it yet

ogulcancelikAGENTS.md

herdr

ogulcancelik/herdr/AGENTS.md

Local, SSH, and Cloud connections and must remain available unless retired for a security reason. - Named core codecs are immutable. Do not add, remove, reorder, or reinterpret fields or enum

danny-avilaAGENTS.md

LibreChat

danny-avila/LibreChat/AGENTS.md

Only expose intentionally approved codes and helpful user-safe information. Error disclosure is a security boundary: never forward raw exceptions, stacks, query text, credentials, request bodies, headers, provider payloads

siyuan-noteAGENTS.md

siyuan

siyuan-note/siyuan/AGENTS.md

# AGENTS.md SiYuan repository guide. Module path `github.com/siyuan-note/siyuan`, license AGPL-3.0. --- ## 1. Non-negotiable

No other project uses it yet

cliAGENTS.md

cli

cli/cli/AGENTS.md

clarification from `@cli/code-reviewers`. Do not automatically publish an issue, discussion, or comment. For security concerns, use the private route below instead. This gate does not prohibit requested private/local experiments

No other project uses it yet

files-communityAGENTS.md

Files

files-community/Files/AGENTS.md

context. Singleton activation does not imply one server instance shared across all elevation or security contexts. #### `IIterable ` and `IIterator ` proxy registration **For each new custom DTO collection crossing the process

No other project uses it yet

sickn33AGENTS.md

agentic-awesome-skills

sickn33/agentic-awesome-skills/AGENTS.md

validation. - `npm run validate`: validate skill frontmatter, required sections, and schema rules. - `npm run security:docs`: run safety checks for command, install, credential, and network guidance. - `npm run test

No other project uses it yet

streamlitAGENTS.md

streamlit

streamlit/streamlit/AGENTS.md

clear error, a short doc note, or leaving the code as is. Security issues and data loss still need a real fix. This applies to review feedback too: a reviewer

No other project uses it yet

streamlitAGENTS.md

streamlit / agents

streamlit/streamlit/.claude/agents/AGENTS.md

testing-feature` | QA test features using Playwright | | `reviewing-local-changes` | Code review for quality, security, best practices, and product/API alignment | | `simplifying-local-changes` | Simplify and refine code changes

No other project uses it yet

SentryAGENTS.md

sentry / src

getsentry/sentry/src/AGENTS.md

test commands, see the "Command Execution Guide" section in `/AGENTS.md` in the repository root. ## Security Guidelines ### Preventing Indirect Object References (IDOR) Multi-tenant queries MUST be scoped. Never trust user

LangChainAGENTS.md

langgraph

langchain-ai/langgraph/AGENTS.md

This repository is a monorepo. Each library lives in a subdirectory under `libs/`. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool

No other project uses it yet

apacheAGENTS.md

spark

apache/spark/AGENTS.md

below are illustrative and advance over time): $ dev/next_version_candidates.py master 5.0.0 branch-4.x 4.3.0 ## Security Security model: [SECURITY.md](./SECURITY.md) Agents that scan this repository should consult `SECURITY.md` for the project

No other project uses it yet

HeyPuterAGENTS.md

puter

HeyPuter/puter/AGENTS.md

domain terms. Section dividers use plain ASCII (`// -- Section --`), never box-drawing characters. ### Security & privacy Before opening a PR, scan the diff for: - Logs, error messages, or responses leaking internal paths

No other project uses it yet

sxyaziAGENTS.md

yazi

sxyazi/yazi/AGENTS.md

crates by the maintained code and correctness obligations they remove versus their integration, compatibility, security, and upkeep costs; add them when the overall trade-off is favorable. - Initialize crates explicitly

No other project uses it yet

wshobsonAGENTS.md

agents

wshobson/agents/docs/agents.md

validator](../plugins/conductor/agents/conductor-validator.md) | opus | Validates Conductor project artifacts for completeness, consistency, and correctness | ### Quality Assurance & Security #### Code Quality & Review | Agent | Model | Description | | ------------------------------------------------------------------------------------------------ | ----- | --------------------------------------------------------------- | | [code-reviewer](../plugins/comprehensive-review/agents/code-reviewer.md) | opus | Code review with security focus

No other project uses it yet

fastlaneAGENTS.md

fastlane

fastlane/fastlane/AGENTS.md

name the existing one and say why it does not fit. - Do not describe security problems in public issues, pull requests or reviews. Report security issues through [SECURITY.md](docs/SECURITY.md

No other project uses it yet

phpAGENTS.md

php-src

php/php-src/AGENTS.md

Vulnerability reports When scanning php-src for vulnerabilities, please respect our security policy summarized in `./SECURITY.md`. You can find the full policy [here](https://raw.githubusercontent.com/php/policies/refs/heads/main/security-classification.rst).

No other project uses it yet