How real projects brief Codex, Cursor and every other agent that reads AGENTS.md.
mvanhornAGENTS.mdmvanhorn/last30days-skill/AGENTS.md
versions stay lockstep: 1. **Feature/fix PRs:** add `changelog.d/ . .md` (`added` / `changed` / `fixed` / `removed` / `deprecated` / `security`) when the change belongs in the next release notes. See `changelog.d/README.md` and `CONTRIBUTING.md`. Fill
calesthioAGENTS.mdcalesthio/OpenMontage/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
aaif-gooseAGENTS.mdaaif-goose/goose/AGENTS.md
Feature). `gh issue create` does not apply templates automatically. Maintainer-directed work, urgent security fixes, release automation, and local or exploratory changes do not require a Ready issue. ## MCP Server
CherryHQAGENTS.mdCherryHQ/cherry-studio/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
AstralAGENTS.mdastral-sh/ruff/AGENTS.md
issue, do not submit a competing one without maintainer agreement. ## Code Review Rules For security reviews of Ruff and ty runtime changes, use the [threat models](agents/references/threat-models.md) to assess trust
QuantumNousAGENTS.mdQuantumNous/new-api/AGENTS.md
domain concept rather than a mechanical step extracted only to shorten the caller. ### Authentication Security (OWASP Mandatory) - Any implementation, modification, or review involving authentication-related flows MUST comply with
HKUDSAGENTS.mdHKUDS/nanobot/AGENTS.md
nanobot/skills/`): Built-in skill definitions (cron, github, image-generation, etc.) loaded into agent context. - **Security** (`nanobot/security/`): PTH file guard and other security measures activated at CLI entry. ### Entry Points
jeecgbootAGENTS.mdjeecgboot/JeecgBoot/jeecgboot-vue3/AGENTS.md
src/utils/http/axios/` wraps Axios with: - Token injection through interceptors. - MD5 request signing for API security. - Multi-tenant header support. - Standard response unwrapping through the `result` field. API functions usually follow this
sickn33AGENTS.mdsickn33/agentic-awesome-skills/AGENTS.md
validation. - `npm run validate`: validate skill frontmatter, required sections, and schema rules. - `npm run security:docs`: run safety checks for command, install, credential, and network guidance. - `npm run test
SentryAGENTS.mdgetsentry/sentry/src/AGENTS.md
critical commands, see the "Command Execution Guide" section in `/AGENTS.md` in the repository root. ## Security Guidelines ### Preventing Indirect Object References (IDOR) Multi-tenant queries MUST be scoped — never trust user
K-Dense-AIAGENTS.mdK-Dense-AI/scientific-agent-skills/AGENTS.md
tools` a space-separated string, `metadata` scalars quoted, and a warning past 500 lines. Security-scan new or substantially changed skills. Scanning uses [Cisco AI Defense Skill Scanner](https://github.com
amruthpillaiAGENTS.mdamruthpillai/reactive-resume/AGENTS.md
full|wenyan-ultra Stop: "stop caveman" or "normal mode" Auto-Clarity: drop caveman for security warnings, irreversible actions, user confused. Resume after. Boundaries: code/commits/PRs written normal. ## Agent skills - Issues
LangChainAGENTS.mdlangchain-ai/langgraph/AGENTS.md
This repository is a monorepo. Each library lives in a subdirectory under `libs/`. ## Corridor security analysis When Corridor's `analyzePlan` tool is available, create a plan and use the tool
herdrdevAGENTS.mdherdrdev/herdr/AGENTS.md
Local, SSH, and Cloud connections and must remain available unless retired for a security reason. - Named core codecs are immutable. Do not add, remove, reorder, or reinterpret fields or enum
ToolJetAGENTS.mdToolJet/ToolJet/server/AGENTS.md
together. If a config change moves, renames, or removes a key, write a migration. ### Security - Parameterized queries only. Never concatenate user input into SQL. ### Language - Never abbreviate `data_source
tinyhumansaiAGENTS.mdtinyhumansai/openhuman/AGENTS.md
domains under `src/ /`, transport/dispatch/auth under `src/core/` | | `crates/openhuman-core/src/ /` | Flat business-domain modules (agent, memory, tools, security, channels, ...) | | `crates/openhuman-core/src/core/` | CLI, JSON-RPC and HTTP dispatch, controller registry, event bus, runtime composition
wshobsonAGENTS.mdwshobson/agents/docs/agents.md
validator](../plugins/conductor/agents/conductor-validator.md) | opus | Validates Conductor project artifacts for completeness, consistency, and correctness | ### Quality Assurance & Security #### Code Quality & Review | Agent | Model | Description | | ------------------------------------------------------------------------------------------------ | ----- | --------------------------------------------------------------- | | [code-reviewer](../plugins/comprehensive-review/agents/code-reviewer.md) | opus | Code review with security focus
PostHogAGENTS.mdPostHog/posthog/AGENTS.md
internal-only systems, private incidents, customer data, Slack thread contents, unreleased roadmap details, or security-sensitive implementation details. Slack thread links and channel references are fine to include — they
GitHubAGENTS.mdgithub/awesome-copilot/AGENTS.md
CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidelines - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community standards - [SECURITY.md](SECURITY.md) for security policies ## MCP Server The repository includes an MCP (Model Context Protocol) Server for searching and installing
Yeachan-HeoAGENTS.mdYeachan-Heo/oh-my-claudecode/AGENTS.md
implementations, refactors, debugging, reviews, planning, research, and verification. - Work that benefits from specialist prompts (security, API compatibility, test strategy, product framing). - Independent tasks that can run in parallel
An open format for instructions to coding agents, read by Codex, Cursor and others. Think of it as a README written for agents.
At the repository root, with more specific files in subdirectories. Agents read the one closest to the file they're editing.
Setup and test commands, code style, and the rules a new contributor would need to know.
Claude Code reads CLAUDE.md. A one-line CLAUDE.md that points at AGENTS.md covers both.
