AGENTS.md examples from real projects

ElasticAGENTS.md

elasticsearch

elastic/elasticsearch/AGENTS.md

jobs expect ephemeral hosts; do not run packaging suites on your workstation. - **Security**: Default dev clusters enable security; use `elastic-admin:elastic-password` or disable with `-Dtests.es.xpack.security.enabled=false`. - **Cursor/Copilot rules

No other project uses it yet

grafanaAGENTS.md

grafana

grafana/grafana/AGENTS.md

avoid over-engineering - Separate PRs for frontend and backend changes (deployed at different cadences) - Security: prevent XSS, SQL injection, command injection - Security issues should be reported via [Grafana's security

colbymchenryDeletes or force-pushesAGENTS.md

codegraph

colbymchenry/codegraph/AGENTS.md

calling codegraph entirely (maintainer-observed, repeatedly). `isError` is reserved for genuine "stop trying" cases: security refusals (`PathRefusalError`) and real malfunctions (which carry a retry-once note). Every expected/recoverable condition — project

apacheAGENTS.md

superset

apache/superset/AGENTS.md

internal integer IDs - **Existing models** - Add UUID fields alongside integer IDs for gradual migration ## Security and Threat Model Before evaluating any code path for security issues, read [`SECURITY.md`](SECURITY.md

No other project uses it yet

calesthioAGENTS.md

OpenMontage / vercel-react-best-practices

calesthio/OpenMontage/.agents/skills/vercel-react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

tw93Deletes or force-pushesAGENTS.md

Mole

tw93/Mole/AGENTS.md

owns the workflow, `SYNC.md` owns cross-product decisions, development records own test/install receipts, and security reviews own residual risks. Reuse an existing entry and ID; link its owner instead

strapiAGENTS.md

strapi

strapi/strapi/AGENTS.md

commitlint`). Format: ``` ( ): ``` Valid types: `feat` `fix` `chore` `ci` `docs` `enhancement` `test` `revert` `security` `future` `release` **Examples:** ```bash feat(content-manager): add bulk delete action fix(database): preserve relation order during

No other project uses it yet

usestrixPipes a download into a shellAGENTS.md

strix

usestrix/strix/AGENTS.md

tool. This file is for AI coding agents that want to **use** Strix (run security scans) or **contribute** to it. ## Using Strix from an agent Install the agent skills

code-yeongyuAGENTS.md

oh-my-openagent

code-yeongyu/oh-my-openagent/.agents/AGENTS.md

form of the `/publish` command | | `remove-deadcode/` | NEW | Skill form of the `/remove-deadcode` command | | `security-research/` | NEW | Team Mode security research audit: 3 vulnerability hunters + 2 PoC engineers | | `codex

code-yeongyuReads credentialsAGENTS.md

oh-my-openagent

code-yeongyu/oh-my-openagent/AGENTS.md

when sidebar is disabled ├─→ initLiveServerRoute() + setLiveParentWakeRoutingDisabled() + warmLiveServerProbe() # live-listener wake routing ├─→ selectRuntimeSecuritySkills() + createRuntimeSkillSourceServer() # runtime security-skill source ├─→ initI18n() # load locale strings (packages/omo-opencode/src/locales/) ├─→ setAgentSortOrder() # apply configured agent_order ├─→ initializeOpenClaw() # if openclaw

code-yeongyuAGENTS.md

oh-my-openagent

code-yeongyu/oh-my-openagent/.opencode/AGENTS.md

Remove unused code with LSP-verified safety + atomic commits. | | `/security-research` | Run the Team Mode security-research audit with 3 vulnerability hunters and 2 PoC engineers. | ## OTHER CONTENTS - `background-tasks.json` — Runtime state

code-yeongyuReads credentialsAGENTS.md

oh-my-openagent / tests

code-yeongyu/oh-my-openagent/tests/AGENTS.md

equality between real artifacts, and observable runtime behavior such as parsing, routing, dispatch, state, security, and dynamic input propagation. - Treat `tests/hashline/` as its own Bun package. Preserve its lockfile

mem0aiReads credentialsAGENTS.md

mem0

mem0ai/mem0/AGENTS.md

bend. ### Reference | Topic | File | |-------|------| | Contributor guide | [`CONTRIBUTING.md`](CONTRIBUTING.md) | | Code of conduct | [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) | | Security reports | [`SECURITY.md`](SECURITY.md) | | Development setup | `docs/contributing/development.mdx` | | Documentation contributions | `docs/contributing/documentation.mdx` | | PR template | `.github/PULL_REQUEST_TEMPLATE.md` | | Issue forms | `.github/ISSUE_TEMPLATE/` | | Contribution

No other project uses it yet

apacheAGENTS.md

echarts

apache/echarts/AGENTS.md

github.com/apache/echarts/wiki/How-to-setup-the-dev-environment` for local setup and zrender-linked development - `https://github.com/apache/echarts/wiki/Security-Checklist-for-Code-Contributors` for security-sensitive API and API-design checks - `.github/pull_request_template.md` for PR structure - `.github/workflows/` for CI expectations This file

No other project uses it yet

prometheusAGENTS.md

prometheus

prometheus/prometheus/AGENTS.md

FEATURE] new capability [ENHANCEMENT] improvement to existing behaviour [PERF] performance improvement [BUGFIX] bug fix [SECURITY] security fix [CHANGE] breaking or behavioural change ``` Example: ```` ```release-notes [BUGFIX] PromQL: Do not skip

No other project uses it yet

mvanhornReads credentialsAGENTS.md

last30days-skill

mvanhorn/last30days-skill/AGENTS.md

versions stay lockstep: 1. **Feature/fix PRs:** add `changelog.d/ . .md` (`added` / `changed` / `fixed` / `removed` / `deprecated` / `security`) when the change belongs in the next release notes. See `changelog.d/README.md` and `CONTRIBUTING.md`. Fill

No other project uses it yet

warpdotdevAGENTS.md

warp

warpdotdev/warp/AGENTS.md

create public pull requests or public issues that disclose a non-public security vulnerability. Refer users to `SECURITY.md` for the proper disclosure methods instead. - When opening

coollabsioReads credentialsAGENTS.md

coolify

coollabsio/coolify/AGENTS.md

controllers. - **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components

traefikAGENTS.md

traefik

traefik/traefik/AGENTS.md

documentation updates go to the current maintenance branches (`v3.7` for v3, `v2.11` for v2, security-fixes only). Forward-ports from the maintenance branches up to `master` are handled by maintainers

No other project uses it yet

2dustAGENTS.md

v2rayNG

2dust/v2rayNG/AGENTS.md

file, package, and module scope is forbidden. Never suppress permission, background-execution, lifecycle, or security requirements. - Guard every API above `minSdk` by SDK or extension version in the same function

No other project uses it yet