AGENTS.md examples from real projects

phpAGENTS.md

php-src

php/php-src/AGENTS.md

Vulnerability reports When scanning php-src for vulnerabilities, please respect our security policy summarized in `./SECURITY.md`. You can find the full policy [here](https://raw.githubusercontent.com/php/policies/refs/heads/main/security-classification.rst).

No other project uses it yet

apacheAGENTS.md

dubbo

apache/dubbo/AGENTS.md

downstream users - Trust boundaries, adversary model, and assumptions about the deployment environment - Security properties Dubbo provides (conditional on configuration) - Security properties Dubbo explicitly does *not* provide - Downstream responsibilities for integrators

No other project uses it yet

qbittorrentAGENTS.md

qBittorrent

qbittorrent/qBittorrent/AGENTS.md

this order: * Correctness * Logic errors and edge cases * Memory leaks and unsafe memory access * Security vulnerabilities * API misuse * Incorrect error handling * Performance * Coding style * Follow the rules defined in [CODING_GUIDELINES.md

No other project uses it yet

outlineAGENTS.md

outline

outline/outline/AGENTS.md

update lockfiles: ```bash yarn install ``` - When adding a `resolutions` entry to address a security advisory in a transitive dependency, target only the specific vulnerable descriptors using the `name@npm: ` syntax

No other project uses it yet

vimAGENTS.md

vim

vim/vim/AGENTS.md

stability periods — see `runtime/doc/develop.txt` `*design-policy*`. - **During a stability period** only clear bug fixes, security fixes, documentation updates, translations, and runtime file updates are accepted. No new features, no backwards

No other project uses it yet

GitHubAGENTS.md

awesome-copilot

github/awesome-copilot/AGENTS.md

CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidelines - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community standards - [SECURITY.md](SECURITY.md) for security policies ## MCP Server The repository includes an MCP (Model Context Protocol) Server for searching and installing

Yeachan-HeoAGENTS.md

oh-my-claudecode

Yeachan-Heo/oh-my-claudecode/AGENTS.md

implementations, refactors, debugging, reviews, planning, research, and verification. - Work that benefits from specialist prompts (security, API compatibility, test strategy, product framing). - Independent tasks that can run in parallel

PostHogAGENTS.md

posthog

PostHog/posthog/AGENTS.md

internal-only systems, private incidents, customer data, Slack thread contents, unreleased roadmap details, or security-sensitive implementation details. Slack thread links and channel references are fine to include — they

photoprismAGENTS.md

photoprism / pkg

photoprism/photoprism/pkg/AGENTS.md

Package Security & Test Guidelines **Last Updated:** August 18, 2026 ## Archive Extraction Security - Always validate ZIP entry names with a safe join. Reject absolute paths, Windows drive or volume paths

No other project uses it yet

gofiberAGENTS.md

fiber

gofiber/fiber/AGENTS.md

comment, as `Test_Chain_NoAllocations`, `Test_Combined_DoesNotAllocate` and `Test_Security_Do_BlocksDNSRebinding` do. - Do not hand-write the plumbing that nearly every test repeats; `internal/apptest` has helpers

halo-devAGENTS.md

halo

halo-dev/halo/AGENTS.md

areas you touch. ## Modules | Module | Path | |---------------------|-----------------------------------------------------------| | API library | `api/` (extension model, contracts, security) | | Backend application | `application/` (services, routers, migrations, packaging) | | Frontend | `ui/` (console, user center, workspace packages) | | Application BOM | `platform/application

No other project uses it yet

halo-devAGENTS.md

halo / api

halo-dev/halo/api/AGENTS.md

Library Guidelines `api/` is the public API library: the extension model, service contracts, and security abstractions consumed by the application and by plugins. Changes here affect downstream compatibility. ## Scope - Source

No other project uses it yet

halo-devAGENTS.md

halo / application

halo-dev/halo/application/AGENTS.md

Backend Application Guidelines `application/` is the WebFlux + R2DBC backend: services, routers, security, migrations, and packaging. Everything here is reactive — never block threads. ## Structure - `application/src/main/java/` — services, routers, endpoints, and configuration. - `application/src/main/resources/application

rapid7AGENTS.md

metasploit-framework

rapid7/metasploit-framework/AGENTS.md

available linked issues, module documentation, and review discussion alongside the diff. Prioritize correctness, security, regressions, compatibility, and reproducible validation of changed behavior. - Ground each finding in a concrete trigger, affected

chatwootAGENTS.md

chatwoot

chatwoot/chatwoot/AGENTS.md

requirement. - Before adding a dependency, verify current upstream maintenance, release activity, community/support health, and security advisories and patch responsiveness. Do not introduce abandoned or unmaintained packages. Prefer a small, readable

No other project uses it yet

keycloakAGENTS.md

keycloak

keycloak/keycloak/AGENTS.md

breaks. In Markdown files in the repository, put each sentence on its own line. ## Security vulnerabilities Do not create public issues for security vulnerabilities. Follow the process in [SECURITY.md](SECURITY.md

nextcloudAGENTS.md

server

nextcloud/server/AGENTS.md

github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior. - **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements

markedjsAGENTS.md

marked

markedjs/marked/AGENTS.md

Open/Closed Principle: provide extension hooks rather than bloating core with endless configuration toggles. ### 3. Security & Scope Boundaries - **No Sanitization in Core**: Marked's single responsibility is translating Markdown into HTML

virgiliojr94AGENTS.md

book-to-skill

virgiliojr94/book-to-skill/AGENTS.md

Preserve backwards compatibility unless the task explicitly authorizes a breaking change. - Do not weaken security checks, path hardening, sanitization, or generated-skill scanning to make an experiment pass. ## Execution loop

pnpmAGENTS.md

pnpm

pnpm/pnpm/AGENTS.md

lives in **[review-code review guide](./.agents/skills/review-code/references/REVIEW_GUIDE.md)** — how changes are accepted or rejected, the security-first / performance-second priorities, the security checklist and advisory regression themes, and the test/changeset/version-coverage expectations