AGENTS.md examples from real projects

BerriAIPipes a download into a shellAGENTS.md

litellm

BerriAI/litellm/AGENTS.md

question weird existing code to make new code high quality, as in: - correct - secure - performant - readable - easy to maintain/change - modern In descending order of importance When adding new features

penpotAGENTS.md

penpot

penpot/penpot/AGENTS.md

Skipping this step is the #1 cause of incorrect or incomplete work. --- ## Auto-triggers - **Security advisory URL pasted** — When the user pastes a URL matching `github.com/penpot/penpot/security/advisories/GHSA-*`, extract the GHSA

No other project uses it yet

pi-holeAGENTS.md

pi-hole

pi-hole/pi-hole/AGENTS.md

correct project spelling is "Pi-hole" (capital P, lowercase h, hyphen). ## Security considerations - The installer and most scripts run as root on end-user systems. Quote variables, validate all user

No other project uses it yet

pingdotggReads credentialsAGENTS.md

t3code

pingdotgg/t3code/AGENTS.md

loudly and get a human sign-off before breaking it. ## Additional tips - Security is important, but should not be over-indexed on, especially for dev mode/maintainer-only features

Gathin23AGENTS.md

cleanyourtv

Gathin23/cleanyourtv/AGENTS.md

tools/tv.py --probe`, `getprop` and backups, quote only the model, Android version and firmware build. - **Security problems are reported privately**, as [SECURITY.md](SECURITY.md) describes, never in a public issue. ## Commit

zylon-aiAGENTS.md

private-gpt / ui

zylon-ai/private-gpt/ui/AGENTS.md

paths and documentation ownership. - Update the relevant docs in `docs/` whenever behavior, visuals, persistence, security posture, or API request/response handling changes. ## Codex-Specific Notes - Follow the validation steps documented

No other project uses it yet

BlockAGENTS.md

goose

block/goose/AGENTS.md

Feature). `gh issue create` does not apply templates automatically. Maintainer-directed work, urgent security fixes, release automation, and local or exploratory changes do not require a Ready issue. ## MCP Server

multica-aiReads credentialsAGENTS.md

multica

multica-ai/multica/AGENTS.md

reuse existing patterns. - Before adding complexity for a speculative or vanishingly unlikely race or security edge case, explain the concrete failure mode, likelihood, and complexity cost to the user

Gathin23AGENTS.md

tv-vibehack

Gathin23/tv-vibehack/AGENTS.md

tools/tv.py --probe`, `getprop` and backups, quote only the model, Android version and firmware build. - **Security problems are reported privately**, as [SECURITY.md](SECURITY.md) describes, never in a public issue. ## Commit

CherryHQAGENTS.md

cherry-studio / vercel-react-best-practices

CherryHQ/cherry-studio/.agents/skills/vercel-react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

QuantumNousAGENTS.md

new-api

QuantumNous/new-api/AGENTS.md

domain concept rather than a mechanical step extracted only to shorten the caller. ### Authentication Security (OWASP Mandatory) - Any implementation, modification, or review involving authentication-related flows MUST comply with

AstralAGENTS.md

ruff

astral-sh/ruff/AGENTS.md

could not be inspected, say so when reporting the PR. ## Code Review Rules For security reviews of Ruff and ty runtime changes, use the [threat models](.agents/references/threat-models.md) to assess trust

cypress-ioAGENTS.md

cypress

cypress-io/cypress/AGENTS.md

full-CI allowlist (binary tests, Windows jobs, v8 snapshot validation). - **Supplementary**: GitHub Actions for security scanning (Snyk), SBOM generation, browser version auto-updates, and PR validation. - **Base branch**: `develop

No other project uses it yet

cypress-ioAGENTS.md

cypress / system-tests

cypress-io/cypress/system-tests/AGENTS.md

during a local (non-CI) run, so `yarn test web_security --browser chrome` deletes the Firefox- and Electron-gated keys from `__snapshots__/web_security_spec.js`, and CI then fails those tests with

HKUDSAGENTS.md

nanobot

HKUDS/nanobot/AGENTS.md

Working on nanobot The Python gateway owns agent execution, sessions, tools, memory, and security policy. WebUI and TUI share that runtime; keep execution and policy out of the clients. WebUI/gateway

calcomReads credentialsAGENTS.md

cal.com

calcom/cal.com/AGENTS.md

senior Cal.diy engineer working in a Yarn/Turbo monorepo. You prioritize type safety, security, and small, reviewable diffs. ## Do - Use `select` instead of `include` in Prisma queries for performance and security

abhigyanpatwariReads credentialsAGENTS.md

GitNexus

abhigyanpatwari/GitNexus/AGENTS.md

imports, or execution flow.** Graph first; text search only for empty/`UNKNOWN`/literals. - For security review, `explain({target: "fileOrSymbol"})` lists taint findings (source→sink flows; needs `analyze --pdg`). - For control/data

No other project uses it yet

jeecgbootReads credentialsAGENTS.md

JeecgBoot / jeecgboot-vue3

jeecgboot/JeecgBoot/jeecgboot-vue3/AGENTS.md

src/utils/http/axios/` wraps Axios with: - Token injection through interceptors. - MD5 request signing for API security. - Multi-tenant header support. - Standard response unwrapping through the `result` field. API functions usually follow this

No other project uses it yet

pingchesuAGENTS.md

gsd-hermes

pingchesu/gsd-hermes/docs/AGENTS.md

checker, integration-checker, ui-checker | | Verifiers | 1 | verifier | | Auditors | 3 | nyquist-auditor, ui-auditor, security-auditor | | Mappers | 1 | codebase-mapper | | Debuggers | 1 | debugger | | Doc Writers | 2 | doc-writer, doc-verifier

git-df-scottAGENTS.md

claude-skills / get-shit-done

git-df-scott/claude-skills/get-shit-done/AGENTS.md

relevant, test evidence, affected platforms/runtimes, and update `CHANGELOG.md` or docs for user-facing changes. ## Security & Configuration Tips Do not commit secrets, local config, or generated worktree artifacts. Before release-facing