AGENTS.md examples from real projects

pnpmAGENTS.md

pnpm

pnpm/pnpm/AGENTS.md

lives in **[review-code review guide](./.agents/skills/review-code/references/REVIEW_GUIDE.md)** — how changes are accepted or rejected, the security-first / performance-second priorities, the security checklist and advisory regression themes, and the test/changeset/version-coverage expectations

pnpmAGENTS.md

pnpm / pnpr

pnpm/pnpm/pnpr/AGENTS.md

pnpr/`. **Read [`../AGENTS.md`](../AGENTS.md) and [`../PHILOSOPHY.md`](../PHILOSOPHY.md) first.** They cover the monorepo-wide philosophy: security, performance, efficient disk usage, predictability, and feature consolidation. They also cover PR workflow, signing agent

wailsappAGENTS.md

wails

wailsapp/wails/AGENTS.md

that summary. Conventional title types choose the category; `changelog:added|changed|fixed|deprecated|removed|security` labels override it, and `skip-changelog` excludes a PR. Internal-only title types are excluded

No other project uses it yet

TencentAGENTS.md

WeKnora / cli

Tencent/WeKnora/cli/AGENTS.md

headers. `_notice` is reserved — open-map infrastructure is in place for deprecation / version_skew / security notices; the field is omitted until a producer is wired in v0.8. `profile` echoes

utmappAGENTS.md

UTM

utmapp/UTM/AGENTS.md

QEMU out-of-process** (XPC: `QEMUHelper`→`QEMULauncher`); host files reach it only through a security-scoped-bookmark dance — respect it for anything touching disk images, shared dirs, or file handles

gchqAGENTS.md

CyberChef

gchq/CyberChef/AGENTS.md

live under `tests/browser/` and are run with `npm run testui` or `npm run testuidev`. ## Security - Avoid prototype pollution. Utilise `Object.create(null)`, `Map`, and `Object.prototype.hasOwnProperty.call(...)`. - Avoid XSS. Escape strings before rendering

No other project uses it yet

alan2207AGENTS.md

bulletproof-react

alan2207/bulletproof-react/AGENTS.md

HTTP requests with MSW instead of mocking fetch - Focus on user interactions and outcomes ## Security Considerations ### Authentication - **JWT tokens** stored in HttpOnly cookies (preferred) or localStorage - **React Query Auth

rustfsAGENTS.md

rustfs

rustfs/rustfs/AGENTS.md

small local edit does not need a formal plan or new document. - Preserve correctness, security, durability, compatibility, and user-owned work. Within those boundaries, choose the reasoning process, algorithm

No other project uses it yet

nettyAGENTS.md

netty

netty/netty/AGENTS.md

github/workflows/autoport-*.yml`). When a cherry-pick conflicts, the port must be done manually. ## Security Netty parses untrusted network input (HTTP/1.x, HTTP/2, HTTP/3, and more), implements TLS on top of BoringSSL/OpenSSL

backstageAGENTS.md

backstage

backstage/backstage/AGENTS.md

code style. - `/REVIEWING.md`: guidelines for pull requests and writing changesets. - `/SECURITY.md`: guidelines for security. - `/docs/architecture-decisions/`: contains the architecture decisions for the project. All new source files

apacheAGENTS.md

kafka

apache/kafka/AGENTS.md

Agent Guide for Apache Kafka This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. ## Project overview Apache Kafka is a distributed event

OWASPAGENTS.md

CheatSheetSeries

OWASP/CheatSheetSeries/AGENTS.md

tools most often break. > The audience for every cheat sheet is **developers, not security experts**. Content must be accurate, practical, concise, and opinionated. We would rather have _good_ advice

hiddifyAGENTS.md

hiddify-app

hiddify/hiddify-app/AGENTS.md

migration, or API change. **Complex**: several areas, native code, connection/core logic, DB migrations, or security-relevant code. - If the change spans repos (e.g. hiddify-core), link the related PR. ## Opening

No other project uses it yet

Yeachan-HeoAGENTS.md

oh-my-codex / templates

Yeachan-Heo/oh-my-codex/templates/AGENTS.md

missing authority, or an irreversible/destructive branch. - Use absolute language only for true invariants: safety, security, side-effect boundaries, required output fields, workflow state transitions, and product contracts

No other project uses it yet

alibabaAGENTS.md

nacos

alibaba/nacos/AGENTS.md

Distributed Lock Spec](./specs/en/lock/lock-spec.md) - Extension model: [Integration And Adapter Spec](./specs/en/integration/integration-adapter-spec.md), [Plugin Specs](./specs/en/plugin/README.md) - Security model: [Auth And Permission Spec](./specs/en/auth/auth-permission-spec.md), [Auth Plugin Spec](./specs/en/auth/auth-plugin-spec.md), [RAM Auth Plugin Spec](./specs/en/auth/ram-auth-plugin-spec.md

No other project uses it yet

VercelAGENTS.md

agent-skills / react-best-practices

vercel-labs/agent-skills/skills/react-best-practices/AGENTS.md

invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation

onyx-dot-appAGENTS.md

onyx / mobile

onyx-dot-app/onyx/mobile/AGENTS.md

mock; this also satisfies `import/first`). - Native mocks are centralized: MMKV self-mocks, `expo-secure-store` manual mock in `__mocks__/`, resets in `jest.setup.ts`. - A generic fn like `apiFetch ` makes `jest.mocked()` infer

zeroclaw-labsAGENTS.md

zeroclaw

zeroclaw-labs/zeroclaw/AGENTS.md

module, factory wiring, adjacent tests, and relevant docs before editing. 2. For architecture, config, security, workflow, governance, CI, release, or agent-assisted changes, start with `docs/book/src/contributing/architecture-map.md`. 3. Name the source

podman-container-toolsAGENTS.md

podman

podman-container-tools/podman/AGENTS.md

Makefile** (`make help`, `make binaries`, `make validatepr`); match the **Go** version in `go.mod`. **Security** issues use the private process linked from CONTRIBUTING, not public GitHub. AI-assisted contributions must follow

conductor-ossAGENTS.md

conductor

conductor-oss/conductor/AGENTS.md

higher versions are always welcome — use one of two lowercase prefixes instead: ```groovy // Security: CVE-2025-12183 — lz4-java minimum patched version // Compat: commons-lang3 3.18.0+ required by Testcontainers/commons-compress ``` - `// Security