AGENTS.md examples from real projects

apacheAGENTS.md

spark

apache/spark/AGENTS.md

below are illustrative and advance over time): $ dev/next_version_candidates.py master 5.0.0 branch-4.x 4.3.0 ## Security Security model: [SECURITY.md](./SECURITY.md) Agents that scan this repository should consult `SECURITY.md` for the project

No other project uses it yet

colinhacksDeletes or force-pushesAGENTS.md

zod

colinhacks/zod/AGENTS.md

codex/skills` symlink); read it directly if your agent doesn't. For a draft **security advisory** — a GHSA id, the Security tab, a private vulnerability report — use the `security-advisory` skill

No other project uses it yet

HeyPuterAGENTS.md

puter

HeyPuter/puter/AGENTS.md

domain terms. Section dividers use plain ASCII (`// -- Section --`), never box-drawing characters. ### Security & privacy Before opening a PR, scan the diff for: - Logs, error messages, or responses leaking internal paths

sxyaziAGENTS.md

yazi

sxyazi/yazi/AGENTS.md

crates by the maintained code and correctness obligations they remove versus their integration, compatibility, security, and upkeep costs; add them when the overall trade-off is favorable. - Initialize crates explicitly

No other project uses it yet

tinyhumansaiReads credentialsAGENTS.md

openhuman

tinyhumansai/openhuman/AGENTS.md

contract, dispatch and auth under `src/core/` | | `crates/openhuman-core/src/ /` | Flat business-domain modules (agent, memory, tools, security, channels, ...) | | `crates/openhuman-core/src/storage/` | The process's storage backend on the `tinystoragedrivers` ports: URL resolution (`OPENHUMAN_STORAGE

No other project uses it yet

wshobsonAGENTS.md

agents

wshobson/agents/docs/agents.md

validator](../plugins/conductor/agents/conductor-validator.md) | opus | Validates Conductor project artifacts for completeness, consistency, and correctness | ### Quality Assurance & Security #### Code Quality & Review | Agent | Model | Description | | ------------------------------------------------------------------------------------------------ | ----- | --------------------------------------------------------------- | | [code-reviewer](../plugins/comprehensive-review/agents/code-reviewer.md) | opus | Code review with security focus

No other project uses it yet

fastlaneAGENTS.md

fastlane

fastlane/fastlane/AGENTS.md

name the existing one and say why it does not fit. - Do not describe security problems in public issues, pull requests or reviews. Report security issues through [SECURITY.md](docs/SECURITY.md

No other project uses it yet

lfnovoReads credentialsAGENTS.md

open-notebook

lfnovo/open-notebook/AGENTS.md

under `## [Unreleased]`, in the one section for its type (`### Added` / `### Changed` / `### Deprecated` / `### Removed` / `### Fixed` / `### Security`); never create a duplicate section. Details: [contributing.md](docs/7-DEVELOPMENT/contributing.md#changelog). - Maintainer profile lives in `.maintainer

No other project uses it yet

phpAGENTS.md

php-src

php/php-src/AGENTS.md

Vulnerability reports When scanning php-src for vulnerabilities, please respect our security policy summarized in `./SECURITY.md`. You can find the full policy [here](https://raw.githubusercontent.com/php/policies/refs/heads/main/security-classification.rst).

No other project uses it yet

qbittorrentAGENTS.md

qBittorrent

qbittorrent/qBittorrent/AGENTS.md

this order: * Correctness * Logic errors and edge cases * Memory leaks and unsafe memory access * Security vulnerabilities * API misuse * Incorrect error handling * Performance * Coding style * Follow the rules defined in [CODING_GUIDELINES.md

apacheAGENTS.md

dubbo

apache/dubbo/AGENTS.md

downstream users - Trust boundaries, adversary model, and assumptions about the deployment environment - Security properties Dubbo provides (conditional on configuration) - Security properties Dubbo explicitly does *not* provide - Downstream responsibilities for integrators

No other project uses it yet

vimAGENTS.md

vim

vim/vim/AGENTS.md

stability periods — see `runtime/doc/develop.txt` `*design-policy*`. - **During a stability period** only clear bug fixes, security fixes, documentation updates, translations, and runtime file updates are accepted. No new features, no backwards

No other project uses it yet

outlineAGENTS.md

outline

outline/outline/AGENTS.md

update lockfiles: ```bash yarn install ``` - When adding a `resolutions` entry to address a security advisory in a transitive dependency, target only the specific vulnerable descriptors using the `name@npm: ` syntax

ToolJetReads credentialsAGENTS.md

ToolJet / server

ToolJet/ToolJet/server/AGENTS.md

frontend. If a config change moves, renames, or removes a key, write a migration. ### Security - Parameterized queries only. Never concatenate user input into SQL. ### Language - Never abbreviate `data_source

HmbownReads credentialsAGENTS.md

DeepSeek-TUI

Hmbown/DeepSeek-TUI/AGENTS.md

guess. **Never cut, at any rung:** trust-boundary validation, data-loss handling, security, accessibility. Brevity is not a reason to drop a guard. Rung 2 is the one this repository

GitHubAGENTS.md

awesome-copilot

github/awesome-copilot/AGENTS.md

CONTRIBUTING.md](CONTRIBUTING.md) for contribution guidelines - [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community standards - [SECURITY.md](SECURITY.md) for security policies ## MCP Server The repository includes an MCP (Model Context Protocol) Server for searching and installing

HmbownReads credentialsAGENTS.md

CodeWhale

Hmbown/CodeWhale/AGENTS.md

guess. **Never cut, at any rung:** trust-boundary validation, data-loss handling, security, accessibility. Brevity is not a reason to drop a guard. Rung 2 is the one this repository

Yeachan-HeoAGENTS.md

oh-my-claudecode

Yeachan-Heo/oh-my-claudecode/AGENTS.md

implementations, refactors, debugging, reviews, planning, research, and verification. - Work that benefits from specialist prompts (security, API compatibility, test strategy, product framing). - Independent tasks that can run in parallel

PostHogAGENTS.md

posthog

PostHog/posthog/AGENTS.md

internal-only systems, private incidents, customer data, Slack thread contents, unreleased roadmap details, or security-sensitive implementation details. Slack thread links and channel references are fine to include — they

photoprismReads credentialsAGENTS.md

photoprism

photoprism/photoprism/AGENTS.md

Setup guide: https://docs.photoprism.app/developer-guide/setup/ - Test guide: https://docs.photoprism.app/developer-guide/tests/ - Contributing: https://github.com/photoprism/photoprism/blob/develop/CONTRIBUTING.md - Security: https://github.com/photoprism/photoprism/blob/develop/SECURITY.md - REST API: https://docs.photoprism.dev/ and https://docs.photoprism.app/developer-guide/api/ - Code maps: [`CODEMAP.md`](CODEMAP.md

No other project uses it yet