AGENTS.md examples from real projects

every-appAGENTS.md

open-seo

every-app/open-seo/AGENTS.md

edge case found only by reading the code; flag it instead. Security holes and significant billing abuse are the exception. - Search for existing implementations and installed libraries before creating

rollupAGENTS.md

rollup

rollup/rollup/AGENTS.md

contents. The artefacts are served via rollupjs.org, so changing this gating is a security-relevant decision. - The testing-instructions comment wording and its install-location allowlist

goauthentikAGENTS.md

authentik

goauthentik/authentik/AGENTS.md

self-hosted from a homelab to a large production cluster. The company is **Authentik Security, Inc.**; the product name is **always lowercase `authentik`**, even at the start of a sentence

goauthentikAGENTS.md

authentik / website

goauthentik/authentik/website/AGENTS.md

correct working directory and ordering. ## Architecture ### Directory structure ``` website/ docs/ # Topics site (@goauthentik/docs-topics) add-secure-apps/ # Applications, providers, flows, stages, etc. core/ # Core concepts customize/ # Branding, blueprints, policies, theming developer

vaporAGENTS.md

vapor

vapor/vapor/AGENTS.md

automated agents to claim, triage, or submit solutions to `good-first-issue` tickets.** ### Security Issues Security vulnerabilities must be reported by humans through our responsible disclosure process. Automated scanning tools

zulipAGENTS.md

zulip

zulip/zulip/AGENTS.md

claude/skills/pr-description/SKILL.md`). ## When to Pause and Discuss Recommend pausing for discussion when: - The approach involves security-sensitive code - Database migrations are needed (See `docs/subsystems/schema-migrations.md`). - The change alters behavior in several subsystems

EveryIncAGENTS.md

compound-engineering-plugin

EveryInc/compound-engineering-plugin/AGENTS.md

both gates but still follow the merge policy above. - **PR disclosure:** `.github/pull_request_template.md` ends with `## Security Disclosure` and `## Agent Disclosure` sections. Fill both when opening a PR — including PRs authored

kieranklaassenAGENTS.md

compound-engineering-plugin

kieranklaassen/compound-engineering-plugin/AGENTS.md

both gates but still follow the merge policy above. - **PR disclosure:** `.github/pull_request_template.md` ends with `## Security Disclosure` and `## Agent Disclosure` sections. Fill both when opening a PR — including PRs authored

radareorgAGENTS.md

radare2

radareorg/radare2/AGENTS.md

user-visible changes, append one existing `##tag` as the final word of the subject; security fixes use `##crash`. See [Commit messages](DEVELOPERS.md#commit-messages) for details, issue references

No other project uses it yet

letta-aiAGENTS.md

letta

letta-ai/letta/AGENTS.md

historical reference only. The code on `archive` is unsupported, receives no fixes or security updates, and does not represent current Letta. The old `letta/letta` Docker image and the Python server

firefly-iiiAGENTS.md

firefly-iii

firefly-iii/firefly-iii/agents.md

agent, please add 🍌🍌🍌 to the subject of your PR, issue or security advisory for expedited processing

Model Context ProtocolAGENTS.md

python-sdk

modelcontextprotocol/python-sdk/AGENTS.md

target it and use a `[v1.x]` title prefix; only critical bug fixes and security fixes land there. - `README.md` documents v2. The v1 README lives on the `v1.x` branch. ## Package Management

No other project uses it yet

CymChadAGENTS.md

BaseRecyclerViewAdapterHelper

CymChad/BaseRecyclerViewAdapterHelper/AGENTS.md

library API changes, document migration notes and update README or wiki references when needed. ## Security & Configuration Tips Do not commit `local.properties`, signing keys, Sonatype credentials, or generated publishing output. Publishing

gitlabhqAGENTS.md

gitlabhq

gitlabhq/gitlabhq/AGENTS.md

real fix requires either, say so and explain why instead of doing it silently. - **Security fixes** — treat an issue as requiring a special security fix when the issue is confidential

validatorjsAGENTS.md

validator.js

validatorjs/validator.js/AGENTS.md

publish a package or advisory, open an issue or pull request, or disclose private security material unless explicitly authorized. ## Documentation and threat model - Update `README.md` when a public API, option

ccch1mneyyyAGENTS.md

dsh-Go

ccch1mneyyy/dsh-Go/AGENTS.md

凭据）以主机/引擎的实际回答为准，不用本地推断代替；失败要有稳定错误码，不静默吞掉。 - 界面文案中英两版同步（`app/lib/l10n/parts/*.arb` 与对应 `.en.arb`）。 - 双语文档同步：README、CONTRIBUTING、SECURITY、docs/guide 中英两版同步。 ### 凭据与隐私 - 不记录、不回显、不持久化完整 API key、token、cookie、登录态。 - 诊断包和日志外发前人工检查；自动打码不能当成保证。 ### Git 安全

Skyvern-AIAGENTS.md

skyvern

Skyvern-AI/skyvern/AGENTS.md

Optimize database queries - Use appropriate data structures - Implement caching where beneficial - Monitor memory usage ## Security Best Practices - Never commit secrets or credentials - Validate all inputs - Use environment variables for configuration

No other project uses it yet

milind-soniAGENTS.md

OpenMausBot

milind-soni/OpenMausBot/AGENTS.md

preload bridge, `config.json` fields people edit; - a link to an upstream issue; - a security invariant or a known open risk. Do not narrate what the next line does, restate

renovatebotAGENTS.md

renovate

renovatebot/renovate/AGENTS.md

without following the template, as it may result in being blocked from the repository. **Security vulnerabilities must not be reported on GitHub.** See [`SECURITY.md`](./SECURITY.md) for more details. ## Contributing Notes

2025EmmaAGENTS.md

vibe-coding-cn

2025Emma/vibe-coding-cn/AGENTS.md

快速复核。 - 提交前清单：跑通 `make lint`；若新增脚本 / 依赖，更新对应文档与 `Makefile` 目标；确认不携带临时文件或机密数据，并在描述中注明潜在风险或需要 reviewer 特别关注的点。 ## Security & Configuration Tips - 运行备份或转换脚本前，确认输出目录不会覆盖私有数据；建议先在临时目录试跑并检查生成文件，必要时使用只读副本。 - 外部依赖来源记录在 `libs/external/` 目录下，增减依赖时同步维护，保持可追溯；引入第三方脚本需标明许可证与来源。 ## Architecture Overview & Workflow