AGENTS.md examples from real projects

halo-devAGENTS.md

halo / application

halo-dev/halo/application/AGENTS.md

Backend Application Guidelines `application/` is the WebFlux + R2DBC backend: services, routers, security, migrations, and packaging. Everything here is reactive — never block threads. ## Structure - `application/src/main/java/` — services, routers, endpoints, and configuration. - `application/src/main/resources/application

No other project uses it yet

lfnovoReads credentialsAGENTS.md

open-notebook

lfnovo/open-notebook/AGENTS.md

under `## [Unreleased]`, in the one section for its type (`### Added` / `### Changed` / `### Deprecated` / `### Removed` / `### Fixed` / `### Security`); never create a duplicate section. Details: [contributing.md](docs/7-DEVELOPMENT/contributing.md#changelog). - Maintainer profile lives in `.maintainer

No other project uses it yet

rapid7AGENTS.md

metasploit-framework

rapid7/metasploit-framework/AGENTS.md

available linked issues, module documentation, and review discussion alongside the diff. Prioritize correctness, security, regressions, compatibility, and reproducible validation of changed behavior. - Ground each finding in a concrete trigger, affected

AdguardTeamReads credentialsAGENTS.md

AdGuardHome / client_v2

AdguardTeam/AdGuardHome/client_v2/AGENTS.md

stable release rather than copying a stale version. **Rationale**: Fewer, well-vetted dependencies reduce security vulnerabilities, supply-chain risk, and long-term maintenance cost. **Known exclusions** (to be fixed): - Most

No other project uses it yet

keycloakAGENTS.md

keycloak

keycloak/keycloak/AGENTS.md

report's area field (from the `Area` dropdown in `bug.yml`): ``` ### Area ``` ## Security vulnerabilities Do not create public issues for security vulnerabilities. Follow the process in [SECURITY.md](SECURITY.md). ## Contributing code

No other project uses it yet

nextcloudAGENTS.md

server

nextcloud/server/AGENTS.md

github.com/nextcloud/.github/blob/master/AI_POLICY.md)** - the primary reference for AI-specific rules, covering disclosure, author accountability, communication, security, licensing, code quality, and autonomous agent behavior. - **[Contribution Guidelines](https://github.com/nextcloud/.github/blob/master/CONTRIBUTING.md)** - covering testing requirements

No other project uses it yet

markedjsAGENTS.md

marked

markedjs/marked/AGENTS.md

Open/Closed Principle: provide extension hooks rather than bloating core with endless configuration toggles. ### 3. Security & Scope Boundaries - **No Sanitization in Core**: Marked's single responsibility is translating Markdown into HTML

MicrosoftDeletes or force-pushesAGENTS.md

Data-Science-For-Beginners

microsoft/Data-Science-For-Beginners/AGENTS.md

server enables hot-reload for quick iteration - Production builds are optimized and minified ### Security Notes - No sensitive data or credentials should be committed - Use environment variables for any API keys

MicrosoftDeletes or force-pushesAGENTS.md

Data-Science-For-Beginners / en

microsoft/Data-Science-For-Beginners/translations/en/AGENTS.md

server enables hot-reload for quick iteration - Production builds are optimized and minified ### Security Notes - No sensitive data or credentials should be committed - Use environment variables for any API keys

MicrosoftDeletes or force-pushesAGENTS.md

Data-Science-For-Beginners / my

microsoft/Data-Science-For-Beginners/translations/my/AGENTS.md

server သည် hot-reload ကို enable လုပ်သည် - Production builds များသည် optimized နှင့် minified ဖြစ်သည် ### Security Notes - Sensitive data သို့မဟုတ် credentials များကို commit မလုပ်ပါနှင့် - Cloud lessons များတွင် API keys အတွက် environment

MicrosoftDeletes or force-pushesAGENTS.md

Data-Science-For-Beginners / pcm

microsoft/Data-Science-For-Beginners/translations/pcm/AGENTS.md

server dey enable hot-reload for quick iteration - Production builds dey optimized and minified ### Security Notes - No sensitive data or credentials suppose dey committed - Use environment variables

MicrosoftDeletes or force-pushesAGENTS.md

Data-Science-For-Beginners / tl

microsoft/Data-Science-For-Beginners/translations/tl/AGENTS.md

kredensyal ng Azure account - Panatilihing updated ang mga dependencies para sa mga security patch ## Pag-aambag sa Mga Pagsasalin - Ang mga automated na pagsasalin ay pinamamahalaan sa pamamagitan ng GitHub

pnpmAGENTS.md

pnpm

pnpm/pnpm/AGENTS.md

lives in **[review-code review guide](./.agents/skills/review-code/references/REVIEW_GUIDE.md)** — how changes are accepted or rejected, the security-first / performance-second priorities, the security checklist and advisory regression themes, and the test/changeset/version-coverage expectations

pnpmAGENTS.md

pnpm / pnpr

pnpm/pnpm/pnpr/AGENTS.md

pnpr/`. **Read [`../AGENTS.md`](../AGENTS.md) and [`../PHILOSOPHY.md`](../PHILOSOPHY.md) first.** They cover the monorepo-wide philosophy: security, performance, efficient disk usage, predictability, and feature consolidation. They also cover PR workflow, signing agent

wailsappAGENTS.md

wails

wailsapp/wails/AGENTS.md

that summary. Conventional title types choose the category; `changelog:added|changed|fixed|deprecated|removed|security` labels override it, and `skip-changelog` excludes a PR. Internal-only title types are excluded

virgiliojr94AGENTS.md

book-to-skill

virgiliojr94/book-to-skill/AGENTS.md

Preserve backwards compatibility unless the task explicitly authorizes a breaking change. - Do not weaken security checks, path hardening, sanitization, or generated-skill scanning to make an experiment pass. ## Execution loop

BlockReads credentialsAGENTS.md

buzz

block/buzz/AGENTS.md

names the concrete defect and the fix. - Recommend blocking only for concrete correctness, security, or agreed-contract defects with a realistic failure scenario: state the defect, how it fails

utmappAGENTS.md

UTM

utmapp/UTM/AGENTS.md

QEMU out-of-process** (XPC: `QEMUHelper`→`QEMULauncher`); host files reach it only through a security-scoped-bookmark dance — respect it for anything touching disk images, shared dirs, or file handles

No other project uses it yet

pingdotggReads credentialsAGENTS.md

t3code

pingdotgg/t3code/AGENTS.md

loudly and get a human sign-off before breaking it. ## Additional tips - Security is important, but should not be over-indexed on, especially for dev mode/maintainer-only features

gchqAGENTS.md

CyberChef

gchq/CyberChef/AGENTS.md

live under `tests/browser/` and are run with `npm run testui` or `npm run testuidev`. ## Security - Avoid prototype pollution. Utilise `Object.create(null)`, `Map`, and `Object.prototype.hasOwnProperty.call(...)`. - Avoid XSS. Escape strings before rendering