How real projects brief Codex, Cursor and every other agent that reads AGENTS.md.
affaan-mAGENTS.mdaffaan-m/ECC/AGENTS.md
domain tasks 2. **Test-Driven** — Write tests before implementation, 80%+ coverage required 3. **Security-First** — Never compromise on security; validate all inputs 4. **Immutability** — Always create new objects, never mutate
DeepSeekAGENTS.mddeepseek-ai/deepseek-harness/packages/experimental/AGENTS.md
packages through `devDependencies`; examples may load them explicitly. - Experimental status does not relax engineering, security, documentation, lifecycle, testing, invariant, or snapshot requirements. - Publishing an experimental package does not promote
MicrosoftAGENTS.mdmicrosoft/vscode/extensions/copilot/assets/prompts/skills/agent-customization/references/agents.md
/hooks.md)). ### Supported Events `SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `PreCompact`, `SubagentStart`, `SubagentStop`, `Stop` ### Example ```yaml --- description: "Secure code reviewer that blocks dangerous commands" tools: [read, search, execute] hooks: PreToolUse: - type: command command
MicrosoftAGENTS.mdmicrosoft/vscode/extensions/copilot/src/extension/chatSessions/copilotcli/AGENTS.md
Operations * Search Operations * Agent & Task Operations * User Interaction * Code Review & Git * Data, Memory & MCP * Security ### `common/copilotCLIPrompt.ts` Parses raw user prompts and extracts structured chat prompt references (files, locations, diagnostics) ### `node/copilotcliPromptResolver.ts
MicrosoftAGENTS.mdmicrosoft/vscode/src/vs/platform/agentHost/node/copilot/prompts/AGENTS.md
FAMILY`, which is process-scoped and would leak across every session in the window. > **Security note.** The setting is application-scoped (not workspace-configurable) and forwarded to the agent host
DietrichGebertAGENTS.mdDietrichGebert/ponytail/AGENTS.md
efficiency), input validation at trust boundaries, error handling that prevents data loss, security, accessibility, the calibration real hardware needs (the platform is never the spec ideal, a clock drifts
MicrosoftAGENTS.mdmicrosoft/PowerToys/AGENTS.md
Top-level AI contributor guidance for developing PowerToys - a collection of Windows productivity utilities
addyosmaniAGENTS.mdaddyosmani/agent-skills/AGENTS.md
parallel fan-out with a merge step** — used by `/ship` to run `code-reviewer`, `security-auditor`, and `test-engineer` concurrently and synthesize their reports. Do not build a "router" persona
addyosmaniAGENTS.mdaddyosmani/agent-skills/docs/agents.md
Role | Best for | |---------|------|----------| | [code-reviewer](../agents/code-reviewer.md) | Senior Staff Engineer | Five-axis review before merge | | [security-auditor](../agents/security-auditor.md) | Security Engineer | Vulnerability detection, OWASP-style audit | | [test-engineer](../agents/test-engineer.md) | QA Engineer | Test
nexu-ioAGENTS.mdnexu-io/open-design/.github/AGENTS.md
burying branching in shell fragments. ## Fork PR approval `fork-pr-workflow-approval.yml` and `scripts/approve-fork-pr-workflows.ts` are a separate security boundary. They may approve low-risk fork PR `pull_request` runs, but must not approve
AstralAGENTS.mdastral-sh/uv/AGENTS.md
webhook events instead of adding `pull_request_target` workflows - NEVER suppress the `dangerous-triggers` security lint; extend the automation dispatcher in a separate pull request if it does not support
koala73AGENTS.mdkoala73/worldmonitor/AGENTS.md
solutions](docs/solutions/) when the affected area has a prior fix — organized by category directory (`security-issues/`, `logic-errors/`, `conventions/`, …) with YAML frontmatter (`module`, `component`, `problem_type`, `tags`) to grep
ElasticAGENTS.mdelastic/elasticsearch/AGENTS.md
jobs expect ephemeral hosts; do not run packaging suites on your workstation. - **Security**: Default dev clusters enable security; use `elastic-admin:elastic-password` or disable with `-Dtests.es.xpack.security.enabled=false`. - **Cursor/Copilot rules
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/.agents/AGENTS.md
form of the `/publish` command | | `remove-deadcode/` | NEW | Skill form of the `/remove-deadcode` command | | `security-research/` | NEW | Team Mode security research audit: 3 vulnerability hunters + 2 PoC engineers | | `codex
code-yeongyuAGENTS.mdcode-yeongyu/oh-my-openagent/.opencode/AGENTS.md
Remove unused code with LSP-verified safety + atomic commits. | | `/security-research` | Run the Team Mode security-research audit with 3 vulnerability hunters and 2 PoC engineers. | ## OTHER CONTENTS - `background-tasks.json` — Runtime state
gsd-buildAGENTS.mdgsd-build/get-shit-done/AGENTS.md
relevant, test evidence, affected platforms/runtimes, and update `CHANGELOG.md` or docs for user-facing changes. ## Security & Configuration Tips Do not commit secrets, local config, or generated worktree artifacts. Before release-facing
gsd-buildAGENTS.mdgsd-build/get-shit-done/docs/AGENTS.md
checker, integration-checker, ui-checker | | Verifiers | 1 | verifier | | Auditors | 3 | nyquist-auditor, ui-auditor, security-auditor | | Mappers | 1 | codebase-mapper | | Debuggers | 1 | debugger | | Doc Writers | 2 | doc-writer, doc-verifier
calesthioAGENTS.mdcalesthio/OpenMontage/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
aaif-gooseAGENTS.mdaaif-goose/goose/AGENTS.md
Feature). `gh issue create` does not apply templates automatically. Maintainer-directed work, urgent security fixes, release automation, and local or exploratory changes do not require a Ready issue. ## MCP Server
CherryHQAGENTS.mdCherryHQ/cherry-studio/.agents/skills/vercel-react-best-practices/AGENTS.md
invoked directly. Next.js documentation explicitly states: "Treat Server Actions with the same security considerations as public-facing API endpoints, and verify if the user is allowed to perform a mutation
An open format for instructions to coding agents, read by Codex, Cursor and others. Think of it as a README written for agents.
At the repository root, with more specific files in subdirectories. Agents read the one closest to the file they're editing.
Setup and test commands, code style, and the rules a new contributor would need to know.
Claude Code reads CLAUDE.md. A one-line CLAUDE.md that points at AGENTS.md covers both.
