The rules real projects give Cursor's agent, from .cursor/rules.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
murphycheng-24Cursor rulemurphycheng-24/coding-guidelines/.cursor/rules/engineering-discipline.mdc
Enhanced version of Andrej Karpathy's 4 behavioral guidelines for LLM coding, expanded to 10 engineering discipline rules. Use when writing, reviewing, refactoring, or debugging code to reduce overcomplication, make surgical changes, surface assumptions, and verify outcomes.
JosefGisisCursor ruleJosefGisis/skills/.cursor/rules/implementation.mdc
Corrects recurring implementation habits — verbosity, premature abstraction, unsafe types, dependency tangles, and scope creep. Apply whenever writing, modifying, reviewing, or refactoring code (features, bugs, utilities, or small targeted changes). Not a design-pattern encyclopedia; a targeted correction set that takes precedence over default coding instincts when they conflict.
galyarderlabsCursor rulegalyarderlabs/galyarder-framework/.cursor/rules/vercel-react-best-practices.mdc
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/go-conventions.mdc
Use when writing, reviewing, or refactoring Go code — naming conventions, receiver naming, error wrapping, interface design, goroutine safety, and common pitfalls (goroutine leaks, defer-in-loop, nil map writes).
VoTruongDanhCursor ruleVoTruongDanh/Skills-Agent/.cursor/rules/enhance.mdc
Improve existing code — refactor, optimize performance, tighten security, or enhance UX. Use when the user wants to make code better without changing its purpose. Triggers: enhance, improve, refactor, optimize, review, cải thiện, tối ưu, nhanh hơn, code dài quá.
CultureDigitaliCursor ruleCultureDigitali/gigiloop/.cursor/rules/gigiloop.mdc
Verification-first autonomous coding loop with resumable state, adversarial review, and local CI fallback
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/typescript-conventions.mdc
Use when writing, reviewing, or refactoring TypeScript or JavaScript code — naming conventions, type annotations, private fields, null vs. undefined, async/await pitfalls, and module structure.
formhaus-devCursor ruleformhaus-dev/formhaus/.cursor/rules/formhaus.mdc
Formhaus form definitions. Use when creating, editing or reviewing a Formhaus JSON form definition, or code that passes one to FormEngine or FormRenderer.
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/react-best-practices.mdc
Use when writing, reviewing, or optimizing React or Next.js code — component architecture, hooks rules, server vs. client components, data fetching patterns, bundle size, and accessibility in React.
sordi-aiCursor rulesordi-ai/skill-everything/.cursor/rules/code-quality.mdc
Apply when writing or refactoring code. Generic rules to prevent the most common review comments — function length, naming, error handling, security, and tooling.
madebyarisCursor rulemadebyaris/advance-minimax-m3-cursor-rules/.cursor/rules/language-agnostic-patterns.mdc
Language-agnostic programming patterns: SOLID, design patterns, clean code, and architecture. Load when refactoring, designing abstractions, or reviewing structure — not for everyday syntax.
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/supply-chain-security.mdc
Dependency and supply-chain threat discipline — pin and lock, audit for advisories, vet a new dependency before adding it, and treat install scripts and typosquats as attack surface. Invoke before adding or upgrading a dependency, or when hardening a project's build against a compromised package. Complements the security-review skill, which covers your own code's threat model.
Often used withbinary-diffpentest-toolsjs-reverse
MANVENDRA-githubCursor ruleMANVENDRA-github/agentry/.cursor/rules/sql/injection-safety.mdc
SQL injection-safety discipline — every user value goes through a bound parameter, never string-built SQL, allowlist the identifiers that can't be bound. Apply when writing or reviewing any SQL or query-building code. Skip only for a fixed, fully-static query with no external input anywhere in it.
KangaKodeCursor ruleKangaKode/universal-agent-bootstrap/.cursor/rules/minimalist.mdc
Prevents over-engineering and code bloat. Invoke on any change over 100 lines or when reviewing for unnecessary complexity.
pavlelausevicCursor rulepavlelausevic/business-reasoning/.cursor/rules/business-reasoning.mdc
Diagnostic business judgment from twelve canonical business books. Use for any question about validating, pricing, positioning, marketing, monetizing or scaling a business, product or side project — including casual phrasings, and even inside a coding task. Also covers competitor research from real reviews and Google Play launches.
andr-caCursor ruleandr-ca/agentharness/.cursor/rules/api-design.mdc
Use when designing, reviewing, or evolving a REST or GraphQL API — resource naming, HTTP status codes, versioning strategy, error response shapes, pagination, and authentication patterns.
tounsilsCursor ruletounsils/claude-code-skills/.cursor/rules/audit-security.mdc
Security review of a change or working tree against the OWASP Top 10: committed secrets, injection, broken access control, SSRF, insecure deserialization, permissive CORS, vulnerable dependencies, and sensitive data in logs. Reports exploitability, not category names. Use when asked to security review this, audit for vulnerabilities, check this is safe to ship, or before pushing code that touches auth, user input, or data access.
abxn4rCursor ruleabxn4r/archon-skills/.cursor/rules/dijkstra.mdc
ALWAYS invoke when the user mentions Dijkstra (e.g., 'Dijkstra', 'ask Dijkstra', 'run Dijkstra', 'consult Dijkstra') or asks for engineering architecture review. Engineering Architect & Principal Engineer evaluating system architecture, codebase health, PRs, technical debt, scalability, refactoring, code quality, and engineering decisions across thousands of commits.
Fadi88Cursor ruleFadi88/one-man-startup/.cursor/rules/agent-security.mdc
Reviews designs and diffs for security and privacy risk - auth, access control, secrets, injection, dependencies, data exposure. It writes its report and never changes code. Use on any feature touching accounts, payments, personal data, file upload or a new integration.
mchittineniCursor rulemchittineni/cloud-platform-skills/.cursor/rules/skills/ai-agent-security-llm-threats.mdc
Security for LLM and agent systems: direct and indirect prompt injection, the OWASP Top 10 for LLM Applications, MITRE ATLAS technique mapping, excessive agency and tool-scope containment, egress allowlisting to stop data exfiltration, human confirmation for irreversible actions, and treating third-party skills and MCP servers as untrusted code. Use when an agent is given tools or credentials, when retrieved documents or repository files could carry injected instructions, or when reviewing an AI feature before it reaches production.
Instruction files for Cursor's agent, kept in .cursor/rules/ as .mdc files.
A rule can apply only to files matching a pattern, or only when the agent asks for it. AGENTS.md always applies.
Copy the .mdc file into your project's .cursor/rules/ directory and adjust its globs.
Open a rule to see its discussion. Reports from people and their agents are coming.
