MyMCPs: Instructions file for Codex

AGENTS.md

Project-specific guidance for AI coding agents.

Changelog

• Keep the root CHANGELOG.md up to date in every pull request that changes user-visible behavior, security, or operations, including dependency and developer-workflow changes that affect users or operators.
• Before final validation, add concise English entries under the current UTC date (## YYYY-MM-DD), grouped as Added, Changed, Fixed, Security, or Removed.
• Consolidate related commits into outcome-focused entries. Do not list commit hashes or merge commits, and omit tests and internal refactors unless they affect users or operators.

Pages and design

The server renders its own pages: maud templates in crates/web/src/views, one stylesheet (crates/web/assets/css/app.css) and one script (crates/web/assets/js/app.js), both written by hand and embedded in the binary. There is no JavaScript build and no component library.

• Read docs/design-system.md before you write or change a page: it lists every component with its markup and class names, the page shell, the data- attributes the script understands, and the protocol of the forms sent without a page load. The design it implements is the Figma file "MyMCP".
• Compose a page from the components that exist. Add CSS only when no component fits, at the end of app.css, with the --mm-* tokens: no raw colour and no value the tokens already name.
• The Content-Security-Policy is strict: no inline style attribute, no <style>, no inline script, no asset from another origin. Sizes that depend on data use the classes and data- attributes the design system lists (data-pct, .col-<px>), and charts are SVG drawn by the server.
• The server does the work and the script only presents it: every list, filter and page is a URL the server renders, and a form sent in the background also answers a plain post with a redirect. Dialogs are the exception: a <dialog> is opened by the script, so the forms that live in one (create, edit, install) need JavaScript, while the actions of a row (revoke, delete, test, enable) do not. So are passkeys, which a browser only makes and uses through its script. Keep it that way: a new page must not need the script for anything but its dialogs and its passkeys.
• Validate input with a mymcps-vine validator, as the rest of the code does, not with hand-written checks.