agentmods.dev

sniff AGENTS.md

Repository instructions for sniff, an automated quality checker that opens a running web app in a real headless browser and follows user flows. It reports failures with evidence and is available as a command-line tool or MCP server.

In plain words
What is it for?
Use it to scan a running web app, reproduce broken interactions, and choose the recommended MCP or command-line workflow.
Why use it?
It helps an agent find problems that only appear during actual use, rather than relying on code inspection or static checks. The instructions also explain setup requirements and the expected results format.

Instructions file for CodexOpenCode

4 3mo ago A scan 1,901 tokens original Apache-2.0
View the source file Aboudjem/sniff
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/aboudjem/sniff/agents-md
Clone the repo
git clone --depth 1 https://github.com/Aboudjem/sniff

Made for: Codex, OpenCode.

Per session 1,901 This file is loaded in full into every session.
When invoked 1,901 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01901 $0.01901
Opus 5 $0.00950 $0.00950
Sonnet 5 $0.00380 $0.00380
Haiku 4.5 $0.00190 $0.00190

Measured 2d ago against content hash d98a150a5902, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

sniff AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md: sniff

Instructions for AI agents and coding assistants working in, or invoking, this repository. Plain Markdown, no required fields (per the AGENTS.md convention: the agent simply parses the text below). Human-facing docs live in README.md; this file holds the extra context an agent needs.

What this repo is

sniff is an autonomous QA scanner: point it at a running web app and it walks the app's real user flows in a real (headless) browser and reports what's actually broken, with proof. It is not a static linter. npm package sniff-qa (binaries sniff and sniff-qa); ships as both a CLI and an MCP server (Claude Code plugin); Apache-2.0; Node >= 22; no API key required.

How an agent should USE sniff

Prefer the MCP sniff tool over the CLI when running inside an agent host (Claude Code, Cursor, VS Code/Copilot, Codex, Gemini CLI, Windsurf, Continue.dev). There is one unified sniff tool; pass { mode, rootDir, baseUrl? }.

  • mode: "walk" (RECOMMENDED, for a running app): drives a real browser, walks the app's user flows, and returns real bugs with reproduction proof. Pass rootDir (absolute project path) and, optionally, baseUrl (the running app's URL). If baseUrl is omitted, sniff auto-detects the local dev server. If no app is running, it degrades to a source scan and tells you so via a note field (start the dev server or pass baseUrl to get runtime bugs). Useful options: maxPages (default 25), mobile (default true, the 375px responsive pass), all (default false, include uncertain findings).
  • mode: "scan" (source-only, no browser): pass rootDir only. Finds placeholder/TODO/console.log/dead links/etc. by reading source. Works offline; no browser needed.
  • mode: "report": load the last results for rootDir (format: "json" | "summary").
  • mode: "run" / "discover" are legacy: prefer walk. run does a source+browser audit; discover does scenario-based E2E.

Handling the Playwright setup gate

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 93 lines · 1,901 tokens per session scan A d98a150a5902

Subscribe to this mod's changes

sniff AGENTS.md is an instructions file published in the GitHub repository Aboudjem/sniff (4 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 1,901 tokens to every session, about $0.0095 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

E2E testingTestingaccessibilityaideveloper-toolsmcpplaywrightqa
Related

Other instructions, from other repositories

argus AGENTS.md

Instructions for chriswu727/argus, covering argus — agent guide, setup, web mode (works everywhere), wire it into the mcp host and using argus within the host task.

chriswu727/argus · 2,825 tokens

playwright-fieldkit CLAUDE.md

Instructions for jpbaking/playwright-fieldkit, a project described as: Playwright FieldKit: gives coding agents hands and eyes on the web — crawl, debug, record, and test live sites via deterministic scripts; portable Agent Skill for Codex, Claude Code, Antigravity, and Cline.

jpbaking/playwright-fieldkit · 5 tokens

playwright-mcp CLAUDE.md

Claude Code instructions for microsoft/playwright-mcp, covering commit convention, ... make changes .., summary, rolling playwright and preparing a release.

microsoft/playwright-mcp · 363 tokens

cli AGENTS.md

AGENTS.md instructions for qawolf/cli, covering @qawolf/cli — agent instructions, commands, testing, project structure and code style.

qawolf/cli · 1,844 tokens

playwright-movies-app AGENTS.md

Instructions for debs-obrien/playwright-movies-app, covering agent guide (humans and ai), preferred tool path, style contract, healing and review checklist.

debs-obrien/playwright-movies-app · 891 tokens

webqa-agent CLAUDE.md

Instructions for MigoXLab/webqa-agent, covering claude.md, 模块化规则引用, 研究和规划 (critical), 1. 使用 context7 mcp 工具 and 2. 使用联网搜索.

MigoXLab/webqa-agent · 4,877 tokens