Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/adder-factory/cartograph/agents-mdgit clone --depth 1 https://github.com/adder-factory/cartographWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/adder-factory/cartograph/agents-md)<a href="https://agentmods.dev/instructions/adder-factory/cartograph/agents-md"><img src="https://agentmods.dev/badge/instructions/adder-factory/cartograph/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03990 | $0.03990 |
| Opus 5 | $0.01995 | $0.01995 |
| Sonnet 5 | $0.00798 | $0.00798 |
| Haiku 4.5 | $0.00399 | $0.00399 |
Grade C, and why
cartograph AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://raw.githubusercontent.com/adder-factory/cartograph/main/install.sh | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://raw.githubusercontent.com/adder-factory/cartograph/main/install.sh | sh How it starts
The opening of the file, as written. The whole thing — 432 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — install and use Cartograph v2 from an AI coding agent
Cartograph is this workspace's native code-intelligence MCP server. These instructions are deliberately mechanical: execute a step, verify its result, then continue.
Working on the Cartograph repository itself? Read
AGENTS.local.mdbefore changing code. It contains the private development conventions, architecture gates, Sonar workflow, reviewer step, and release procedure. A fresh public clone does not contain that git-ignored file.
Existing project rule
If .cartograph/ or a project-local Cartograph MCP registration exists, use
Cartograph for relationship-aware exploration:
cartograph contextfor broad coding-task evidence;cartograph findfor exact name/path/reference or BM25 lookup;cartograph graphfor callers, callees, and reverse impact;cartograph affectedfor test selection;cartograph reviewfor compare-to-ref and dirty-worktree evidence;cartograph statusbefore relying on the index.
If the index is stale, run cartograph index <project> or call the MCP
cartograph_admin index action. Do not present stale evidence as current.
If the project has no Cartograph setup, ask:
I notice this project does not have Cartograph initialized. Would you like me to start its PostgreSQL/ParadeDB database, index it, and add project-local MCP configuration?
Architecture and hard requirements
Cartograph v2 is:
- a native Rust executable;
- PostgreSQL 18.4 or newer within major version 18;
- code-aware BM25 through ParadeDB
pg_search0.25.3; - pgvector 0.8.4 or newer (0.8.6 recommended for external PostgreSQL; the
managed ParadeDB 0.25.3 image bundles
pg_search0.25.3 and pgvector 0.8.4); - useful without an LLM through exact, lexical, graph, review, and test-impact retrieval.
There is no SQLite runtime, importer, optional feature, or fallback. Never recommend SQLite for v2 and never attempt to open an old SQLite graph.
Step 0 — install the binary
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 432 lines · 3,990 tokens per session scan C bb72675e8c52
cartograph AGENTS.md is an instructions file published in the GitHub repository adder-factory/cartograph (2 stars, last pushed 9d ago), licensed MIT. It adds 3,990 tokens to every session, about $0.0199 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
sverklo CLAUDE.md
Instructions for sverklo/sverklo, covering sverklo development, using sverklo tools, project structure and build & test.
CodeStory AGENTS.md
AGENTS.md instructions for TheGreenCedar/CodeStory, covering codestory agent guide, start here, ownership boundaries, product invariants and identity and configuration.
CodeStory copilot-instructions.md
Copilot instructions for TheGreenCedar/CodeStory: Use CodeStory proactively for repository questions. Do not wait for the user to mention it by name.
astra copilot-instructions.md
Copilot instructions for nimelkot/astra: Astra uses the official MCP Python SDK and targets Python 3.10+. The MCP server is stdio-based and exposes the same core services as the CLI.
rs-agent-code-utility AGENTS.md
AGENTS.md instructions for njfio/rs-agent-code-utility, covering repository guidelines, tooling: use the rts index, not grep / rg, when to use which tool, verify before you claim and two cli shapes.
engraphis AGENTS.md
AGENTS.md instructions for Coding-Dev-Tools/engraphis, covering agents.md — engraphis, internal subagent delegation, 0. read this first — two architectures live in one package, 1. commands and ── unified dashboard + memory inspector ──.