Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/alecs5am/ralphy/agents-mdgit clone --depth 1 https://github.com/alecs5am/ralphyWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.09632 | $0.09632 |
| Opus 5 | $0.04816 | $0.04816 |
| Sonnet 5 | $0.01926 | $0.01926 |
| Haiku 4.5 | $0.00963 | $0.00963 |
Grade D, and why
ralphy AGENTS.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Subtle steeringmediumPrompt injection
Instructions that bias recommendations or shape behaviour without the user noticing.
**Chat is the user interface; the Ralphy CLI is the agent runtime.** The user does not operate `ralphy` by hand — they talk to Hermes, Claude Code, Codex, or another local coding agent in plain language, and the agent dr Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- **If the user wants a clean slate**, use `ralphy project delete <id>` (registry-aware) or wait for explicit `rm -rf` permission scoped to a named path. Never volunteer a cleanup. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. **Only registered provider connectors may hold keys / hit provider hosts — no ad-hoc curl.** Keys flow through a connector's own `envVar` (`OPENROUTER_API_KEY`, `ELEVENLABS_API_KEY`, `FAL_KEY`, `FIRECRAWL_API_KEY`, `A How it starts
The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — playbook router
The authoritative domain state is SQLite under the explicit .ralphy data
root. Normal commands and bridge handlers use explicit --workspace scope or
an immutable Session; registry/current-Workspace pointers and legacy control
files are not authoritative. Portable transfer uses workspace.export and
workspace.import.
This file is
@-imported byCLAUDE.md, so it's always in the system prompt. It is the routing contract for every user request.
Current ralphy CLI:
v0.3.0(released 2026-06-02). Verify the user's binary viaralphy --version. If it lags this version, suggestbrew upgrade ralphy(macOS) ornpm update -g @alecs5am/ralphy(cross-platform) so they pick up the fixes documented in this routing table.
Positioning (who operates Ralphy)
Chat is the user interface; the Ralphy CLI is the agent runtime. The user does not operate ralphy by hand — they talk to Hermes, Claude Code, Codex, or another local coding agent in plain language, and the agent drives the CLI on their behalf. The product promise is "turn your coding agent into a content farm": the CLI exists to give agents reproducible model calls, workspace state, quality gates, renders, logs, and memory. Direct CLI use is for setup, debugging, and power users — not the default workflow. Practically: surface what you ran when it helps the user follow along, but never tell the user to run a ralphy verb when you can run it for them. (Memory: agent-facing-ralphy-positioning.)
What a run produces. A finished piece is a Unit: one Template (structure) + one Style (look) + N Recipes (effects) + M Assets (character / location / prop / music). Project deliverables land in <project>/units/<slug>/; account-level posts, threads, and articles land in <workspace>/units/<slug>/. Everything between a chat request and that Unit is the production contract below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 164 lines · 9,632 tokens per session scan D a97dd362ce93
ralphy AGENTS.md is an instructions file published in the GitHub repository alecs5am/ralphy (128 stars, last pushed 8d ago), licensed Apache-2.0. It adds 9,632 tokens to every session, about $0.0482 per session on Opus 5. A static security scan graded it D with 3 findings (subtle steering, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
openscience AGENTS.md
AGENTS.md instructions for synthetic-sciences/openscience, covering style guide, avoid let statements, avoid else statements, prefer single word naming and testing.
gini-agent AGENTS.md
AGENTS.md instructions for Open-Curiosity/gini-agent, covering gini agent instructions, shape, adrs, boundaries and branches.
Ornn CLAUDE.md
Instructions for ChronoAIProject/Ornn, covering claude.md — chrono-ornn, product positioning, tech stack, architecture and code standards.
selftune AGENTS.md
Instructions for selftune-dev/selftune, covering agents.md, repository overview, vendored effect reference, agent-first architecture and project structure.
agentconfig.org AGENTS.md
Instructions for agentconfig/agentconfig.org, covering agent instructions for agentconfig.org, project overview, target audience, site structure and tech stack.
generative-media-skills AGENTS.md
Instructions for calesthio/generative-media-skills, covering agent instructions, non-negotiable rules and allowed consistency.