Borrowing it
Nothing to install: this file belongs to alevizio/curb. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/alevizio/curb/main/CLAUDE.mdgit clone --depth 1 https://github.com/alevizio/curbWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/alevizio/curb/claude-md)<a href="https://agentmods.dev/instructions/alevizio/curb/claude-md"><img src="https://agentmods.dev/badge/instructions/alevizio/curb/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/alevizio/curb/claude-md"><img src="https://agentmods.dev/badge/instructions/alevizio/curb/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.17240 | $0.17240 |
| Opus 5.5 | $0.06896 | $0.06896 |
| Sonnet 5.5 | $0.03448 | $0.03448 |
| Haiku 4.5 | $0.01724 | $0.01724 |
Grade A, and why
curb CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
monitor's QStash PAT, must not be able to broadcast `?test=ios`; run that test by hand with curl and How it starts
The opening of the file, as written. The whole thing — 695 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CURB — SF street parking, block by block
Context for Claude Code. Read this before editing.
What it is
A mobile-first web app that shows San Francisco street-parking rules on an interactive map: where you can park, until when it's swept, whether it's metered, and whether it's a residential permit (RPP) zone. Lets the user set a calendar reminder before the next sweep.
Stack (intentionally minimal)
- Single static file:
index.html. No build step, no framework, no bundler. - Vanilla JS + Leaflet 1.9.4 (from cdnjs) for the map.
- Basemap: self-hosted parchment raster tiles (
basemap/parchment/,SELF_BASEMAPin index.html), baked from MAP_STYLE byscripts/build-basemap.shand served by Vercel from this repo ($0). Seedocs/self-host-basemap-plan.md. Google (forced off 2026-06-29, billing) and CARTO (keyless tiles now watermarked "API KEY REQUIRED") are unreachable while SELF_BASEMAP is set. Legacy path: official Google Map Tiles API whenGMAPS_KEY(orwindow.GMAPS_KEY) is set — session-token flow ininitBasemap(), viewport attribution refreshed on moveend. Falls back to keyless CARTO Voyager raster tiles when no key / on any failure. Leaflet stays the map engine either way. The Google key is a client key (referrer-restrict it) kept OUT of the public repo: local dev reads a gitignoredconfig.js(fromconfig.example.js); on Vercel,api/config.jsemitswindow.GMAPS_KEYfrom theGMAPS_KEYenv var andvercel.jsonrewrites/config.js→/api/config. - Everything is client-side. Data is fetched live from DataSF (Socrata) at runtime.
- Design system: fonts Anton (display) + Hanken Grotesk (body); "transit signage" aesthetic; color tokens in :root (--green clear / --amber soon / --red now / --meter permit-blue / paper+ink). Keep this language if extending the UI.
Data sources (all DataSF Socrata, CORS-open: access-control-allow-origin: *)
DataSF moved hosts: data.sfgov.org now 301s to data.sf.gov with no CORS header (and 403s any
query using $select), which silently broke every browser fetch. Always use https://data.sf.gov (2026-09-27).
- Street sweeping —
yhqp-riqshttps://data.sf.gov/resource/yhqp-riqs.json Fields: cnn (segment id), corridor, limits (cross streets), blockside, cnnrightleft (L/R vs digitized direction), weekday, fromhour, tohour, week1..week5 ("1"/"0" = Nth occurrence of that weekday in the month), line (GeoJSON LineString). CURRENT data. weekday can also be 'Holiday' (824 rows, one per curb side on ~590 blocks): the side's posted holiday schedule, see the holiday model below. - Parking meters —
8vzz-qzz9https://data.sf.gov/resource/8vzz-qzz9.json Fields: street_name (UPPERCASE), cap_color, on_offstreet_type, lat/long, etc. CURRENT data. Used only for a street-level count (no spatial join — see limits). - Parking regulations / RPP —
hi6h-neyhhttps://data.sf.gov/resource/hi6h-neyh.json Fields: regulation, rpparea1 (permit-area letter), hrlimit, days, from_time, to_time, exceptions, shape (GeoJSON MultiLineString). STALE: this is SFMTA's 2017 set, flagged by the city as not comprehensively updated. Treat as a hint. NOTE: RPP covers BOTH curbs — rendered as ONE street-wide centerline ribbon UNDER the curb lines, with zoom-scaled weight (rppWeight(): 4px@z15 → 26px@z18 ≈ curb-to-curb). Do NOT draw offset bands per side: they stack into a blue blanket at low zoom and collide with the ±5m curb lines at high zoom (tried 2026-06-09, looked broken). - Loading / color-curb zones —
6cqg-dxku(Meter Operating Schedules) Fieldapplied_color_rulecarries the regulation + days_applied/from_time/to_time/ time_limit (White=passenger, Yellow=commercial, Red=truck, Green=short-term, Orange=bus).cap_coloris UNRELIABLE (white zones show Grey caps) — match on applied_color_rule. No geometry → join to meter coords bypost_id(8vzz-qzz9 lat/long). Metered zones only; paint-only curbs aren't published. Loaded once on toggle, rendered per-viewport. - Parking citations —
ab4h-6ztd(23.8M rows, daily, ~2-5 day lag) STR CLEAN (TRC7.2.22) + ST CLEANIN (T37C) = street-cleaning tickets, minute-resolution. A 2024 records request (#26-5453) restored GPS lat/long on the citations: ~1.05M of ~1.35M street-cleaning tickets now match to a CNN by NEAREST CNN SEGMENT (<=40m), the primary pipeline. The old address→CNN join via EAS (3mea-di5p, keyed by stripZeros(number)|street_name) is demoted to a pre-2024 fallback for rows without GPS. Precomputed offline intodata/enforcement.json— seescripts/build-enforcement-records.pyanddocs/sweeper-data-research.md. Powers the "🎯 Ticketed ~9:11a" lines. Feed gotchas (checked 2026-10-11 against the records file, ticket by ticket): (1) every ticket written 12:00-12:59 AM shows a WRONG hour, the first digit of the minute (00:24 → 02:24); anything that reads hours from the feed must go throughfixHour(scripts/midnight-hour.mjs, used by build-stats). Reported to DataSF 2026-10-11; they replied 2026-10-15 that they are investigating. The bug never leaves a ticket at 00:01-00:59, so build-stats treats any day that has one as fixed and leaves its hours alone (logged as "feed already right on N days"): the workaround switches itself off as their fix lands. (2) The feed's latitude/longitude (added mid-2026) geocode the typed ADDRESS, not the officer's GPS: same ticket, different block ~1 in 4 times, so keep the records file for block times. (3) The feed is missing most of Nov-Dec 2024. The records file is complete (1,351,709 tickets, Jan 2024 to Jun 2026), but in two tabs: 'Report 1' stops at Excel's row limit and 'Report 1(1)' holds the other 303k (mostly Aug 2025 to Mar 2026), starting in column B with no header row. Read every tab from its first used column (until 2026-10-13 the build skipped that tab without a word, so the map used 815k matched tickets instead of 1.05M). The file lives in the gitignoredprivate/folder (private/TRC7.2.22_1.1.2024_06.24.2026.xlsx, 90 MB, the build's default path; never commit or serve it). On another Mac, download it again from request 26-5453 on sanfrancisco.nextrequest.com.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +7 lines · +208 tokens per session 9e950bebc353
- 6d ago Changed · +15 lines · +520 tokens per session 6dd94c5eaf77
- 6d ago Changed · +21 lines · +646 tokens per session 1857512eff05
- 13d ago Changed · +2 lines · +63 tokens per session 76d8830f40c6
- 15d ago Changed · +30 lines · +909 tokens per session 907065a03230
- 17d ago Changed · +4 lines · +117 tokens per session c5c10d41767d
- 18d ago Changed · +11 lines · +362 tokens per session f0fbb11fc432
- 19d ago Changed · +18 lines · +569 tokens per session 8cb2fe46c22f
- 20d ago Changed · +4 lines · +175 tokens per session 3c4cfdc6a6cb
- 21d ago First seen · 583 lines · 13,671 tokens per session scan A af30d90c7a71
curb CLAUDE.md is an instructions file published in the GitHub repository alevizio/curb (11 stars, last pushed 2d ago), licensed MIT. It adds 17,240 tokens to every session, about $0.0690 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
curb CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| curb CLAUDE.mdalevizio/curb | Instructions file | 11 | 2d ago | MIT | A | 17,240 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |