gitea_mcp: Instructions file for Codex

AGENTS.md

gitea_mcp AGENTS.md is an instructions file for Codex, OpenCode from amonstack/gitea_mcp. It costs 4,619 tokens per session, scanned C, original, MIT.

Repository instructions for an AI coding agent working on the Gitea MCP project. They define required checks, branch and worktree practices, and implementation rules.

In plain words
What is it for?
They guide repository changes, command selection, branch management, and implementation work while pointing to the project’s architecture and README for technical details.
Why use it?
They reduce unsafe edits and incorrect commands by requiring the agent to inspect files, scripts, and the project structure first.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md; mentions OpenCode.

This is amonstack/gitea_mcp's own configuration. It tells Codex and OpenCode how to work on gitea_mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything gitea_mcp configures →

Reuse

Borrowing it

Nothing to install: this file belongs to amonstack/gitea_mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/amonstack/gitea_mcp/master/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/amonstack/gitea_mcp

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for gitea_mcp AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/amonstack/gitea_mcp/agents-md/github.svg)](https://agentmods.dev/instructions/amonstack/gitea_mcp/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/amonstack/gitea_mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/amonstack/gitea_mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for gitea_mcp AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/amonstack/gitea_mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/amonstack/gitea_mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 4,619 This file is loaded in full into every session.
When invoked 4,619 The same file — it is already loaded in full.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.04619 $0.04619
Opus 5.5 $0.01848 $0.01848
Sonnet 5.5 $0.00924 $0.00924
Haiku 4.5 $0.00462 $0.00462

Measured 2mo ago against content hash 5e1e34952db3, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

gitea_mcp AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

- The Gitea credential (token or git credential) is sent ONLY inside the `Authorization` header of `GiteaClient.request` (and, on the GitLab platform, of `GitLabClient.request`), in one of three schemes: `Authorization:
AGENTS.md · 177 lines

How it starts

The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Uppercase MUST, MUST NOT, and MAY are binding directives; lowercase forms are ordinary words (RFC 2119/8174 convention). FIRST and EXACTLY denote strict precedence and exactness.

This file constrains AI design and development process, rules, and boundaries only; it contains no project description. Project capabilities, deployment, and the MCP client setup guide live in README.md / README.zh-CN.md; the concrete architecture (tech stack, module layout, dependency relationships, core patterns) lives in docs/architecture.md (see §5 Appendix).

1. Agent Guidelines

This section defines how the agent operates on this repository — the workflow to follow and the rules that bind edits and commits.

1.1 Before Running Any Command

  • MUST verify the target file or directory exists before operating on it.
  • MUST NOT assume make, npm run, or other scripts work until the corresponding target exists; check the Makefile and package.json scripts before invoking.
  • The project is an installed ESM workspace — node_modules/ already holds dependencies. Prefer existing tooling over installing new tooling.

1.2 Branch and Worktree Workflow

This project uses a two-remote model: origin is the personal fork (ake131998/gitea_mcp) and upstream is the canonical repo (amonstack/gitea_mcp). Each change MUST follow an isolated branch + worktree workflow:

  • MUST NOT edit, stage, commit, merge, rebase, or cherry-pick on master / main. The local master is a read-only integration branch that mirrors upstream and is synchronized only from upstream; the sole permitted advance is git fetch upstream && git merge --ff-only upstream/master. No branch — feature, fix, the working branch, or any origin/* ref — is ever merged into master; master is never the merge target, only the fast-forward target from upstream. It MUST stay free of direct work — not "just this once", not even for a one-line fix.
  • master accepts no merges. A branch reaches master exclusively through the upstream round-trip: squash to one commit → push to origin → PR against upstream master → upstream merges → local master fast-forwards from upstream. Assembling master by merging local or origin branches is forbidden.
  • Before the first edit of any task, MUST verify the current branch with git branch --show-current; if it is master / main, MUST stop and switch to a feature branch (or a worktree) FIRST, then begin.
  • Branch from the latest master as <type>/<name> (feat/..., fix/..., chore/..., docs/..., refactor/..., test/...) + short kebab-case name (e.g. feat/user-issues).
  • Work in an isolated git worktree at .opencode/worktrees/<name>, not in the primary checkout; the primary checkout MUST stay clean.
  • Before committing, show the full diff and wait for explicit approval; commit only after approval (per 1.6).
  • When shipping: squash the branch to a single clean commit, push to origin (the fork), and open a PR against upstream master. Pushing to origin and opening a PR are both user-gated — do neither unless explicitly requested.
  • After the PR merges: fetch upstream, advance local master with git merge --ff-only upstream/master, remove the worktree, and delete the branch.

Read the full file on GitHub · 177 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago Changed · +147 tokens per session 5e1e34952db3
  2. 2mo ago First seen · 177 lines · 4,472 tokens per session scan C d6600b6307ab

Subscribe to this mod's changes

gitea_mcp AGENTS.md is an instructions file published in the GitHub repository amonstack/gitea_mcp (2 stars, last pushed 1mo ago), licensed MIT. It adds 4,619 tokens to every session, about $0.0185 per session on Opus 5.5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

gitea_mcp AGENTS.md compared with instructions from other repositories

gitea_mcp AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
gitea_mcp AGENTS.mdamonstack/gitea_mcpInstructions file21mo agoMITC4,619Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA5,685GitHub Copilot
langchain AGENTS.mdlangchain-ai/langchainInstructions file149ktodayMITA4,680Codex, OpenCode
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA3,093GitHub Copilot
vscode model-prompts.instructions.mdmicrosoft/vscodeInstructions file195ktodayMITA2,022GitHub Copilot