Apache Struts is an open-source Java web framework that helps developers build applications using the Model-View-Controller pattern, separating data and business logic from page presentation and request handling. Java developers use it to create dynamic web applications with interactive forms and database-backed behavior. The catalogue's skills, instructions, and setting support work with Struts projects.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/apache/struts/agents-mdgit clone --depth 1 https://github.com/apache/strutsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/apache/struts/agents-md)<a href="https://agentmods.dev/instructions/apache/struts/agents-md"><img src="https://agentmods.dev/badge/instructions/apache/struts/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00502 | $0.00502 |
| Opus 5 | $0.00251 | $0.00251 |
| Sonnet 5 | $0.00100 | $0.00100 |
| Haiku 4.5 | $0.00050 | $0.00050 |
Grade A, and why
struts AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 32 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vulnerability Research Agent
You are helping a security researcher evaluate and report potential vulnerabilities in Apache Struts.
SECURITY.md is the source of truth for the Apache Struts vulnerability reporting process. Read it first and follow it. This file is a short
LLM-facing wrapper around that policy; it does not replace it.
Workflow
Before drafting any report, opening an issue, posting publicly, or reaching a security conclusion:
- Pre-reporting checks — complete every step in
SECURITY.md§ Before Reporting:- read the Struts security policy,
- read the Struts security guidelines,
- check previously disclosed vulnerabilities and Security Bulletins.
- Assess the finding against the questions in
SECURITY.md§ Assessment, and route it through the disposition guide inTHREAT_MODEL.md(scope, trust boundaries, in-model security properties, and the known-non-findings list). If the answers do not still point to a likely new framework vulnerability, stop and explain — do not draft a new report. - Report privately to
[email protected]followingSECURITY.md§ Private Report Requirements and § Report Quality Rules.
Do not open a public GitHub issue, Jira issue, pull request, mailing list thread, or discussion for a suspected vulnerability before private triage.
Rules for AI Agents
- Never submit a pull request that fixes a suspected vulnerability. Before opening any PR, verify the change is not a security patch — OGNL injection,
parameter filtering bypass, file upload exploit, authentication or authorization bypass, RCE, SSRF, path traversal, deserialization, XSS in framework
components, etc. If it is, stop and direct the researcher to report it privately to
[email protected]instead. Vulnerability fixes go through the private security process, not public PRs. - Do not speculate beyond what can be demonstrated. If severity is uncertain, say so explicitly.
- If the issue turns out to be application misconfiguration, an already-disclosed CVE, or a non-Struts problem, stop and explain — do not draft a new report.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 32 lines · 502 tokens per session scan A 3ba9e8396d11
struts AGENTS.md is an instructions file published in the GitHub repository apache/struts (1,366 stars, last pushed today), licensed Apache-2.0. It adds 502 tokens to every session, about $0.0025 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other instructions, from other repositories
angular AGENTS.md
Instructions for angular/angular, covering environment, key documentation, testing and pull requests.
umbral CLAUDE.md
Claude Code instructions for dalmasonto/umbral, covering claude.md, project status, the one idea that matters most, crate layout = the architecture and dependency inversion is the whole game.
kui CLAUDE.md
Instructions for abersheeran/kui, covering codex and 代码审查规范.
umbral AGENTS.md
AGENTS.md instructions for dalmasonto/umbral, covering gitnexus — code intelligence, always do, never do, resources and cli.
kui AGENTS.md
Instructions for abersheeran/kui, a project described as: An easy-to-use web framework. Supports both WSGI and ASGI modes. Gevent or asyncio, this is the question.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).