Apache Struts is an open-source Java web framework that helps developers build applications using the Model-View-Controller pattern, separating data and business logic from page presentation and request handling. Java developers use it to create dynamic web applications with interactive forms and database-backed behavior. The catalogue's skills, instructions, and setting support work with Struts projects.
Borrowing it
Nothing to install: this file belongs to apache/struts. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/apache/struts/main/AGENTS.mdgit clone --depth 1 https://github.com/apache/strutsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/apache/struts/agents-md)<a href="https://agentmods.dev/instructions/apache/struts/agents-md"><img src="https://agentmods.dev/badge/instructions/apache/struts/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/apache/struts/agents-md"><img src="https://agentmods.dev/badge/instructions/apache/struts/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00502 | $0.00502 |
| Opus 5.5 | $0.00201 | $0.00201 |
| Sonnet 5.5 | $0.00100 | $0.00100 |
| Haiku 4.5 | $0.00050 | $0.00050 |
Grade A, and why
struts AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 32 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vulnerability Research Agent
You are helping a security researcher evaluate and report potential vulnerabilities in Apache Struts.
SECURITY.md is the source of truth for the Apache Struts vulnerability reporting process. Read it first and follow it. This file is a short
LLM-facing wrapper around that policy; it does not replace it.
Workflow
Before drafting any report, opening an issue, posting publicly, or reaching a security conclusion:
- Pre-reporting checks — complete every step in
SECURITY.md§ Before Reporting:- read the Struts security policy,
- read the Struts security guidelines,
- check previously disclosed vulnerabilities and Security Bulletins.
- Assess the finding against the questions in
SECURITY.md§ Assessment, and route it through the disposition guide inTHREAT_MODEL.md(scope, trust boundaries, in-model security properties, and the known-non-findings list). If the answers do not still point to a likely new framework vulnerability, stop and explain — do not draft a new report. - Report privately to
[email protected]followingSECURITY.md§ Private Report Requirements and § Report Quality Rules.
Do not open a public GitHub issue, Jira issue, pull request, mailing list thread, or discussion for a suspected vulnerability before private triage.
Rules for AI Agents
- Never submit a pull request that fixes a suspected vulnerability. Before opening any PR, verify the change is not a security patch — OGNL injection,
parameter filtering bypass, file upload exploit, authentication or authorization bypass, RCE, SSRF, path traversal, deserialization, XSS in framework
components, etc. If it is, stop and direct the researcher to report it privately to
[email protected]instead. Vulnerability fixes go through the private security process, not public PRs. - Do not speculate beyond what can be demonstrated. If severity is uncertain, say so explicitly.
- If the issue turns out to be application misconfiguration, an already-disclosed CVE, or a non-Struts problem, stop and explain — do not draft a new report.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 32 lines · 502 tokens per session scan A 3ba9e8396d11
struts AGENTS.md is an instructions file published in the GitHub repository apache/struts (1,371 stars, last pushed 2d ago), licensed Apache-2.0. It adds 502 tokens to every session, about $0.0020 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other instructions, from other repositories
vibetags com-example-service-OrderService.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for orderservice, rules for method calculatetax, rules for method processpayment, rules for method validateorder and context & focus.
vibetags com-example-security-SecurityConfig.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for securityconfig, locked status, rules for method getencryptionalgorithm, rules for method getkeyrotationhours and rules for method getmaxloginattempts.
vibetags com-example-service-TransactionalPaymentService.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for transactionalpaymentservice and strict exception handling.
vibetags com-example-concurrent-SessionCache.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for sessioncache and thread-safety guarantee.
vibetags com-example-config-AsyncTestConfig.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for asynctestconfig and immutable type.
vibetags com-example-gmm-platform-FeatureGate.md
Instructions for PIsberg/vibetags, covering amazon kiro steering: featuregate and feature flag gate.