agentmods.dev

aurora: Instructions file for Codex

AGENTS.md

aurora AGENTS.md is an instructions file for Codex, OpenCode from Arvo-AI/aurora. It costs 4,849 tokens per session, scanned E, original, Apache-2.0.

A repository guide for Aurora, including its architecture, development commands, Docker deployments, and Vault-based secret management. Docker packages applications and their services into repeatable containers.

In plain words
What is it for?
Use it when developing Aurora, starting or stopping its containers, rebuilding services, viewing logs, or preparing deployments.
Why use it?
It helps coding agents run the project, inspect services, and keep development and production configuration aligned.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is Arvo-AI/aurora's own configuration. It tells Codex and OpenCode how to work on aurora itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything aurora configures →

not rated 454repo +6 changed 1mo ago E scan 4,849 tokens original Apache-2.0
View source ↗ Arvo-AI/aurora aurorasre.ai
Reuse

Borrowing it

Nothing to install: this file belongs to Arvo-AI/aurora. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Arvo-AI/aurora/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/Arvo-AI/aurora

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for aurora AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/arvo-ai/aurora/agents-md/github.svg)](https://agentmods.dev/instructions/arvo-ai/aurora/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/arvo-ai/aurora/agents-md"><img src="https://agentmods.dev/badge/instructions/arvo-ai/aurora/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for aurora AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/arvo-ai/aurora/agents-md"><img src="https://agentmods.dev/badge/instructions/arvo-ai/aurora/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 4,849 This file is loaded in full into every session.
When invoked 4,849 The same file — it is already loaded in full.
Security scan E 4 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.04849 $0.04849
Opus 5.5 $0.01940 $0.01940
Sonnet 5.5 $0.00970 $0.00970
Haiku 4.5 $0.00485 $0.00485

Measured 1mo ago against content hash 205c098649fa, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade E, and why

aurora AGENTS.md scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Harvests environment variableshighData exfiltration

Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.

Options that dump secrets (`--with-decryption`, `--expand-keys`) are blocked

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

must fail in Ask mode. Conversely `rm -rf /` is caught by the denylist in *any*

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

denylist only covers the `base64|sh` / `curl|sh` / `bash -c` spellings.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- Subprocess calls (`subprocess.run`, `Popen`, etc.) must receive an explicit `env` parameter with only the variables they need — never inherit the full server environment.
AGENTS.md · 315 lines

How it starts

The opening of the file, as written. The whole thing — 315 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Aurora - Agent Guidelines

Commands

  • Start dev: make dev (builds & starts all containers)
  • Stop: make down
  • View logs: make logs (shows last 50 lines, follows)
  • Rebuild API: make rebuild-server (rebuild aurora-server only)
  • Frontend lint: cd client && npm run lint
  • Frontend build: cd client && npm run build
  • Backend logs: docker logs -f aurora-celery_worker-1 (or kubectl logs -f deployment/aurora-celery-worker)
  • Deploy with Docker Compose: make prod (production build)

Docker deployments

  • Development: Use make dev-build to build the project, make dev to start containers, and make down to stop them.
  • Production (prebuilt images): Use make prod-prebuilt to pull from GHCR, retag, and run. Use make prod-local to build from source instead. Use make down to stop.
  • Production (build from source): Use make prod-local or make prod-build for feature branch demos and custom builds.
  • Important: Always update both docker-compose.yaml and docker-compose.prod-local.yml together to keep environment variables in sync.

Architecture

  • Docker Compose stack: aurora-server (Flask API on :5080), celery_worker (background tasks), chatbot (WebSocket on :5006), frontend (Next.js on :3000), postgres (:5432), redis (:6379), vault (secrets :8200), seaweedfs (object storage :8333)
  • Backend (server/): Flask REST API (main_compute.py), WebSocket chatbot (main_chatbot.py), Celery tasks, connectors for GCP/AWS/Azure/Datadog/New Relic/Grafana, LangGraph agent workflow
  • Frontend (client/): Next.js 15, TypeScript, Tailwind CSS, shadcn/ui components, Auth.js authentication, path alias @/* → ./src/*
  • Database: PostgreSQL (aurora_db), Redis for Celery queue
  • Secrets: HashiCorp Vault (KV v2 engine at aurora mount)
  • Object Storage: S3-compatible via SeaweedFS (default), supports AWS S3, Cloudflare R2, MinIO, etc.
  • Config: Environment in ./.env, GCP service account in server/connectors/gcp_connector/*.json

Read the full file on GitHub · 315 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +161 lines · +2,135 tokens per session scan A → E 205c098649fa
  2. 1mo ago Changed · -17 tokens per session 9a8cd039afa7
  3. 2mo ago First seen · 154 lines · 2,731 tokens per session scan A 877d4f2ac892

Subscribe to this mod's changes

aurora AGENTS.md is an instructions file published in the GitHub repository Arvo-AI/aurora (454 stars, last pushed yesterday), licensed Apache-2.0. It adds 4,849 tokens to every session, about $0.0194 per session on Opus 5.5. A static security scan graded it E with 4 findings (harvests environment variables, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

DevOps and cloudaiopsawsazuredatadoggcp
Related

aurora AGENTS.md compared with instructions from other repositories

aurora AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
aurora AGENTS.mdArvo-AI/auroraInstructions file454yesterdayApache-2.0E4,849Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode