What is uv AGENTS.md?

Project-specific coding instructions for uv, a fast Python package and project manager written in Rust.

Guiding code changes, choosing between integration and unit tests, running focused checks, handling Rust linting, and updating the lockfile carefully.

They help keep changes consistent with the project's contribution rules and testing practices, while avoiding unsafe shortcuts and unnecessary dependency or build changes.

uv AGENTS.md — Instructions file by astral-sh

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/astral-sh/uv/agents-md

Clone the repo

git clone --depth 1 https://github.com/astral-sh/uv

Made for: Codex, OpenCode.

Per session 445 This file is loaded in full into every session.

When invoked 445 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00445	$0.00445
Opus 5	$0.00222	$0.00222
Sonnet 5	$0.00089	$0.00089
Haiku 4.5	$0.00044	$0.00044

Measured today against content hash e62d09731b95, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

uv AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 28 lines

What it actually says

Read CONTRIBUTING.md for guidelines on how to run tools
ALWAYS ensure that new tests use the same style as existing tests for all parts of the test
ALWAYS check whether the behavior of a new test is already covered by an existing test
PREFER integration tests, e.g., at it/... over unit tests
PREFER running specific tests over running the entire test suite
PREFER insta snapshots following patterns in nearby tests over substring assertions
When making changes for Windows from Unix, use cargo xwin clippy to check compilation
NEVER perform builds with the release profile, unless asked or reproducing performance issues
AVOID using panic!, unreachable!, .unwrap(), unsafe code, and clippy rule ignores
PREFER patterns like if let to handle fallibility
PREFER exhaustive match expressions without wildcard (_) arms over matches!, so new enum variants require explicit handling
ALWAYS write SAFETY comments following our usual style when writing unsafe code
PREFER #[expect()] over [allow()] if clippy must be disabled
PREFER let chains (if let combined with &&) over nested if let statements
NEVER update all dependencies in the lockfile and ALWAYS use cargo update --precise to make lockfile changes
NEVER assume clippy warnings or test failures are pre-existing, it is very rare that main has warnings
ALWAYS use .github/automations-dispatch.json to trigger privileged workflows from GitHub webhook events instead of adding pull_request_target workflows
NEVER suppress the dangerous-triggers security lint; extend the automation dispatcher in a separate pull request if it does not support the required event
PREFER top-level imports over local imports or fully qualified names
AVOID shortening variable names, e.g., use version instead of ver, and requires_python instead of rp
PREFER [TypeName] references when writing Rust doc comments

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +2 lines · +29 tokens per session e62d09731b95
yesterday First seen · 26 lines · 416 tokens per session scan A bb1f28e687cf

Subscribe to this mod's changes

uv AGENTS.md is an instructions file published in the GitHub repository astral-sh/uv (89,308 stars, last pushed today), licensed Apache-2.0. It adds 445 tokens to every session, about $0.0022 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Languages Project management packaging python resolver uv

uv AGENTS.md

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

What this file has done since we first saw it

Other instructions, from other repositories

librosa AGENTS.md

packrehearsal AGENTS.md

clawrium AGENTS.md

plane-cli AGENTS.md

agents

temple8 AGENTS.md