agentmods.dev

anjian-agent: Instructions file for Claude Code

CLAUDE.md

anjian-agent CLAUDE.md is an instructions file for Claude Code from ck3938700-ship-it/anjian-agent. It costs 1,058 tokens per session, scanned A, original, MIT.

Project instructions for Claude Code that describe a local security-assessment tool, its design, and rules for authorized testing.

In plain words
What is it for?
Use them when maintaining the tool's Python application, scanner, evidence handling, agent integrations, reports, or Claude Code setup.
Why use it?
They give future coding sessions the product context and safety boundaries needed to make changes without weakening access controls or storing sensitive data.

Instructions file for Claude Code

Written for Claude Code: the file is CLAUDE.md. Also seen: mentions Claude Code.

This is ck3938700-ship-it/anjian-agent's own configuration. It tells Claude Code how to work on anjian-agent itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything anjian-agent configures →

not rated 0repo 1mo ago A scan 1,058 tokens original MIT
View source ↗ ck3938700-ship-it/anjian-agent
Reuse

Borrowing it

Nothing to install: this file belongs to ck3938700-ship-it/anjian-agent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ck3938700-ship-it/anjian-agent/main/CLAUDE.md
Clone the repo
git clone --depth 1 https://github.com/ck3938700-ship-it/anjian-agent

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for anjian-agent CLAUDE.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ck3938700-ship-it/anjian-agent/claude-md/github.svg)](https://agentmods.dev/instructions/ck3938700-ship-it/anjian-agent/claude-md)
Your own site
<a href="https://agentmods.dev/instructions/ck3938700-ship-it/anjian-agent/claude-md"><img src="https://agentmods.dev/badge/instructions/ck3938700-ship-it/anjian-agent/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for anjian-agent CLAUDE.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/ck3938700-ship-it/anjian-agent/claude-md"><img src="https://agentmods.dev/badge/instructions/ck3938700-ship-it/anjian-agent/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,058 This file is loaded in full into every session.
When invoked 1,058 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01058 $0.01058
Opus 5 $0.00529 $0.00529
Sonnet 5 $0.00212 $0.00212
Haiku 4.5 $0.00106 $0.00106

Measured 10d ago against content hash c35f5d3191ab, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

anjian-agent CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 67 lines

What it actually says

Claude Code 维护上下文：安鉴台

你正在维护一个本地优先、授权门禁的安全评估交付工具。用户是一名信息安全专业大学生，主要运行环境是 Windows 11，长期使用 Obsidian，并可能用 Claude Code CLI 继续开发。

产品目标

帮助用户把“小型网站安全基线评估”做成可信的收费交付：范围清晰、过程留痕、自动结果需人工确认、报告可读、支持复测。不要把产品扩张成攻击框架或全网扫描器。

当前版本的主入口是可安装 Python CLI + stdio MCP Server；浏览器工作台与本地大模型适配器同时保留。

不可破坏的安全原则

  1. 所有主动网络访问必须绑定数据库中的明确目标与明确端口。
  2. 必须存在非空授权依据，每次运行前必须再次确认。
  3. 内网、本机、保留、链路本地等地址默认阻止，只有范围显式允许时才能访问。
  4. 禁止新增口令爆破、凭据填充、拒绝服务、绕过授权、漏洞利用、持久化、隐蔽或批量公网扫描能力。
  5. 不保存响应正文、Cookie 值、Authorization 头、口令、令牌或与发现无关的个人信息。
  6. 自动结果只能是 observation；必须由用户明确操作才能成为正式 finding。
  7. 新增网络功能时先写滥用分析、范围约束和本机测试，再实现代码。
  8. Burp/HAR/PCAP/源码证据必须脱敏；不得持久化秘密值、认证头、正文或 PCAP 载荷。
  9. SQLMap/FFUF/Nuclei 必须终端按工具授权，固定有界参数，不能接受任意命令行参数。

技术结构

  • src/anjian/app.py：FastAPI 页面与工作流
  • src/anjian/db.py：SQLite schema 和轻量数据访问
  • src/anjian/scanner.py：低影响检查与范围门禁
  • src/anjian/agent/：Claude 代理工作区、严格 scope、工具适配、结果归一化与报告
  • src/anjian/agent/evidence.py：Burp/HAR 脱敏导入与 TShark 指定 PCAP 分析
  • src/anjian/agent/code_scan.py：内置与外部源码扫描适配
  • src/anjian/agent/correlation.py：跨运行去重与多来源交叉印证
  • src/anjian/mcp_server.py：Claude Code 结构化 MCP 工具和 Prompt
  • claude-integration/：用户级 MCP 注册脚本与可选 Skill
  • src/anjian/reporting.py：Markdown/Obsidian 导出
  • src/anjian/templates/：Jinja2 页面和打印报告
  • tests/：pytest 测试；网络测试只能指向测试进程拥有的 127.0.0.1

每次修改的完成标准

.\.venv\Scripts\python.exe -m pytest
  • 测试全通过
  • start.cmd 能启动，http://127.0.0.1:8765/health 返回 ok
  • 不放宽授权门禁
  • 不把客户数据、data/、报告导出或虚拟环境提交 Git
  • 数据表修改要提供向后兼容迁移，不能让既有 anjian.db 无法使用
  • 面向用户的文字优先使用清楚的中文

推荐开发顺序

  1. 备份与加密提醒、按项目保留期限列出待清理数据
  2. 报告版本冻结与 SHA-256 摘要
  3. 复测记录独立于原检查记录
  4. 可配置的人工检查清单和 OWASP ASVS 5.0.0 引用
  5. 客户可读的单项目静态 HTML 交付包
  6. 最后才考虑新检查项；每一项都必须能解释误报、证据与业务意义

不要做的“看似高级”改动

  • 不要默认监听 0.0.0.0，本地工具只监听 127.0.0.1
  • 不要引入云端账号、遥测或在线 AI 依赖
  • 不要自动生成夸大风险的漏洞描述
  • 不要在没有数据库迁移方案时换 ORM
  • 不要为了炫技重写为前后端分离；当前单体结构更适合个人长期维护
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 67 lines · 1,058 tokens per session scan A c35f5d3191ab

Subscribe to this mod's changes

anjian-agent CLAUDE.md is an instructions file published in the GitHub repository ck3938700-ship-it/anjian-agent (0 stars, last pushed 1mo ago), licensed MIT. It adds 1,058 tokens to every session, about $0.0053 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude CodeSecuritycybersecuritylocal-llmmcpmodel-context-protocolollama
Related

Other instructions, from other repositories

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,469 tokens