agent-kudos: Instructions file for Codex

AGENTS.md

agent-kudos AGENTS.md is an instructions file for Codex, OpenCode from Coaden/agent-kudos. It costs 515 tokens per session, scanned A, original, MIT.

Repository instructions that define how contributors and coding agents should work on the agent-kudos TypeScript package.

In plain words
What is it for?
Use them when changing the repository, especially for architecture, security, tests, storage, or release-related work.
Why use it?
They prevent architectural mistakes, unsafe changes, and accidental publication or exposure of local data.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is Coaden/agent-kudos's own configuration. It tells Codex and OpenCode how to work on agent-kudos itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything agent-kudos configures →

Reuse

Borrowing it

Nothing to install: this file belongs to Coaden/agent-kudos. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Coaden/agent-kudos/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/Coaden/agent-kudos

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for agent-kudos AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/coaden/agent-kudos/agents-md/github.svg)](https://agentmods.dev/instructions/coaden/agent-kudos/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/coaden/agent-kudos/agents-md"><img src="https://agentmods.dev/badge/instructions/coaden/agent-kudos/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for agent-kudos AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/coaden/agent-kudos/agents-md"><img src="https://agentmods.dev/badge/instructions/coaden/agent-kudos/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 515 This file is loaded in full into every session.
When invoked 515 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00515 $0.00515
Opus 5.5 $0.00206 $0.00206
Sonnet 5.5 $0.00103 $0.00103
Haiku 4.5 $0.00052 $0.00052

Measured 2mo ago against content hash f430f958d0de, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

agent-kudos AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 43 lines

How it starts

The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This repository is a public TypeScript package. Changes should be reviewable, portable, secure by default, and appropriate for an OSS audience.

Working agreement

  • Read docs/plan.md, ARCHITECTURE.md, and SECURITY.md before architectural changes.
  • Use Node.js 22.13 or newer, ESM, strict TypeScript, and the built-in node:sqlite API.
  • Keep V1 single-machine and local-first. Do not add hosted services, telemetry, accounts, network listeners, or postinstall behavior.
  • Do not publish packages, create releases, alter npm configuration, or write into a user’s real ~/.agents directory without explicit authorization.
  • Tests and demos must use isolated temporary homes.
  • Never commit real kudos data, SQLite databases, environment files, secrets, generated coverage, or npm tarballs.

Architectural invariants

  • SQLite event rows are canonical and append-only. State changes are new events.
  • Agent IDs are validated stable identities; aliases never silently merge identities.
  • MCP writes use the actor bound at server startup. Tool arguments cannot override it.
  • WINS.md, inbox files, and profile.json are generated projections. NOTES.md is human-owned and must never be overwritten.
  • Machine reads stay context-bounded: compact list/change feeds have conservative defaults, hard limits, byte budgets, and opaque cursors. WINS.md is not a machine query source.
  • Projection cleanup may remove only regular files listed in the generated-files manifest.
  • Normal mutations must not rebuild or rewrite every pending inbox entry; full regeneration belongs to the explicit rebuild operation.
  • system actors are automation identities and have no implicit agent or administrative authority.
  • Raw JSON/JSONL export must remain available when canonical rows are unsupported or malformed; writes must fail closed across unknown event semantics.
  • Do not follow symlinks outside the configured home.
  • Evidence is descriptive metadata, never captured tool output or secret material.
  • No filesystem work occurs at module import time, and library code never calls process.exit().

Read the full file on GitHub · 43 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 43 lines · 515 tokens per session scan A f430f958d0de

Subscribe to this mod's changes

agent-kudos AGENTS.md is an instructions file published in the GitHub repository Coaden/agent-kudos (0 stars, last pushed 8d ago), licensed MIT. It adds 515 tokens to every session, about $0.0021 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

agent-kudos AGENTS.md compared with instructions from other repositories

agent-kudos AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
agent-kudos AGENTS.mdCoaden/agent-kudosInstructions file08d agoMITA515Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode