Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/colinhacks/zod/agents-mdgit clone --depth 1 https://github.com/colinhacks/zodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/colinhacks/zod/agents-md)<a href="https://agentmods.dev/instructions/colinhacks/zod/agents-md"><img src="https://agentmods.dev/badge/instructions/colinhacks/zod/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.05774 | $0.05774 |
| Opus 5 | $0.02887 | $0.02887 |
| Sonnet 5 | $0.01155 | $0.01155 |
| Haiku 4.5 | $0.00577 | $0.00577 |
Grade A, and why
zod AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Development Commands
The project uses pnpm workspaces. Key commands:
pnpm build- Build all packages (runs recursive build command)pnpm vitest run- Run all tests with Vitest. Includes the compile-mode project, which re-runs the zod tests with global AOT compilation enabled (seewiki/compile.md).pnpm vitest run <path>- Run specific test file (e.g.,packages/zod/src/v4/classic/tests/string.test.ts)pnpm vitest run <path> -t "<pattern>"- Run specific test(s) within a file (e.g.,-t "MAC")pnpm vitest run --update- Update all test snapshotspnpm vitest run <path> --update- Update snapshots for specific test filepnpm test:watch- Run tests in watch modepnpm vitest run --coverage- Run tests with coverage reportpnpm test:compile- Focused alias for just the compile-mode project. Already covered bypnpm test; use this when iterating on compile-related changes.pnpm dev- Execute code with tsx under source conditionspnpm dev <file>- Execute<file>with tsx & proper resolution conditions. Usually use forplay.ts.pnpm dev:play- Quick alias to run play.ts for experimentationpnpm check:comments- Fail on stacked//comment lines (--fixjoins them)pnpm lint- Run biome linter with auto-fixpnpm format- Format code with biomepnpm fix- Run both format and lint
Rules
- Node.js v24+ required (use nvm if needed); pnpm v10.12.1
- ES modules are used throughout (
"type": "module") - All tests must be written in TypeScript - never use JavaScript
- Use
play.tsfor quick experimentation; use proper tests for all permanent test cases - Features without tests are incomplete - every new feature or bug fix needs test coverage
- Don't skip tests due to type issues - fix the types instead
- Test both success and failure cases with edge cases
- Keep added tests as minimal and dense as possible without sacrificing comprehensiveness; avoid redundant assertions or broad fixtures when a focused case proves the behavior.
- No log statements (
console.log,debugger) in tests or production code - Never stack prose across consecutive
//lines. Lines have no maximum width here — the editor wraps for display — so a paragraph split across several//lines is just a hard-wrapped line, and hard wrapping breaks search, diffs and editing. Write one long//instead.pnpm check:commentsenforces this in pre-commit and CI;--fixjoins the offenders. Commented-out code,@ts-/@__NO_SIDE_EFFECTS__-style pragmas, bullet lists, and blocks separated by a bare//are exempt. When two adjacent comments describe two different statements, separate them with a blank line rather than joining them. - Keep comments SHORT AND TIGHT — one lowercase sentence fragment, one clause, no trailing period. Never a capitalized full sentence, and never two of them. Extreme concision: say only what the code cannot say, and cut the setup sentence, the recap, and the same point restated in different words; a comment that needs three sentences usually means the code should be clearer. Identifiers keep their real casing (
Error,parse()), only the prose is lowercase. - Ask before generating new files
- Use
util.defineLazy()for computed properties to avoid circular dependencies - Never branch on specific schema types in shared code. No
def.type === "optional"conditionals, no hardcoded lists of wrapper type names, no walks up the wrapper chain hunting for a particular type. Every schema type added later silently falls through such a check, and the list is wrong the moment someone writes a new wrapper. When a shared path needs to know something about a schema, express it as a structural property on the internals —optin/optout,values,pattern,propValues— and let each type declare its own answer. This is not negotiable in the parse paths; a PR that adds edge-case conditional logic keyed on schema types will be rejected regardless of how well it is tested. - Performance is critical - parameter reassignment is allowed for optimization
- Any change to
packages/zod/srcmust be weighed on all three axes: runtime performance, memory consumption, and bundle size — see "The three axes" below. A change that improves one and is only checked on that one is not finished. - ALWAYS use the
ghCLI to fetch GitHub information (issues, PRs, etc.) instead of relying on web search or assumptions - Keep JSDoc as minimal as possible. A self-explanatory type or symbol name needs no doc comment. When a comment is genuinely required, write one short sentence describing behavior — not history, rationale, or examples. Don't add interface-level JSDoc that just restates the interface name.
- When you've modified a PR (or opened/closed/commented on one), include the PR URL liberally in summary messages — at minimum once at the end of any reply that touched it
- When creating a PR, do not include a separate test plan section in the body. Link to any relevant issues under discussion, and use the same copywriting guidelines from "Commenting on issues and PRs": concise maintainer voice, prose over templates, and validation details only when they are material to the reader.
- Format validators (
z.iso.*,z.email(),z.url(),z.uuid(), …) are deliberately narrower than the specs they're named after. "The spec allows X" is not a reason to accept X — see "Format validators: spec compliance is not the bar" below. - NEVER bump the version in
packages/zod/package.json(or any package'spackage.json). A version bump is the only thing that triggers a release; everything else (including direct pushes tomain) is recoverable until that happens. If a version bump is genuinely needed, ask first.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 216 lines · 5,774 tokens per session scan A 2a47d6886e23
zod AGENTS.md is an instructions file published in the GitHub repository colinhacks/zod (43,628 stars, last pushed 4d ago), licensed MIT. It adds 5,774 tokens to every session, about $0.0289 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
zod-skill AGENTS.md
Instructions for anivar/zod-skill, covering zod v4 — complete guide, abstract, 1. parsing & type safety, rule: use safeparse() for user input and rule: use parseasync for async refinements.
react-seed AGENTS.md
Instructions for guokaigdg/react-seed, covering agents.md, 目录, 1. 项目概览, 2. 技术栈 and 3. 目录结构.
persian-tools typescript.instructions.md
Instructions for persian-tools/persian-tools, covering typescript development instructions, typescript best practices for persian-tools, type safety, function signatures and type definitions.
agentic-playwright enums.instructions.md
Instructions for idavidov13/agentic-playwright, covering enums, critical, file locations, instructions and phase 1: decide if the value belongs in an enum.
ui-extensions-sdk CLAUDE.md
Instructions for contentful/ui-extensions-sdk, covering claude project instructions — ui-extensions-sdk, identity & scope, working style, sharp edges and verification before claiming done.
hana-developer-cli-tool-example mcp-server-development.instructions.md
Use when creating or updating MCP (Model Context Protocol) server components. Enforces TypeScript patterns, JSON-RPC communication rules, tool/resource/prompt registration, and integration with CLI command metadata. Ensures MCP server follows protocol requirements and maintains consistency with the CLI infrastructure.