Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/danafitkowski/cpp-cpm-engine/claude-mdgit clone --depth 1 https://github.com/danafitkowski/cpp-cpm-engineWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01668 | $0.01668 |
| Opus 5 | $0.00834 | $0.00834 |
| Sonnet 5 | $0.00334 | $0.00334 |
| Haiku 4.5 | $0.00167 | $0.00167 |
Grade A, and why
cpp-cpm-engine CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — Operating contract for cpp-cpm-engine releases
This file is the contract that the per-version AUDIT_LEDGER_v{X}.md files cite. It defines what "CLOSED" means, what hard-stop conditions block a release, and what the operator (a human or an AI agent like Claude Code) must do before claiming an audit row is closed.
If the ledger and this file disagree, this file wins. The ledger refers to this file; it does not redefine it.
1. Definition of Done (DoD) — the four criteria
A row in any AUDIT_LEDGER_v{X}.md may move to status CLOSED if and only if all four of the following are true:
- Code or doc change exists. A concrete, committable diff — a new file, an edit to an existing file, or a configuration change — addresses the finding. Adding the item to
ROADMAP_OPEN.mdis not a change for this purpose; it closes the meta-tracking task only. - Verification command provided. The ledger row's Verification command column contains a single shell or
nodecommand that an independent operator can run, in the repo root, to reproduce the verification. The command must exit non-zero on regression. - File read end-to-end after edit. After the diff is written, the author re-reads the touched file(s) from line 1 to EOF — not by
grep, not by pattern-match. This is the human-eye check that the change is internally consistent, that no leftover scaffolding remains, and that the surrounding context still parses. - Clean-window re-grep performed. From a fresh read, search every touched file for: outdated version strings, contradictory test counts / metric values, references to evidence packets or fixtures that do not exist on disk, and forbidden marketing language ("industry-first", "best-in-class", "revolutionary", "world-class", "game-changing", "unprecedented", "cutting-edge", "state-of-the-art"). Any finding downgrades the row to DEFERRED until resolved.
A row that satisfies 3 of 4 is not CLOSED. There is no partial credit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 115 lines · 1,668 tokens per session scan A 2673f085f758
cpp-cpm-engine CLAUDE.md is an instructions file published in the GitHub repository danafitkowski/cpp-cpm-engine (1 stars, last pushed 5d ago), licensed MIT. It adds 1,668 tokens to every session, about $0.0083 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
massing AGENTS.md
Instructions for ibuilder/massing, covering agents.md, cursor cloud specific instructions, what the update script already did, services (all run from source in dev) and node 24 gotcha (important).
opentakeoff AGENTS.md
Instructions for Kentucky-ai/opentakeoff, covering run / build / check, shipping — the required steps, every change, where things live, how the canvas works (the mental model) and conventions.
massing CLAUDE.md
Instructions for ibuilder/massing, covering project: massing, what this is, non-negotiables, stack and build order.
procore-mcp-server CLAUDE.md
Instructions for TylerIlunga/procore-mcp-server, covering procore mcp server, quick start, architecture, build pipeline and tool description quality.
roughlogic.com AGENTS.md
Instructions for clay-good/roughlogic.com, covering agents.md, what this repo is, use the calculators as an agent (the fast path), the repo map and how to add or change a calculator.
roughlogic.com CLAUDE.md
Instructions for clay-good/roughlogic.com: This project uses OpenLore for persistent architectural memory.