What is studio AGENTS.md?

A repository guide for Studio, an open-source control layer that manages authentication, routing, and monitoring between MCP clients and MCP servers. It explains the project structure and commands for its TypeScript, React, and API components; a monorepo is one repository containing several related applications or packages.

Use it when exploring Studio, starting its client and server, running database migrations, or making changes across its web and API packages.

It tells coding agents which documentation describes the intended design and how to start the full development environment or individual parts.

How decocms/studio configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to decocms/studio. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/decocms/studio/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/decocms/studio

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/decocms/studio/agents-md/github.svg)](https://agentmods.dev/instructions/decocms/studio/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/decocms/studio/agents-md"><img src="https://agentmods.dev/badge/instructions/decocms/studio/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/decocms/studio/agents-md"><img src="https://agentmods.dev/badge/instructions/decocms/studio/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 1,365 This file is loaded in full into every session.

When invoked 1,365 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01365	$0.01365
Opus 5.5	$0.00546	$0.00546
Sonnet 5.5	$0.00273	$0.00273
Haiku 4.5	$0.00136	$0.00136

Measured 22d ago against content hash ea25c41e6c3b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

studio AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 114 lines

How it starts

The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Studio

Studio is an open-source AI platform that connects models and agents to an organization’s data, tools, and workflows. It provides the common infrastructure for building specialized business applications, including storefront solutions. Authentication, MCP connectivity, monitoring, and cost controls belong to the platform so each application can focus on the work its users need to do.

Before changing code

Read the guidance for each area your change touches, including when working from the repository root:

When changing	Read first
API tools, routes, storage, or realtime delivery	apps/api/AGENTS.md
Web UI, localization, or experiments	apps/web/AGENTS.md
Shared contracts, organization flags, or async utilities	packages/shared/AGENTS.md
Sandbox provisioning, dispatch, caching, or daemon	packages/sandbox/AGENTS.md
Lint rules, lint configuration, or oxlint version	plugins/AGENTS.md
MCP bindings	packages/bindings/README.md
Tests	TESTING.md; for E2E, also packages/e2e/README.md

Working locally

Use docker compose up --build --watch (bun run dev) for API + web development. Compose owns PostgreSQL, NATS, object storage, and startup migrations; source syncs into containers while dependencies stay in the image. Do not add managed service downloads or process supervision to the CLI. Frontend-only and local Kubernetes workflows remain available. CONTRIBUTING.md owns setup, worktree isolation, and lifecycle commands; workspace READMEs own builds.

Before pushing, run bun run verify and include any formatting changes in the commit. CI runs the broader checks. Run focused integration or E2E tests when the changed behavior needs them, following TESTING.md.

Investigate failing checks. Before calling a failure pre-existing, reproduce it on the base revision or provide equivalent evidence. Report what passed, what failed, and what was not run.

Read the full file on GitHub · 114 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

22d ago Changed · +2 lines · +32 tokens per session ea25c41e6c3b
1mo ago Changed · +6 lines · +60 tokens per session 938940f95ce5
1mo ago Changed · +6 lines · +83 tokens per session 48b63cdb5cb7
1mo ago Changed · -672 lines · -9,343 tokens per session c9cae450932c
1mo ago Changed · +29 lines · +453 tokens per session 7babd1d6f4d0
1mo ago Changed · +13 lines · +282 tokens per session 40f3c6f2e184
1mo ago Changed · +72 tokens per session 6f0cfc22de2b
1mo ago Changed · +12 lines · +305 tokens per session 84b01f152741
1mo ago Changed · +33 lines · +521 tokens per session bff3a59d408d
2mo ago First seen · 685 lines · 8,900 tokens per session scan A 8004f1291e78

Subscribe to this mod's changes

studio AGENTS.md is an instructions file published in the GitHub repository decocms/studio (415 stars, last pushed yesterday), licensed MIT. It adds 1,365 tokens to every session, about $0.0055 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

LLM agents ai deco mcp mcp-client

studio AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
studio AGENTS.mddecocms/studio	Instructions file	415	yesterday	MIT	A	1,365	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	today	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

studio: Instructions file for Codex