Borrowing it
Nothing to install: this file belongs to DeliciousBuding/fund-dashboard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/DeliciousBuding/fund-dashboard/main/AGENTS.mdgit clone --depth 1 https://github.com/DeliciousBuding/fund-dashboardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/deliciousbuding/fund-dashboard/agents-md)<a href="https://agentmods.dev/instructions/deliciousbuding/fund-dashboard/agents-md"><img src="https://agentmods.dev/badge/instructions/deliciousbuding/fund-dashboard/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01643 | $0.01643 |
| Opus 5 | $0.00822 | $0.00822 |
| Sonnet 5 | $0.00329 | $0.00329 |
| Haiku 4.5 | $0.00164 | $0.00164 |
Grade A, and why
fund-dashboard AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — Fund Dashboard
最后更新：2026-08-30 23:53
所有 AI agent（Claude Code / Codex / Cursor）在本文档仓库遵守的共享约束。 开源公开仓库。禁止提交任何主机名、公网 IP、真实密钥、个人邮箱或本地路径。 产品：个人投资组合工作台（公网暴露形态）—— Web UI（session 登录）+ REST API + MCP server。基金 / 股票持仓、净值追踪、XIRR、穿透分析、回测、定投、系统工作台。 本仓库 = Go 后端 +
web/前端（go:embed 内嵌单二进制）+ zod 契约。设计定档docs/design/（W0–W7 已实施）。
S.U.P.E.R 设计原则
| 原则 | 仓库内检查标准 |
|---|---|
| Single Purpose | 路由只做协议适配；业务进 internal/service；数据访问进 internal/repository |
| Unidirectional | datasource/repository → service → REST/MCP/UI，禁止反向依赖和跨层旁路 |
| Ports over Implementation | REST 与 MCP 共用 service；SQLite/PG 经统一 repository/dialect 契约 |
| Environment-Agnostic | 主机、域名、密钥和部署拓扑只从环境/私有运维面注入，公开仓不固化 live 值 |
| Replaceable | 前端、数据源、数据库驱动、边缘代理均通过明确边界可替换，不改核心业务语义 |
项目骨架
- 入口：
cmd/fund-dashboard - 业务：
internal/（分层主干见docs/ARCHITECTURE.md§2；完整包以go list ./internal/...为权威） - 契约：
packages/contracts（zod，前后端共享的 API 契约 SSOT） - 部署：
deploy/Dockerfile（三阶段：web 构建 → Go 静态二进制含内嵌 SPA）·deploy/docker-compose.ci.yml（CI smoke） - 文档：
docs/{ARCHITECTURE,TESTING}.md·CHANGELOG.md·CONTRIBUTING.md - 前端：
web/（React 19 + Vite 7 + Tailwind v4 + TanStack + ECharts；路由懒加载 + echarts 分包；设计定档docs/design/）
鉴权边界
| 面 | 鉴权 | 说明 |
|---|---|---|
/api/admin/* |
Authorization: Bearer MCP_API_KEY |
空 key fail-closed |
/mcp |
静态 key：MCP_API_KEY → Operator；PUBLIC_MCP_KEY → Analyst。或 OAuth 访问令牌（ES256 JWT，aud = <issuer>/mcp）：fund.read → Analyst，fund.write → Operator |
双空且 OAuth 关闭时 fail-closed；作用域→角色映射单一来源（oauth.RoleForScopes），设计见 docs/design/07 |
/.well-known/oauth-*、`/oauth/token |
register | revoke |
/oauth/authorize、/oauth/consent |
复用 fund_session cookie；无会话 → 302 /login?next=…（回跳目标规范化后二次校验 /oauth/ 前缀） |
同意页带一次性 consent_token（10min、单次消费），零 JS / 零内联样式以符合既有 CSP |
| MCP 写工具 | confirmation_id + confirmation_token |
拒绝 bare confirmed=true |
| 浏览器读/写 | session cookie（argon2id 登录，滑动续约）；写加 X-Fund-Request 头 + Origin 白名单 |
设计见 docs/design/04 |
| 前端写路径（兼容层，默认关闭） | edge proxy 注入 X-Fund-Edge-Key（FUND_EDGE_KEY）；需显式 FUND_EDGE_AUTH_ENABLED=true 才生效 |
浏览器 JS 不持 key（会话写路径优先） |
全 /api/* |
per-IP 限流（FUND_API_RPM）；/mcp per-key（FUND_MCP_RPM）；/oauth/* per-IP（FUND_OAUTH_RPM） |
公网加固见 docs/design/06 |
/api/health |
匿名 | 生产省略 version |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +2 lines · +327 tokens per session 4add0cd89b99
- 5d ago First seen · 87 lines · 1,316 tokens per session scan A 3486fa966882
fund-dashboard AGENTS.md is an instructions file published in the GitHub repository DeliciousBuding/fund-dashboard (0 stars, last pushed 2d ago), licensed Apache-2.0. It adds 1,643 tokens to every session, about $0.0082 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.