Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/dend/guildbridge/claude-mdgit clone --depth 1 https://github.com/dend/guildbridgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01065 | $0.01065 |
| Opus 5 | $0.00532 | $0.00532 |
| Sonnet 5 | $0.00213 | $0.00213 |
| Haiku 4.5 | $0.00106 | $0.00106 |
Grade A, and why
guildbridge CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
Build & Check Commands
npm run dev— Start local dev server (port 8788)npm run deploy— Deploy to Cloudflare Workersnpm run type-check— Runtsc --noEmit(no test suite exists)
Project Overview
GuildBridge is a remote MCP server deployed on Cloudflare Workers. It exposes Discord operations (read, search, post messages) as MCP tools. Authentication is via Discord OAuth; all Discord API calls use a bot token.
Architecture
src/index.ts— MCP server definition, tool handlers, access control logic (guild + channel)src/discord-api.ts— Discord REST API wrappers, types, and permission computationsrc/discord-handler.ts— Discord OAuth flow (Hono routes)src/utils.ts— OAuth token exchange helpers,Propstype (user identity stored in auth token)src/workers-oauth-utils.ts— CSRF/session/state managementsrc/cf-access.ts— Cloudflare Access JWT validation middlewaresrc/admin.ts— Admin panel UI + API: Allowlist tab (KV), Activity tab (D1 audit log)src/audit.ts— Tool-call audit: dual-write to D1 + Analytics Engine
Key Design Decisions
Access control is two-layered
- Guild membership — checked via the user's OAuth access token (
listUserGuilds). Cached 60s. - Channel visibility — computed using Discord's permission algorithm (
computePermissions). Uses bot token to fetch guild roles, member roles, and channel permission overwrites. Cached 60s per guild.
Bot token vs user token
All Discord API calls use the bot token. The user's OAuth token is only used to verify guild membership (/users/@me/guilds with Bearer auth). This means the bot must be in any guild the user wants to access.
Permission computation follows Discord's algorithm
computePermissions in discord-api.ts implements the standard Discord permission resolution:
- Start with @everyone role permissions
- OR in member's role permissions
- Short-circuit if ADMINISTRATOR
- Apply channel-level overwrites: @everyone → roles → member-specific Guild owners bypass permission checks entirely.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 71 lines · 1,065 tokens per session scan A a9dba39d9b65
guildbridge CLAUDE.md is an instructions file published in the GitHub repository dend/guildbridge (16 stars, last pushed 4mo ago), licensed MIT. It adds 1,065 tokens to every session, about $0.0053 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
thalovant-mcp AGENTS.md
AGENTS.md instructions for thalovant/thalovant-mcp: This repository is a first-class consumer of the Thalovant control-plane and hub runtime APIs. Read the platform contracts in ../infra-manifests/docs/thalovant-platform/ when available.
prism-mcp CLAUDE.md
Claude Code instructions for skyphusion-labs/prism-mcp, covering claude.md, what this is, relation to the stack, commands and deploy model.
discord-mcp AGENTS.md
Instructions for cappyeo/discord-mcp, covering agents.md, 1. think before coding, 2. simplicity first, 3. surgical changes and 4. goal-driven execution.
mcp-agent-hub AGENTS.md
AGENTS.md instructions for avdiam/mcp-agent-hub, covering claude.md, what this is, current status: v1 feature-complete (2026-06-18), session continuity — read these first every session and layout (actual).
dataworkers-claw-community CLAUDE.md
Claude Code instructions for DataWorkersProject/dataworkers-claw-community, covering dataworkers — ai agent platform for data engineering, quick start, architecture, 10 mcp servers and seed data (demo tenant: cust-001).
dataworkers-claw-community AGENTS.md
AGENTS.md instructions for DataWorkersProject/dataworkers-claw-community, covering data workers — agent instructions, what this repository is, the agents, working in this codebase and working with your data (as an agent using these tools).