Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/drbaher/sign-cli/agents-mdgit clone --depth 1 https://github.com/DrBaher/sign-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01179 | $0.01179 |
| Opus 5 | $0.00589 | $0.00589 |
| Sonnet 5 | $0.00236 | $0.00236 |
| Haiku 4.5 | $0.00118 | $0.00118 |
Grade A, and why
sign-cli AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agents
Drive sign-cli from an LLM or non-interactive client. This is the quickstart; the full canonical reference is docs/agent-guide.md.
Output contract
- Success: JSON to stdout, exit
0. - Failure:
{ ok: false, error: { code, message, hint?, details? } }to stderr, non-zero exit. - Toggle to plain text:
SIGN_ERROR_FORMAT=text.
Exit codes
| Code | Meaning |
|---|---|
0 |
Success |
2 |
Invalid input (missing/malformed flag, schema fail) |
3 |
Policy / chain / verification failed |
4 |
Not found / out of range |
Full code table and the failure-mode → recovery map: docs/reference/exit-codes.md.
Discovery
Never hardcode tool names, flag lists, or counts — call these at startup:
sign --catalog json # full CLI command + flag inventory
sign mcp tools # live MCP tool catalog (with inputSchema/outputSchema)
sign --version
The signing asymmetry
The whole architecture is built around one rule: the agent does every step except the signing gesture. sign (CLI / MCP tool / POST /v1/sign) requires a per-signer token that's scoped to one email, TTL-bounded, single-use. The requester (which can be the agent) holds and DMs the token to the human signer; the signer pastes it into sign sign --token .... The agent never sees signer tokens.
Pre-sign safety checks (--require-hash, --require-title, --require-signer-email) throw structured errors before any state mutation, so an agent computing a hash earlier can refuse to sign if the document was swapped in flight.
Read-only mode
For sandboxed agents that should inspect and track but not mutate:
sign mcp serve --read-only true \
--tool request_show --tool audit_verify --tool pdf_detect_signature_field
sign serve --read-only true --rate-limit 5
Mutating tools/routes return FORBIDDEN_READ_ONLY (exit 3 / HTTP 403). The set is in READ_ONLY_BLOCKED_TOOLS and READ_ONLY_BLOCKED_ROUTES in the source.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 90 lines · 1,179 tokens per session scan A b452a009fe16
sign-cli AGENTS.md is an instructions file published in the GitHub repository DrBaher/sign-cli (0 stars, last pushed 1mo ago), licensed MIT. It adds 1,179 tokens to every session, about $0.0059 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
accessflow CLAUDE.md
Instructions for bablsoft/accessflow, covering claude.md — accessflow agent rules, project at a glance, repository layout, backend and runtime & framework versions.
hardened-images CLAUDE.md
Instructions for konstruktoid/hardened-images, covering claude.md, project overview, commands, architecture and agent skills and instructions.
blueclaw AGENTS.md
Instructions for yeomyeonggeori/blueclaw, covering agents.md, core principles, single source of truth, working on this repository and branch names.
sysknife CLAUDE.md
Instructions for lacs-project/sysknife, covering sysknife operating notes, current focus — ubuntu; gui paused, pre-commit gate, repository workflow and worktree convention.
claude-standing-orders CLAUDE.md
Instructions for bhuiyanmobasshir94/claude-standing-orders, covering claude-standing-orders, product references are not this repo's own usage, conventions, after changing anything under user/ and verifying a change.
ATF-AI copilot-instructions.md
Instructions for agronetlabs/ATF-AI, covering atf-ai repository instructions for github copilot, governance boundary, core vs. adapter changes, rwa privileged actions and security.