Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/ericdrowell/brometal/claude-mdgit clone --depth 1 https://github.com/ericdrowell/brometalWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01099 | $0.01099 |
| Opus 5 | $0.00549 | $0.00549 |
| Sonnet 5 | $0.00220 | $0.00220 |
| Haiku 4.5 | $0.00110 | $0.00110 |
Grade A, and why
brometal CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working on BroMetal
Instructions for Claude working on this repository. If you are writing an app
that uses BroMetal, read packages/brometal/AGENTS.md
instead.
Start with AGENTS.md at this root — it covers the layout, the
commands, and the failure modes that have bitten before. This file adds the
things that are easy to skip.
Always update the changelog
Any change under packages/brometal/ gets a CHANGELOG.md entry in the same
change. Not at release time, not "later" — now, while you still remember why.
The log currently jumps from ## Unreleased straight to 0.7.0. Versions 0.8
through 0.12 shipped with no entries at all, because writing them was a separate
step that got skipped. That is the failure this rule exists to prevent.
Add to the ## Unreleased section at the top. Never write a version number —
the version is not chosen until npm run release runs, and the release script
promotes ## Unreleased to ## <version> (<date>) and opens a fresh empty one.
There are exactly three sections, and they always appear in this order:
### Added— new API surface### Improved— existing behaviour made better, including breaking changes### Fixed— a bug that shipped
There is no Changed. Every change is an addition, an improvement, or a fix.
Never create a second section with the same name. Add your bullet to the
existing ### Added / ### Improved / ### Fixed, creating it only if absent.
Appending a fresh ### Added at the bottom of the section is the easy mistake —
it renders as two separate lists and the reader cannot tell why.
Mark anything source-incompatible Breaking, in Improved, and say what to do
instead.
Changes that do not need an entry: website content, README edits, tests, comments, and internal refactors with no behavioural difference.
Only edit the root file
/CHANGELOG.md is the source of truth. Two things derive from it:
- The website (
/changelog) parses the root file at build time. No copy exists, so it cannot drift. packages/brometal/CHANGELOG.mdis a copy written bynpm run sync:examples, so the file is readable fromnode_modules. Never edit it — the next sync overwrites it silently. It is committed rather than gitignored because npm falls back to.gitignorein the absence of an.npmignore, and an ignored file would not ship.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 112 lines · 1,099 tokens per session scan A 9364806d90c5
brometal CLAUDE.md is an instructions file published in the GitHub repository ericdrowell/brometal (104 stars, last pushed 17d ago), licensed MIT. It adds 1,099 tokens to every session, about $0.0055 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
oxc AGENTS.md
Instructions for oxc-project/oxc, covering agents.md - ai assistant guide for oxc, ai usage policy for contributors, repository structure, core crates and development commands.
compiler-explorer AGENTS.md
Instructions for compiler-explorer/compiler-explorer, covering agents.md, build & test commands, important workflow requirements, style guidelines and architecture guidelines.
oxc copilot-instructions.md
Instructions for oxc-project/oxc: When reviewing pull requests in this repository.
compiler-explorer copilot-instructions.md
Instructions for compiler-explorer/compiler-explorer: For each answer to the user, evaluate your level of confidence in the correctness of the answer on a scale from 1 to 10, where 1 is very uncertain and 10 is absolutely certain. If your confidence level is below 8, state so and suggest ways to verify the answer.
grida AGENTS.md
Instructions for gridaco/grida, covering hi robots, welcome to the grida project, project structure, languages, frameworks, tools, infrastructures, documentation and the rust engine — moved to gridaco/nothing.
neva AGENTS.md
AGENTS.md instructions for nevalang/neva, covering neva engineering guide, project model, repository map, documentation and ai engineering harness.