gate-mcp AGENTS.md

A set of AGENTS.md instructions for work on gate/gate-mcp, a project that connects coding agents to external tools and services. It records project facts, user preferences, API documentation rules, testing expectations, and implementation constraints.

In plain words
What is it for?
Use it when modifying gate-mcp documentation, OpenAPI files, authentication examples, rate limiting, metrics, generated APIs, or tests.
Why use it?
It gives the coding agent the project's established rules and technical context so future changes follow local conventions and avoid known mistakes.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/gate/gate-mcp/agents-md
Clone the repo
git clone --depth 1 https://github.com/gate/gate-mcp

Made for: Codex, OpenCode.

Per session 1,034 This file is loaded in full into every session.
When invoked 1,034 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01034 $0.01034
Opus 5 $0.00517 $0.00517
Sonnet 5 $0.00207 $0.00207
Haiku 4.5 $0.00103 $0.00103

Measured 2d ago against content hash 45056eccbf27, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

gate-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 31 lines

How it starts

The opening of the file, as written. The whole thing — 31 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Learned User Preferences

  • README 中不要将 mcporter 标注为「推荐」或 "Recommended"
  • gate-mcp 文档与 OAuth/客户端示例须与 gateapi-mcp-service 实现对齐;需认证的连接应使用私有端点 /mcp/exchange,勿将仅适合公开的 /mcp 用于 OAuth 流程示例
  • 将 .cursor/、.idea/、config/、scripts/ 添加到 .gitignore
  • gateapiv4 YAML CR 中发现的内部字段(如 create_user、update_user、update_time、show_status、show_page、warn_rate、finance_uid)直接移除,不使用 x-external: false 标记
  • gateapiv4 YAML 中 inline object 提取到同文件的 components/schemas,不提取到外部 definitions/ 文件
  • gateapiv4 YAML CR 修复时 create_time 和 status 字段视为对外字段需保留
  • 大型功能实现时,每个阶段(Phase)的内容必须独立闭环、可编译、可测试验证,不允许跨阶段留未闭合的依赖
  • 单元测试要求全面覆盖,目标覆盖率 ≥ 90%,所有方案中列出的测试系列须逐项实现
  • Go 限频相关代码修改后,须同时运行 go test -race 验证无竞态
  • gateapi-mcp-service 中 MainUID 获取不到时,直接使用用户 UID 作为 MainUID fallback,不阻塞请求
  • Prometheus metrics label 禁止使用含动态参数值的 resolved path(如 order_id、contract),必须使用 path_template 或 tool name 等固定基数标识

Learned Workspace Facts

  • gateapiv4 YAML 中 integer 字段若需表示大 ID(如条件单 order_id),必须显式添加 format: int64,否则 OpenAPI Generator 默认生成 int32 会溢出
  • MCP 工具的 body 参数 description 中,修改(amend/update)接口应显式警告 body 是扁平 JSON 结构,不是创建接口的嵌套结构(如 {initial, trigger}),避免 AI 客户端混淆
  • gateapi-mcp-service 限频系统采用三层分包架构:luaparse(Lua 解析)→ match(radix 匹配 + WBL)→ enforce(Redis EVAL 执行),解析器不做匹配、匹配器不解析 Lua、执行器不重复路径匹配
  • gateapi-mcp-service 与 apiv4-gateway 共享同一 Redis 令牌桶(同 key、同 token_bucket_script),MCP 侧 Redis key 拼接格式必须与 req_limiter.lua 逐字符一致
  • gateway-config 的 rate_limit_config.lua 当前含 42 个 limit_routers(41 个 allow=true)、70 条 limit_rules,支持 ip/user_id/spot_user_id_market/future_user_id_market 四种 limit_var
  • Global 规则(http_blacklist + 429 采样封禁)Redis key 统一前缀 mcp:global_limiter:,禁止与 token_bucket key 空间冲突
  • spot_user_id_market 路由需链式执行 3 次 Redis EVAL(UID → UID+market → MainUID+market),future_user_id_market 需 2 次,任一环节令牌耗尽短路 429 且已消耗令牌不退还
  • gatekeeper-go 内部接口 GET /users/:user_id(端口 8183)返回 main_uid 和 tier,失败时降级为 MainUID=UID+Tier=0 不阻塞
  • 限频 Lua 配置经 Nacos 下发,四层解析管线(P1 Precheck → P2 Lex → P3 Parse+Bind → P4 Validate)失败时保留 lastGood;limit_mode 缺省为 RESPECTIVE(与 req_limiter.lua 一致),DISTRIBUTED_SHARED 模式 key 不含 method/uri
  • OpenAPI 中同一 operation 若挂多个 tag,Go SDK 会为各 tag 生成独立 API 文件,但 *Opts 等类型名仍由 operationId 派生,易在单包内重复定义;应在 gateapiv4 YAML 中保证每个 operation 仅一个 tag 后重新生成 SDK,勿手工改 gateapi-go-internal
  • gateapi-mcp-service 限频系统新增 pathresolve 层:加载 config/interface.json 将 MCP tool name + arguments 解析为 HTTP path/method,用于 radix tree 匹配和 Redis key 拼接
  • observe 和 enforce 共享 BuildRequestView/ExtractClientIPFromHeader/ParseMainUID(位于 internal/ratelimit 包导出),禁止在 enforce 包中重复实现

Read the full file on GitHub · 31 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 31 lines · 1,034 tokens per session scan A 45056eccbf27

Subscribe to this mod's changes

gate-mcp AGENTS.md is an instructions file published in the GitHub repository gate/gate-mcp (37 stars, last pushed 25d ago), licensed MIT. It adds 1,034 tokens to every session, about $0.0052 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,182 tokens

buildNext

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

next.js AGENTS.md

Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens

spec-kit AGENTS.md

Instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,040 tokens

langchain AGENTS.md

Instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,345 tokens