vrchat-assistant AGENTS.md

vrchat-assistant AGENTS.md is an instructions file for Codex, OpenCode from ggg123124/vrchat-assistant. It costs 7,320 tokens per session, scanned B, original, MIT.

A repository instruction guide for a Node.js service that monitors VRChat friends’ online activity and stores related history. VRChat is a social virtual-world platform, and VRCX is a separate tool whose local database can contain older friend and activity records.

In plain words
What is it for?
Use it to configure the service, decide whether to migrate VRCX history, import that data, and understand the project’s development rules.
Why use it?
It makes the setup process explicit, including whether VRCX data should be imported and when the service must be stopped to reduce database risks. It also documents the project’s AI-agent-first workflow.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/ggg123124/vrchat-assistant/agents-md
Clone the repo
git clone --depth 1 https://github.com/ggg123124/vrchat-assistant

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for vrchat-assistant AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ggg123124/vrchat-assistant/agents-md.svg)](https://agentmods.dev/instructions/ggg123124/vrchat-assistant/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/ggg123124/vrchat-assistant/agents-md"><img src="https://agentmods.dev/badge/instructions/ggg123124/vrchat-assistant/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 7,320 This file is loaded in full into every session.
When invoked 7,320 The same file — it is already loaded in full.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.07320 $0.07320
Opus 5 $0.03660 $0.03660
Sonnet 5 $0.01464 $0.01464
Haiku 4.5 $0.00732 $0.00732

Measured yesterday against content hash ca15bec01767, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade B, and why

vrchat-assistant AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

| 查询在线好友 | `curl -X POST http://127.0.0.1:8799/mcp -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_online_friends","arguments":{}}}'` |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl http://127.0.0.1:8799/health
AGENTS.md · 302 lines

How it starts

The opening of the file, as written. The whole thing — 302 lines — stays where its author put it; the contents beside it link to each section on GitHub.

VRChat 助手 (vrchat-assistant)

基于 Node.js 的 VRChat 好友在线状态监控服务,配合 Hermes 插件和桌面插件使用,支持自动抓取 OTP 验证码登录。

🤖 AI-first 项目:本程序只面向 AI Agent 使用与扩展,人类不直接编码;加功能 = 人类向 Agent 提需求 → Agent 实现。开发规范见 DEVELOPMENT.md

面向 AI Agent 的配置引导:以下步骤可由 Agent 自动完成。建议 agent 在本仓库目录内运行(服务目录可自动探测,无需设置环境变量)。

安装前检查(Agent 必读)

⚠️ 在开始配置步骤 1 之前,Agent 必须先向用户核实以下问题:

  1. 是否安装/使用过 VRCX?

    • VRCX 是一款流行的 VRChat 第三方工具,会在本地保存好友活动历史、世界缓存、好友备注等数据(SQLite 数据库)。本服务的 scripts/migrate-vrcx0.mjs 脚本可从 VRCX 数据库一键导入这些历史数据。
    • 若用户使用过 VRCX,继续追问第 2 个问题。
    • 若用户从未使用过 VRCX,可跳过数据导入,直接进入「配置步骤」。
  2. 是否需要将 VRCX 中的历史数据导入到本系统?

    • 导入内容包括:好友列表与信任等级、好友备注/昵称、世界缓存、位置变更历史、上下线记录、Avatar 变更、状态/Bio 变更等(详见下表)。
    • 导入是可选的——不导入也能正常使用本服务,只是查询历史活动记录时没有迁移前的旧数据。
    • 若用户需要导入,在完成「配置步骤」1-3(服务能正常启动)后,运行 node scripts/migrate-vrcx0.mjs 导入数据(脚本会自动探测 VRCX 数据库路径和 userId)。
    • 迁移引擎(v1.1.0 起):改用 better-sqlite3(与主服务同引擎,WAL 模式),已移除旧版 sql.js 整文件重写(该方式曾导致 SQLITE_CORRUPT,2026-08-12 实测踩坑后由 PR #10 防呆 + PR #12 根因修复)。服务运行中迁移不再损坏数据库,但仍建议迁移前停止服务(避免与服务的实时写入交错)。脚本内置 127.0.0.1:8799 端口检测:检测到服务运行时会给出警告,需加 --force 确认后继续(风险自负)。
    • ✅ 幂等说明(v1.2.0 起,PR #14 已修复):迁移记录带 vrcxId 标记 + events 表 JSON 表达式唯一索引 + INSERT OR IGNORE重复执行自动跳过已迁移记录(只补新增,不重复插入)。旧版脚本(无 vrcxId)产生的迁移数据会被检测并提示,需 --force 才会重插(防误全量重插)。迁移完成后 node start-monitor.js 启动服务。
    • 若用户不需要导入,直接进入「配置步骤」。
  3. 是否愿意参与本仓库的 PR/issue 协作审核(AGENT-REVIEW 协议)?

    • 本仓库支持协作审核:多个独立部署的 AI Agent 可以共同参与 PR / issue 审核,通过认领评论声明参与,满员(默认 3 人)后不再重复劳动。协议见仓库根目录 AGENT-REVIEW.md
    • 参与是完全自愿、可随时退出的:不参与不影响任何功能;参与后 Agent 会定时检查 open PR/issue,认领未满员的条目并提交审核意见(只读,不合并)。
    • 若用户愿意参与:Agent 在完成「配置步骤」后,按 AGENT-REVIEW.md §1 配置定时检查(参考脚本 scripts/agent-review.py)。
    • 若用户不愿意参与:跳过即可,Agent 不得自行参与。
迁移项 VRCX 数据表 说明
好友列表 friend_log_current 好友 userId、显示名、信任等级
好友备注 memos 好友昵称/备注文本
世界缓存 cache_world 世界 ID、名称、作者、缩略图等
位置变更 feed_gps 好友何时在哪个世界
自己的位置历史 gamelog_location 本账号自己的位置历史(VRCX 游戏日志解析),迁移为 user-location 事件,供 get_companions 交叉匹配好友位置查同屏
上下线记录 feed_online_offline 好友上线/下线时间及位置
Avatar 变更 feed_avatar 好友更换 Avatar 记录
状态变更 feed_status 好友状态文本变更
Bio 变更 feed_bio 好友个人简介变更

Read the full file on GitHub · 302 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +8 lines · +315 tokens per session ca15bec01767
  2. 6d ago First seen · 294 lines · 7,005 tokens per session scan B 1eb89ddd2830

Subscribe to this mod's changes

vrchat-assistant AGENTS.md is an instructions file published in the GitHub repository ggg123124/vrchat-assistant (21 stars, last pushed today), licensed MIT. It adds 7,320 tokens to every session, about $0.0366 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.