grsshppr AGENTS.md

Project instructions that define how people and coding agents should make changes in Grasshopper, an open-source product. They act as a shared contract covering principles, responsibilities, workflows, and rules.

In plain words
What is it for?
Use them when planning, proposing, implementing, or reviewing changes to Grasshopper. They guide work from a written proposal through discussion, decision, code change, and release.
Why use it?
They make project decisions and changes consistent, documented, and traceable. They also clarify which rules are required and where technical or design guidance belongs.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/grasshopper-protocol/grsshppr/agents-md
Clone the repo
git clone --depth 1 https://github.com/grasshopper-protocol/grsshppr

Made for: Codex, OpenCode.

Per session 2,083 This file is loaded in full into every session.
When invoked 2,083 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02083 $0.02083
Opus 5 $0.01042 $0.01042
Sonnet 5 $0.00417 $0.00417
Haiku 4.5 $0.00208 $0.00208

Measured 2d ago against content hash eeb59003c695, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

grsshppr AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 169 lines

How it starts

The opening of the file, as written. The whole thing — 169 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — How Humans and Agents Operate in Grasshopper

Grasshopper is a fully open product: open code, open specs, open design, open decisions, public roadmap. This file is the contract for everyone who changes the project — human or AI. It is enforceable. If a change violates it, the change is wrong, not the rule.

For engineering specifics (tech stack, data model, naming, module rules) see ENGINEERING.md. For visual direction see DESIGN.md and design/principles.md. This file governs how change happens.


1. Principles (non-negotiable)

  1. Open by default. Publish the reasoning, not just the result. If there is no concrete reason to keep something private, it is public.
  2. Document before building. Non-trivial change starts as a written proposal (RFC), not as a pull request.
  3. Decisions must be traceable. Every decision links idea → discussion → decision (ADR) → implementation (PR) → release. No orphan changes.
  4. Product, Design, and Engineering are equals. A design or product proposal is a first-class contribution, not a request for engineering.
  5. Lazy stays lazy. This process governs change, not effort. A typo or a one-line fix needs no ceremony. The bar scales with blast radius.

2. Responsibilities of Agents

When acting on this repository, an agent MUST:

  • Write an RFC before any major change. "Major" = new feature/module, schema or data-model change, new dependency, public API change, design-system change, governance change, or reversing a prior ADR.
  • Link every change to an issue or spec. A PR with no linked issue/RFC is incomplete.
  • Record decisions as ADRs. When a choice is made between alternatives, write the ADR (context, options, decision, consequences) and link it.
  • Update documentation in the same change. Code that changes behavior updates the relevant doc (README, ENGINEERING, DESIGN, roadmap) in the same PR.
  • Ship a test with non-trivial logic. A PR that adds or changes non-trivial logic includes a test in the same change and must not lower the coverage gate (see ADR-0011 and ENGINEERING.md). Logic that isn't unit-testable in place is extracted into a pure helper under src/lib and tested there.
  • Verify green before pushing. Run pnpm verify (typecheck + lint) before pushing a branch. A branch that fails pnpm typecheck must not be pushed — typecheck is exactly what next build (Vercel) enforces. The .githooks/pre-commit hook runs it automatically as a hard gate; lint stays advisory until the current lint debt is cleared. See ADR-0012.
  • Resolve merge conflicts cleanly. After resolving any conflict, re-run pnpm verify and scan the diff for accidentally duplicated blocks before committing. Never commit both sides of a hunk — a duplicated definition breaks the build.
  • Record any gate bypass. git commit --no-verify is for emergencies only and must be called out in the PR description. A silent bypass is a silent change (see §4).
  • Never introduce silent changes. No undocumented features, no quiet dependency additions, no schema drift, no behavior changes "while I was in there." If it wasn't asked for and isn't documented, don't ship it.
  • Surface operational risk in the repo, not in private notes. Incidents, drift, and security concerns belong in /decisions or SECURITY.md, where humans can see them.

Read the full file on GitHub · 169 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 169 lines · 2,083 tokens per session scan A eeb59003c695

Subscribe to this mod's changes

grsshppr AGENTS.md is an instructions file published in the GitHub repository grasshopper-protocol/grsshppr (2 stars, last pushed 2d ago), licensed MIT. It adds 2,083 tokens to every session, about $0.0104 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.