Borrowing it
Nothing to install: this file belongs to Handigraphs/handigraphs-stats-api-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Handigraphs/handigraphs-stats-api-mcp/main/AGENTS.mdgit clone --depth 1 https://github.com/Handigraphs/handigraphs-stats-api-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/handigraphs/handigraphs-stats-api-mcp/agents-md)<a href="https://agentmods.dev/instructions/handigraphs/handigraphs-stats-api-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/handigraphs/handigraphs-stats-api-mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/handigraphs/handigraphs-stats-api-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/handigraphs/handigraphs-stats-api-mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01469 | $0.01469 |
| Opus 5.5 | $0.00588 | $0.00588 |
| Sonnet 5.5 | $0.00294 | $0.00294 |
| Haiku 4.5 | $0.00147 | $0.00147 |
Grade A, and why
handigraphs-stats-api-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Handigraphs Stats API MCP agent guide
This public Apache-2.0 repository is the canonical local stdio adapter. The REST service lives separately in cjbuskey/handigraphs-app. Use Node 22 and follow CONTRIBUTING.md, SECURITY.md and .agents/pipeline.yml.
Use a dedicated worktree and codex/ task branch from fetched origin/main. Inspect open PRs and preserve unrelated work. Record the active writer, base, validation, checkpoint and remaining work in the plan's per-shard progress fragment (or a tracked agent-handoff note for an unplanned task). Push task-scoped checkpoints. Open a ready PR after validation; CI is test-build-pack across Linux, macOS and Windows. There is no auto-merge or local UI gate. Merging, tagging, publishing npm or MCPB releases and hosted changes require explicit user authorization.
Run the full mcp validation profile before requesting review. Use mocked REST endpoints and the official MCP client. Never use a live credential without a user-supplied temporary sandbox key held only in the process environment. Keep stdout reserved for MCP protocol, diagnostics on stderr, and credentials out of arguments, URLs, fixtures, logs and tool results. Preserve bounded same-origin requests, no redirects, no automatic retries and old-server stats compatibility. Do not introduce generic HTTP tools or hosted transports.
Hosted MCP implementation boundary
The explicitly authorized hosted_mcp_oauth PR-06 adds an opt-in Node 22
entrypoint, npm run start:hosted, alongside the unchanged local stdio launch.
This is the scoped exception to the stdio-only development rule above; it does
not authorize hosting, rollout changes, secrets, a release or publication.
Hosted source is not an available service or product-client acceptance result.
Use HANDIGRAPHS_HOSTED_ENABLED=true, HANDIGRAPHS_MCP_RESOURCE_URL (the exact
HTTPS /mcp endpoint), HANDIGRAPHS_OAUTH_ISSUER (HTTPS application origin),
HANDIGRAPHS_MCP_SERVICE_CLIENT_ID and the separate
HANDIGRAPHS_MCP_SERVICE_SECRET only in the runtime environment. PORT defaults
to 3000. No user API key is read by this entrypoint. Validate with synthetic
loopback issuers, never live customer credentials. The loopback HTTP test switch
HANDIGRAPHS_HOSTED_ALLOW_LOOPBACK=true is forbidden with production NODE_ENV or
any Heroku DYNO. Host defaults to the configured resource authority; optional
HANDIGRAPHS_HOSTED_ALLOWED_HOSTS and HANDIGRAPHS_HOSTED_ALLOWED_ORIGINS are
comma-separated exact allowlists. Forwarded headers never grant trust.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +1 lines · +24 tokens per session 0af19f6d9780
- 8d ago Changed · +14 lines · +180 tokens per session 8096f2217f29
- 9d ago Changed · +59 lines · +856 tokens per session 5db7b39420ff
- 12d ago First seen · 31 lines · 409 tokens per session scan A 0083da470837
handigraphs-stats-api-mcp AGENTS.md is an instructions file published in the GitHub repository Handigraphs/handigraphs-stats-api-mcp (0 stars, last pushed 4d ago), licensed Apache-2.0. It adds 1,469 tokens to every session, about $0.0059 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.