Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/hkpc-1967/spring-ant/agents-mdgit clone --depth 1 https://github.com/HKPC-1967/spring-antWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/hkpc-1967/spring-ant/agents-md)<a href="https://agentmods.dev/instructions/hkpc-1967/spring-ant/agents-md"><img src="https://agentmods.dev/badge/instructions/hkpc-1967/spring-ant/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00807 | $0.00807 |
| Opus 5 | $0.00404 | $0.00404 |
| Sonnet 5 | $0.00161 | $0.00161 |
| Haiku 4.5 | $0.00081 | $0.00081 |
Grade A, and why
spring-ant AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Big picture
- Spring Boot 3 backend (Java 21) with
/apicontext path; entrypoint issrc/main/java/org/hkpc/dtd/Application.java. - Controllers live under
src/main/java/org/hkpc/dtd/business/*/controllerand are wrapped by an aspect (common/core/aspect/MainAspect.java) that logs and enforces the unified response envelope fromResponseStructureUtil. - Database access uses MyBatis (mapper XML in
src/main/resources/mapper/*.xml, mapper interfaces incomponent/postgres/dao), PageHelper for pagination, and Druid as the datasource. - JWT auth + RBAC:
JwtAuthenticationFiltervalidates tokens, sets Spring Security roles, andSpringSecurityConfigapplies role checks for specific routes.
Response + error handling conventions
- Successful controller responses are wrapped by
ResponseStructureUtil.getSuccessResponse(...)unless the URL is inMainAspect.NO_CHANGE_RESULT_URLS. - Errors should use
CodeException+ErrorCodeEnum;GlobalExceptionHandlermaps common validation/format errors to consistent error codes. - Logging for alarms uses markers from
CommonConst(MARK_ALARM_SYSTEM,MARK_ALARM_CUSTOM).
Security + auth flow
- JWT access token header is
Authorization: Bearer <token>; refresh token header isrefreshToken(seeCommonConst). - Routes excluded from JWT checks are in
CommonConst.NO_CHECK_JWT_TOKEN_URLSandOpenApiConfigexcludes login/refresh from Swagger header injection. - JWT signing key is stored encrypted in DB (see
DbConfigService.KeyEnum.JWT_KEY), not in YAML. - Swagger UI is protected by Spring Security form login with a session cookie (
project-config.spring-security.swagger-auth.*inapplication-dev.yml); business APIs remain stateless and use Bearer JWTs.
MyBatis code generation pipeline
- DB table/column comments are the source of truth and are propagated via MyBatis Generator + custom comments.
- Generator entrypoint:
component/postgres/mybatis/generator/MybatisGenerator.javawith config insrc/main/resources/generator-configuration.xml. CustomCommentGeneratoradds@Schemaannotations to generated models; the workflow copies model classes into DTOs for Swagger docs.- Background doc:
readme/pipelined_model_code_generation.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 46 lines · 807 tokens per session scan A 3e953429a0fb
spring-ant AGENTS.md is an instructions file published in the GitHub repository HKPC-1967/spring-ant (22 stars, last pushed 1mo ago), licensed MIT. It adds 807 tokens to every session, about $0.0040 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
shadcn-lar CLAUDE.md
Claude Code instructions for binjuhor/shadcn-lar, covering claude.md, role & responsibilities, workflows and documentation management.
ant-design-pro CLAUDE.md
Claude Code instructions for ant-design/ant-design-pro, covering claude.md, project, commands, critical rules and architecture essentials.
open-mercato AGENTS.md
AGENTS.md instructions for open-mercato/open-mercato, covering agents guidelines, always, ask first, never and validation commands.
catch-admin AGENTS.md
Instructions for JaguarJack/catch-admin, covering catchadmin v5 - ai agent guidelines, role, 规则, 技术栈 and project 目录说明.
south-admin-react CLAUDE.md
Claude Code instructions for southliu/south-admin-react, covering claude.md, commands, development, code quality and package management.
ant-design-cli AGENTS.md
AGENTS.md instructions for ant-design/ant-design-cli, covering agents.md, coding principles, 1. think before coding, 2. simplicity first and 3. surgical changes.