Borrowing it
Nothing to install: this file belongs to ilyautov/cordon. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ilyautov/cordon/main/AGENTS.mdgit clone --depth 1 https://github.com/ilyautov/cordonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ilyautov/cordon/agents-md)<a href="https://agentmods.dev/instructions/ilyautov/cordon/agents-md"><img src="https://agentmods.dev/badge/instructions/ilyautov/cordon/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ilyautov/cordon/agents-md"><img src="https://agentmods.dev/badge/instructions/ilyautov/cordon/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01428 | $0.01428 |
| Opus 5.5 | $0.00571 | $0.00571 |
| Sonnet 5.5 | $0.00286 | $0.00286 |
| Haiku 4.5 | $0.00143 | $0.00143 |
Grade A, and why
cordon AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working in this repository
Instructions for a coding agent. A human reading this will not be harmed by it either.
Cordon is a border layer between untrusted content and an agent's actions. That single fact decides most questions here, including several where the usual good advice points the other way.
The three invariants
Break any of these and the change is wrong no matter how clean it is.
1. No model calls in the hot path. Nothing in src/ may ask a model anything. Whatever decides has to be verifiable by reading the code and reproducible on the same input. Detecting maliciousness by meaning loses to an adaptive attacker and fires on honest text at the same time: a page explaining prompt injection is written out of the same phrases as an attack.
2. src/scope/ never sees untrusted content. Not a summary of it, not a fragment, not a length. The certificate is derived from what the human said and from the policy, and from nothing else. This is the reason the whole scheme works; if a change makes a document, a web page or a tool result reach scope, the change is finished being discussed.
3. Failure has to be loud. Both harnesses read a crashed hook, a timed-out hook and an empty stdout as "let it through". So the hot path is synchronous and linear, the bundle is committed rather than built at install time, and a caught exception is never allowed to turn a deny into silence. When you add a try, say in the catch what happens to the decision.
The map
src/sanitize/ the hidden layer: invisible characters, mixed scripts, hidden HTML,
encoded blocks, percent-encoding. Pure functions over strings
src/provenance/ who said this: atoms, shingles, the taint store
src/scope/ the intent certificate and effect classes. Untrusted content never enters
src/gate/ the decision on a call, plus the quarantine backstop. The exposure
rule lives here: the decision answers to the fact of reading
untrusted content, not only to a match against it
src/output/ the source-influence footer under the model's answer
src/session/ state between processes, and its expiry
src/policy/ loading and defaults, plus protection of Cordon's own files
src/notify/ the channel to the owner that the agent cannot reach
src/adapters/ claude-code and gemini-cli: translate harness events, hold no security logic;
codex, kimi and deepseek: the claude-code adapter with a dialect of what each harness honours;
mcp: a stdio JSON-RPC gateway in front of one upstream server, same rule;
langchain: a createAgent middleware, same rule — beforeModel feeds the user
turn, wrapToolCall carries the gate and the observation
src/cordon.ts wiring. src/cli.ts: scan, hook, mcp, doctor
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago Changed · +1 lines · +23 tokens per session 46c3b7685e7d
- 1mo ago First seen · 80 lines · 1,405 tokens per session scan A 0dd399a038e7
cordon AGENTS.md is an instructions file published in the GitHub repository ilyautov/cordon (6 stars, last pushed yesterday), licensed MIT. It adds 1,428 tokens to every session, about $0.0057 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.