Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/ilyautov/cordon/agents-mdgit clone --depth 1 https://github.com/ilyautov/cordonWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01405 | $0.01405 |
| Opus 5 | $0.00702 | $0.00702 |
| Sonnet 5 | $0.00281 | $0.00281 |
| Haiku 4.5 | $0.00140 | $0.00140 |
Grade A, and why
cordon AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working in this repository
Instructions for a coding agent. A human reading this will not be harmed by it either.
Cordon is a border layer between untrusted content and an agent's actions. That single fact decides most questions here, including several where the usual good advice points the other way.
The three invariants
Break any of these and the change is wrong no matter how clean it is.
1. No model calls in the hot path. Nothing in src/ may ask a model anything. Whatever decides has to be verifiable by reading the code and reproducible on the same input. Detecting maliciousness by meaning loses to an adaptive attacker and fires on honest text at the same time: a page explaining prompt injection is written out of the same phrases as an attack.
2. src/scope/ never sees untrusted content. Not a summary of it, not a fragment, not a length. The certificate is derived from what the human said and from the policy, and from nothing else. This is the reason the whole scheme works; if a change makes a document, a web page or a tool result reach scope, the change is finished being discussed.
3. Failure has to be loud. Both harnesses read a crashed hook, a timed-out hook and an empty stdout as "let it through". So the hot path is synchronous and linear, the bundle is committed rather than built at install time, and a caught exception is never allowed to turn a deny into silence. When you add a try, say in the catch what happens to the decision.
The map
src/sanitize/ the hidden layer: invisible characters, mixed scripts, hidden HTML,
encoded blocks, percent-encoding. Pure functions over strings
src/provenance/ who said this: atoms, shingles, the taint store
src/scope/ the intent certificate and effect classes. Untrusted content never enters
src/gate/ the decision on a call, plus the quarantine backstop. The exposure
rule lives here: the decision answers to the fact of reading
untrusted content, not only to a match against it
src/output/ the source-influence footer under the model's answer
src/session/ state between processes, and its expiry
src/policy/ loading and defaults, plus protection of Cordon's own files
src/notify/ the channel to the owner that the agent cannot reach
src/adapters/ claude-code and gemini-cli: translate harness events, hold no security logic;
mcp: a stdio JSON-RPC gateway in front of one upstream server, same rule;
langchain: a createAgent middleware, same rule — beforeModel feeds the user
turn, wrapToolCall carries the gate and the observation
src/cordon.ts wiring. src/cli.ts: scan, hook, mcp, doctor
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 80 lines · 1,405 tokens per session scan A 0dd399a038e7
cordon AGENTS.md is an instructions file published in the GitHub repository ilyautov/cordon (1 stars, last pushed 11d ago), licensed MIT. It adds 1,405 tokens to every session, about $0.0070 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
arcjet-js AGENTS.md
Instructions for arcjet/arcjet-js, covering agent guidance, examples live in arcjet/examples and integration work: review before a pr.
Agent-Security-Regression-Harness AGENTS.md
Instructions for OWASP/Agent-Security-Regression-Harness, covering ai agent guide: owasp agent security regression harness, project overview, architecture, contribution workflow and what needs doing.
ziran CLAUDE.md
Instructions for taoq-ai/ziran, covering ziran development guidelines, active technologies, project structure, commands and code style.
cyvisguard CLAUDE.md
Instructions for flankerhqd/cyvisguard: See AGENTS.md for repo orientation, commands, conventions, and the honesty invariants to preserve when touching demo/scenario code.
llm-safe-haven CLAUDE.md
Instructions for pleasedodisturb/llm-safe-haven, covering llm safe haven, what this is, project structure, tdd — non-negotiable (adopted 2026-08-17) and the contract.
llm-safe-haven AGENTS.md
Instructions for pleasedodisturb/llm-safe-haven, covering agents.md, what this file is (and isn't), why this shape (d-08), working agreements and current state.