What is facebook-lyr AGENTS.md?

Repository instructions for AI coding agents working on facebook-lyr, a server that collects data from Facebook, Messenger, and Threads. They describe the project's layout, rules, testing, and runtime setup.

Use them when modifying facebook-lyr, especially its cookie handling, login checks, scraping code, configuration, errors, and tests.

They give an agent the project-specific context needed to make changes safely and consistently.

How ishan-parihar/facebook-lyr configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to ishan-parihar/facebook-lyr. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/ishan-parihar/facebook-lyr/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/ishan-parihar/facebook-lyr

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/ishan-parihar/facebook-lyr/agents-md/github.svg)](https://agentmods.dev/instructions/ishan-parihar/facebook-lyr/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/ishan-parihar/facebook-lyr/agents-md"><img src="https://agentmods.dev/badge/instructions/ishan-parihar/facebook-lyr/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/ishan-parihar/facebook-lyr/agents-md"><img src="https://agentmods.dev/badge/instructions/ishan-parihar/facebook-lyr/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 745 This file is loaded in full into every session.

When invoked 745 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00745	$0.00745
Opus 5	$0.00373	$0.00373
Sonnet 5	$0.00149	$0.00149
Haiku 4.5	$0.00075	$0.00075

Measured 8d ago against content hash 0fa0d5b4b551, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade A, and why

facebook-lyr AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 63 lines

How it starts

The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — guidance for AI agents working on facebook-lyr

facebook-lyr is a cookie-scraping MCP server for Facebook / Messenger / Threads, mirroring instagram-lyr's architecture exactly.

Layout

facebook_mcp_server/
├── core/                scraping exception hierarchy (AuthenticationError, RateLimitError, ...)
├── config/              schema (CookieConfig) + loaders (CLI > env > defaults)
├── session_state.py     SourceState/RuntimeState + portable cookies.json (0600)
├── cookie_import.py     browser registry + SQLite cookie extraction (facebook.com)
├── setup.py             interactive profile creation (--login)
├── drivers/browser.py   load_cookies / validate_session (curl_cffi)
├── scraping/
│   ├── identity.py      shared UA + Chrome TLS impersonation fingerprint
│   ├── parsers.py       fb_dtsg extraction, login-wall detection, embedded-JSON deep-scan
│   └── api_client.py    FacebookScrapeClient — all web surfaces
├── authentication.py    source-session checks
├── bootstrap.py         auth gating + FACEBOOK_COOKIES env bootstrap
├── dependencies.py      get_ready_client + cookie write-back sink
├── error_handler.py     ToolError mapping + issue diagnostics
├── tools/               tool_guard + registration modules
├── server.py            FastMCP server + sequential middleware
├── cli_main.py          AXI CLI (home view, --login, --status, direct tools)
└── tool_registry.py     tool list + run_tool_direct

Rules

One fingerprint bundle. Every request must use the same UA + TLS impersonation + Client Hints (scraping/identity.py). Presenting the same session under two pairings is a bot-detection tell.
fb_dtsg is a CSRF token. It is fetched from the logged-in homepage and cached on the client. Ajax write endpoints require it.
Never hardcode page-structure paths. Facebook's embedded JSON changes constantly — use the deep-scan predicates in parsers.py, not fixed key paths. Add fixture-backed tests when adding a parser.
Login walls must become AuthenticationError. Every HTML page fetch checks detect_login_wall; ajax endpoints rely on 401/403 instead.
Write tools are gated. confirm=true + write pacing. Keep the gap human-like; agent loops must not burst writes.
Auth artifacts are 0600. Cookies are credentials — never log them, never return them in tool output.
No new Graph-API code. This project deliberately uses cookie scraping, like instagram-lyr. Don't re-add graph.facebook.com calls.

Read the full file on GitHub · 63 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 63 lines · 745 tokens per session scan A 0fa0d5b4b551

Subscribe to this mod's changes

facebook-lyr AGENTS.md is an instructions file published in the GitHub repository ishan-parihar/facebook-lyr (1 stars, last pushed 28d ago), licensed MIT. It adds 745 tokens to every session, about $0.0037 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

facebook-lyr: Instructions file for Codex