What is agentcanvas AGENTS.md?

Repository instructions for AgentCanvas, a software project with an extension system and an optional image-source component called Assets-2. They define how media references, editor commands, APIs, and extensions must work together.

Use them when modifying AgentCanvas features involving extensions, images, editor actions, React Flow, APIs, or plugin discovery.

They help an agent preserve the project’s contracts and architecture when changing editor, document, web, or extension code.

How jackspooner/agentcanvas configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to jackspooner/agentcanvas. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/jackspooner/agentcanvas/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/jackspooner/agentcanvas

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/jackspooner/agentcanvas/agents-md/github.svg)](https://agentmods.dev/instructions/jackspooner/agentcanvas/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/jackspooner/agentcanvas/agents-md"><img src="https://agentmods.dev/badge/instructions/jackspooner/agentcanvas/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/jackspooner/agentcanvas/agents-md"><img src="https://agentmods.dev/badge/instructions/jackspooner/agentcanvas/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 760 This file is loaded in full into every session.

When invoked 760 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00760	$0.00760
Opus 5.5	$0.00304	$0.00304
Sonnet 5.5	$0.00152	$0.00152
Haiku 4.5	$0.00076	$0.00076

Measured 2mo ago against content hash 5dcf5d03aefd, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

agentcanvas AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 48 lines

How it starts

The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AgentCanvas Agent Guide

Assets-2 usage

agentcanvas.assets2 is an optional image-source extension. AgentCanvas stores the durable reference envelope; Assets-2 owns media identity and bytes.
Preserve canonical refs as {type: "asset", project, assetId}. Do not copy Assets-2 bytes into AgentCanvas or add provider-specific fallbacks to core.
Use the native Assets-2 surface or the shared client for asset operations, and never return local paths, signed URLs, or inline binary data to agents.

Plugin architecture

The public product term is extension. Keep plugin, plugins/, and agentcanvas.plugin/v1 where they are compatibility/runtime identifiers; new public authoring surfaces should use extension terminology.
@agentcanvas/editor is the only package allowed to import React Flow. Document, HTTP, MCP, root web, and extension APIs must stay on canonical AgentCanvas contracts.
Core toolbar, keyboard, menu, and extension actions must use the shared editor command service.
Runtime activation is determined only by non-hidden immediate child folders under plugins/. Do not add agentcanvas.config.mjs, an enabled-plugin list, recursive discovery, remote loading, or hot reload.
First-party source belongs in plugin-packages/; built distributions belong in dist/plugin-catalog/; plugins/ is generated active runtime state.
Normal element behavior must use @agentcanvas/plugin-sdk. Do not add element type switches to kernel validation, HTTP, MCP, browser, or snapshot code.
HTTP, OpenAPI, browser delivery, snapshots, and resident MCP must consume one frozen registry. Stdio MCP remains a bridge to the resident /mcp endpoint.
Plugins are trusted executable dependencies. Manifest permissions gate supported host services but are not a security sandbox.
Missing optional plugins must preserve canonical envelopes. They may not silently normalize, delete, or downgrade stored data.
Plugin activation changes require a restart. Invalid visible plugin folders fail startup explicitly.

Read the full file on GitHub · 48 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 48 lines · 760 tokens per session scan A 5dcf5d03aefd

Subscribe to this mod's changes

agentcanvas AGENTS.md is an instructions file published in the GitHub repository jackspooner/agentcanvas (0 stars, last pushed 3mo ago), licensed MIT. It adds 760 tokens to every session, about $0.0030 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

agentcanvas AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
agentcanvas AGENTS.mdjackspooner/agentcanvas	Instructions file	0	3mo ago	MIT	A	760	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	today	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	today	MIT	A	7,461	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	today	MIT	A	5,649	GitHub Copilot
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	today	MIT	A	4,680	Codex, OpenCode
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	today	MIT	A	3,093	GitHub Copilot
vscode model-prompts.instructions.mdmicrosoft/vscode	Instructions file	195k	today	MIT	A	2,022	GitHub Copilot

agentcanvas: Instructions file for Codex