Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/junghoonghae/tossinvest-cli/agents-mdgit clone --depth 1 https://github.com/JungHoonGhae/tossinvest-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/junghoonghae/tossinvest-cli/agents-md)<a href="https://agentmods.dev/instructions/junghoonghae/tossinvest-cli/agents-md"><img src="https://agentmods.dev/badge/instructions/junghoonghae/tossinvest-cli/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03704 | $0.03704 |
| Opus 5 | $0.01852 | $0.01852 |
| Sonnet 5 | $0.00741 | $0.00741 |
| Haiku 4.5 | $0.00370 | $0.00370 |
Grade B, and why
tossinvest-cli AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -sS -d "tossctl regression" "https://ntfy.sh/$YOUR_NTFY_TOPIC" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS -X POST -H 'Content-Type: application/json' \ How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agents
tossctl 자동화를 셋업하려는 AI 에이전트 (OpenClaw / Claude Code / Codex / Cursor / 기타) 가 참고할 짧은 recipe.
전제
tossctl version # 0.4.9+
tossctl auth status # Session: active / Live Check: valid 여야 함
auth status 가 active 가 아니면 사용자가 직접 tossctl auth login 으로 QR + 폰 2차 인증을 마쳐야 합니다 (에이전트가 대신 못 함).
Command taxonomy & safety
Every leaf command carries machine-readable annotations:
source:official(official Open API only),wts(WTS internal endpoint only),both(official preferred, WTS fallback), orlocal(no remote API call).wtsendpoints are unofficial and may change without notice.mutating: true: the command can change account state (live trading). It is attached toorder place,order cancel,order amend,order conditional place|cancel|modify, andops call(because that generic dispatcher can invoke write operations).writes_state: true: a non-trading command changes a preference or resource.writes_state: possibleonops callmeans the selected operation decides; inspect itsmutationpolicy before calling it.environment:liveorpaperwhen the target ledger matters. It is independent of productdomainand credentialsource.experimental: the opt-in feature gate.paper-tradingis hidden and blocked unlessexperimental.paper_trading=true.
Rules for agents:
- Never auto-invoke
mutating: truecommands. A human must approve every live order. Trading is also gated inconfig.json(disabled by default). - Preview before placing. Use
order previewto validate a canonical order intent, then let a human runorder place. writes_state: true명령도 먼저 preview합니다. 사용자의 현재 요청이 그 정확한 변경을 승인한 경우에만 방금 조회한 영향 상태·intent에 결합된confirm_token으로 실행하고, 불가역 작업은 별도 acknowledgement까지 확인합니다. Open API IP 교체·목표가 알림·숨김 종목·관심종목 폴더/종목 관리가 이 범주입니다.- paper 명령은 실거래
mutating: true가 아니라writes_state: true,mutation_risk: simulation,authorization: simulation_execute입니다. 그래도--execute는 사용자가 현재 요청에서 모의 원장 변경을 명시적으로 허용한 경우에만 사용합니다. paper 승인을 live 승인으로 재사용하지 말고,paper order live-preview가 만든 결과도 사람이 일반 live confirm 경계를 다시 통과하게 둡니다. - Open API IP 교체는 새 IP 추가와 검증을 먼저 하고, 실패하면 기존 목록을 복구합니다.
- Prefer
--output jsonfor machine-readable output. - Treat
source: wtsresults as best-effort; add amonitor apiprobe when you build automation on top of them. - Don't auto-run
tossctl update. It changes the tossctl binary itself (not account state), but an agent silently switching versions mid-task can surprise the human running it — let a human trigger it, or runtossctl update --check(read-only) if you need to know whether an update exists.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +117 lines · +2,589 tokens per session aef73e1e9003
- 4d ago First seen · 90 lines · 1,115 tokens per session scan B 0fbcaf0e9797
tossinvest-cli AGENTS.md is an instructions file published in the GitHub repository JungHoonGhae/tossinvest-cli (490 stars, last pushed today), licensed MIT. It adds 3,704 tokens to every session, about $0.0185 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
ollama CLAUDE.md
Claude Code instructions for ollama/ollama: See AGENTS.md for the shared agent instructions for this repository.
azure-sdk-for-go go-code.instructions.md
Instructions for Azure/azure-sdk-for-go: All code should follow the guidelines from the Azure Go SDK Guidelines. This document is a summary of the most important guidelines to follow when contributing to the Azure Go SDK.
chatgpt-cli CLAUDE.md
Claude Code instructions for kardolus/chatgpt-cli, covering chatgpt-cli — release runbook, prerequisites, 1. cut the release, 2. publish the github release + binaries and 3. update the homebrew tap.
Sighthound AGENTS.md
Instructions for Corgea/Sighthound, covering claude, commands, python / django test naming and agent skill.
adeu GEMINI.md
Gemini CLI instructions for dealfluence/adeu, covering adeu — native track changes for ai, available tools, readdocx, processdocumentbatch and applytextrevision.
MCP-Airflow-API copilot-instructions.md
Instructions for call518/MCP-Airflow-API, covering copilot instructions for mcp-airflow-api, project architecture, critical patterns, functions.py - persistent session with retry strategy and standard pattern in airflowapi.py.