agentmods.dev

tossinvest-cli: Instructions file for Codex

AGENTS.md

tossinvest-cli AGENTS.md is an instructions file for Codex, OpenCode from JungHoonGhae/tossinvest-cli. It costs 3,954 tokens per session, scanned B, original, MIT.

A guide for tossctl, a command-line tool for working with the Toss investment service. It explains which commands use official or unofficial interfaces and marks the few commands that can place, cancel, or change live trades.

In plain words
What is it for?
Use it to check authentication, preview orders, read machine-readable results, detect API changes, and safely build trading automation.
Why use it?
It helps an agent avoid treating live trading like a read-only operation and makes human approval part of every order workflow.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions Claude Code; mentions Codex; built for openclaw.

This is JungHoonGhae/tossinvest-cli's own configuration. It tells Codex and OpenCode how to work on tossinvest-cli itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything tossinvest-cli configures →

not rated 520repo +2 changed 1mo ago B scan 3,954 tokens original MIT
View source ↗ JungHoonGhae/tossinvest-cli tossinvest-cli.vercel.app
Reuse

Borrowing it

Nothing to install: this file belongs to JungHoonGhae/tossinvest-cli. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/JungHoonGhae/tossinvest-cli/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/JungHoonGhae/tossinvest-cli

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for tossinvest-cli AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/junghoonghae/tossinvest-cli/agents-md/github.svg)](https://agentmods.dev/instructions/junghoonghae/tossinvest-cli/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/junghoonghae/tossinvest-cli/agents-md"><img src="https://agentmods.dev/badge/instructions/junghoonghae/tossinvest-cli/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for tossinvest-cli AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/junghoonghae/tossinvest-cli/agents-md"><img src="https://agentmods.dev/badge/instructions/junghoonghae/tossinvest-cli/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 3,954 This file is loaded in full into every session.
When invoked 3,954 The same file — it is already loaded in full.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.03954 $0.03954
Opus 5.5 $0.01582 $0.01582
Sonnet 5.5 $0.00791 $0.00791
Haiku 4.5 $0.00395 $0.00395

Measured 1mo ago against content hash 66302654ccac, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

tossinvest-cli AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

curl -sS -d "tossctl regression" "https://ntfy.sh/$YOUR_NTFY_TOPIC"

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sS -X POST -H 'Content-Type: application/json' \
AGENTS.md · 216 lines

How it starts

The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Agents

tossctl 자동화를 셋업하려는 AI 에이전트 (OpenClaw / Claude Code / Codex / Cursor / 기타) 가 참고할 짧은 recipe.

전제

tossctl version          # 0.4.9+
tossctl auth status      # Session: active / Live Check: valid 여야 함

auth status 가 active 가 아니면 사용자가 직접 tossctl auth login 으로 QR + 폰 2차 인증을 마쳐야 합니다 (에이전트가 대신 못 함).

Command taxonomy & safety

Every leaf command carries machine-readable annotations:

  • source: official (official Open API only), wts (WTS internal endpoint only), both (official preferred, WTS fallback), or local (no remote API call). wts endpoints are unofficial and may change without notice.
  • mutating: true: the command can change account state (live trading). It is attached to order place, order cancel, order amend, order conditional place|cancel|modify, and ops call (because that generic dispatcher can invoke write operations).
  • writes_state: true: a non-trading command changes a preference or resource. writes_state: possible on ops call means the selected operation decides; inspect its mutation policy before calling it.
  • environment: live or paper when the target ledger matters. It is independent of product domain and credential source.
  • experimental: the opt-in feature gate. paper-trading is hidden and blocked unless experimental.paper_trading=true.

Rules for agents:

  • Never auto-invoke mutating: true commands. A human must approve every live order. Trading is also gated in config.json (disabled by default).
  • Preview before placing. Use order preview to validate a canonical order intent, then let a human run order place.
  • writes_state: true 명령도 먼저 preview합니다. 사용자의 현재 요청이 그 정확한 변경을 승인한 경우에만 방금 조회한 영향 상태·intent에 결합된 confirm_token으로 실행하고, 불가역 작업은 별도 acknowledgement까지 확인합니다. Open API IP 교체·목표가 알림·숨김 종목·관심종목 폴더/종목 관리가 이 범주입니다.
  • paper 명령은 실거래 mutating: true가 아니라 writes_state: true, mutation_risk: simulation, authorization: simulation_execute입니다. 그래도 --execute는 사용자가 현재 요청에서 모의 원장 변경을 명시적으로 허용한 경우에만 사용합니다. paper 승인을 live 승인으로 재사용하지 말고, paper order live-preview가 만든 결과도 사람이 일반 live confirm 경계를 다시 통과하게 둡니다.
  • Open API IP 교체는 새 IP 추가와 검증을 먼저 하고, 실패하면 기존 목록을 복구합니다.
  • Prefer --output json for machine-readable output.
  • Treat source: wts results as best-effort; add a monitor api probe when you build automation on top of them.
  • Don't auto-run tossctl update. It changes the tossctl binary itself (not account state), but an agent silently switching versions mid-task can surprise the human running it — let a human trigger it, or run tossctl update --check (read-only) if you need to know whether an update exists.

Read the full file on GitHub · 216 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +5 lines · +128 tokens per session 66302654ccac
  2. 1mo ago Changed · +1 lines · +39 tokens per session 915df057f051
  3. 1mo ago Changed · +3 lines · +83 tokens per session 07332a57996b
  4. 2mo ago Changed · +117 lines · +2,589 tokens per session aef73e1e9003
  5. 2mo ago First seen · 90 lines · 1,115 tokens per session scan B 0fbcaf0e9797

Subscribe to this mod's changes

tossinvest-cli AGENTS.md is an instructions file published in the GitHub repository JungHoonGhae/tossinvest-cli (520 stars, last pushed 2d ago), licensed MIT. It adds 3,954 tokens to every session, about $0.0158 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Finance and fintechai-agentscligokorea-stockllm-toolsstock-trading
Related

tossinvest-cli AGENTS.md compared with instructions from other repositories

tossinvest-cli AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
tossinvest-cli AGENTS.mdJungHoonGhae/tossinvest-cliInstructions file5202d agoMITB3,954Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode