Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/knuckles-team/gitlab-api/agents-mdgit clone --depth 1 https://github.com/Knuckles-Team/gitlab-apiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04420 | $0.04420 |
| Opus 5 | $0.02210 | $0.02210 |
| Sonnet 5 | $0.00884 | $0.00884 |
| Haiku 4.5 | $0.00442 | $0.00442 |
Grade A, and why
gitlab-api AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
95% identical to servicenow-api AGENTS.md — 138 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 395 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Claude Code loads this file via
CLAUDE.md(@AGENTS.mdimport) — the two stay in sync. Edit this file, notCLAUDE.md.
Tech Stack & Architecture
- Language/Version: Python 3.10+
- Core Libraries:
agent-utilities,fastmcp,pydantic-ai - Key principles: Functional patterns, Pydantic for data validation, asynchronous tool execution.
- Architecture:
mcp_server.py: Main MCP server entry point and tool registration.agent.py: Pydantic AI agent definition and logic.skills/: Directory containing modular agent skills (if applicable).
Architecture Diagram
graph TD
User([User/A2A]) --> Server[A2A Server / FastAPI]
Server --> Agent[Pydantic AI Agent]
Agent --> Skills[Modular Skills]
Agent --> MCP[MCP Server / FastMCP]
MCP --> Client[API Client / Wrapper]
Client --> ExternalAPI([External Service API])
Workflow Diagram
sequenceDiagram
participant U as User
participant S as Server
participant A as Agent
participant T as MCP Tool
participant API as External API
U->>S: Request
S->>A: Process Query
A->>T: Invoke Tool
T->>API: API Request
API-->>T: API Response
T-->>A: Tool Result
A-->>S: Final Response
S-->>U: Output
Commands (run these exactly)
Installation
pip install .[all]
Quality & Linting (run from project root)
pre-commit run --all-files
Execution Commands
gitlab-mcp
gitlab_api.mcp_server:mcp_server
gitlab-agent
gitlab_api.agent_server:agent_server
Project Structure Quick Reference
- MCP Entry Point →
mcp_server.py - Agent Entry Point →
agent_server.py - Source Code →
gitlab_api/ - Skills →
skills/(if exists)
File Tree
├── .github/
│ └── workflows/
│ ├── docs.yml
│ ├── pages.yml
│ └── pipeline.yml
├── .specify/
│ └── specs/
│ ├── code-enhancement-20260512/
│ │ ├── CHECKLIST.md
│ │ ├── DRIFT_REPORT.md
│ │ ├── spec.json
│ │ ├── spec.md
│ │ ├── tasks.json
│ │ └── tasks.md
│ └── code-enhancement-20260524/
│ ├── spec.json
│ ├── spec.md
│ ├── tasks.json
│ └── tasks.md
├── docker/
│ ├── agent.compose.yml
│ ├── debug.Dockerfile
│ ├── Dockerfile
│ ├── mcp.compose.yml
│ └── starship.toml
├── docs/
│ ├── concepts.md
│ ├── deployment.md
│ ├── index.md
│ ├── installation.md
│ ├── overview.md
│ ├── platform.md
│ └── usage.md
├── gitlab_api/
│ ├── api/
│ │ ├── __init__.py
│ │ ├── api_client_base.py
│ │ ├── api_client_environments.py
│ │ ├── api_client_issues.py
│ │ ├── api_client_merge_requests.py
│ │ ├── api_client_other.py
│ │ ├── api_client_pipelines.py
│ │ ├── api_client_projects.py
│ │ ├── api_client_repositories.py
│ │ ├── api_client_system.py
│ │ └── api_client_users_groups.py
│ ├── __init__.py
│ ├── __main__.py
│ ├── agent_server.py
│ ├── api_client.py
│ ├── auth.py
│ ├── gitlab_gql.py
│ ├── gitlab_input_models.py
│ ├── gitlab_response_models.py
│ ├── main_agent.json
│ ├── mcp_config.json
│ └── mcp_server.py
├── scripts/
│ ├── security_sanitizer.py
│ ├── validate_a2a_agent.py
│ ├── validate_agent.py
│ └── verify_api_integration.py
├── tests/
│ ├── __init__.py
│ ├── conftest.py
│ ├── test_api_wrapper.py
│ ├── test_auth.py
│ ├── test_concept_parity.py
│ ├── test_gitlab_a2a_validation.py
│ ├── test_gitlab_api_brute_force_coverage.py
│ ├── test_gitlab_gql.py
│ ├── test_gitlab_mcp_validation.py
│ ├── test_gitlab_models.py
│ ├── test_init_dynamics.py
│ ├── test_mock_coverage.py
│ ├── test_startup.py
│ ├── test_verify_agent.py
│ └── verify_a2a_queries.py
├── .bumpversion.cfg
├── .codespellignore
├── .dockerignore
├── .env.example
├── .gitattributes
├── .gitignore
├── .pre-commit-config.yaml
├── .vulture_ignore
├── a2a.json
├── AGENTS.md
├── CHANGELOG.md
├── CLAUDE.md
├── LICENSE
├── MANIFEST.in
├── mcp_config.json
├── mkdocs.yml
├── opencode.json
├── pyproject.toml
├── pytest.ini
├── README.md
├── requirements.txt
└── uv.lock
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 395 lines · 4,420 tokens per session scan A 52f49812e37c
gitlab-api AGENTS.md is an instructions file published in the GitHub repository Knuckles-Team/gitlab-api (10 stars, last pushed 3d ago), licensed MIT. It adds 4,420 tokens to every session, about $0.0221 per session on Opus 5. A static security scan graded it A with 0 findings. It is 95% identical to servicenow-api AGENTS.md, differing in 138 lines, and is treated as a copy.
Other instructions, from other repositories
ag2 AGENTS.md
Instructions for ag2ai/ag2, covering ag2 development guidelines, ai-assisted contribution policy, architecture decision records (adr), code style guidelines and package structure.
proximo AGENTS.md
Instructions for john-broadway/proximo, covering hello, agent, what this is — sharp edges first, verify us — don't trust us, what we'll never do to you and why we work this way (optional).
backend.ai AGENTS.md
AGENTS.md instructions for lablup/backend.ai, covering ai coding agent guidelines, document structure (agents.md / knowledge.md), writing style, document index and absolute rules (global).
ampersend-sdk CLAUDE.md
Instructions for edgeandnode/ampersend-sdk, covering claude.md, project overview, development commands, python setup and install python 3.13.
backend.ai CLAUDE.md
Claude Code instructions for lablup/backend.ai, a project described as: Backend.AI is a streamlined, container-based computing cluster platform that hosts popular computing/ML frameworks and diverse programming languages, with pluggable heterogeneous accelerator support including CUDA GPU, ROCm GPU, Gaudi NPU, Google…
summonpot AGENTS.md
Instructions for tugrulguner/summonpot, covering agents.md, what summonpot is, layout, coding guidelines and workflow.