Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/kuwaitdevs/myfatoorah-mcp/copilot-instructionsgit clone --depth 1 https://github.com/kuwaitdevs/myfatoorah-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/kuwaitdevs/myfatoorah-mcp/copilot-instructions)<a href="https://agentmods.dev/instructions/kuwaitdevs/myfatoorah-mcp/copilot-instructions"><img src="https://agentmods.dev/badge/instructions/kuwaitdevs/myfatoorah-mcp/copilot-instructions.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00539 | $0.00539 |
| Opus 5 | $0.00269 | $0.00269 |
| Sonnet 5 | $0.00108 | $0.00108 |
| Haiku 4.5 | $0.00054 | $0.00054 |
Grade C, and why
myfatoorah-mcp copilot-instructions.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- Use this file to provide workspace-specific custom instructions to Copilot. For more details, visit https://code.visualstudio.com/docs/copilot/copilot-customization#_use-a-githubcopilotinstructionsmd-file --> What it actually says
-
Verify that the copilot-instructions.md file in the .github directory is created.
-
Clarify Project Requirements TypeScript MCP server for the MyFatoorah API, using Node.js 20+, MCP TypeScript SDK v2, Zod v4, stdio, and npm.
-
Scaffold the Project Created a strict ESM TypeScript package with npm, linting, formatting, tests, CI, and VS Code configuration.
-
Customize the Project Implemented focused MyFatoorah v3 tools, a guarded API escape hatch, safe configuration resource, payment prompt, token redaction, and confirmation guards.
-
Install Required Extensions No language-specific extension is required by the MCP project setup guidance.
-
Compile the Project Formatting, linting, type checking, all tests, and the production build pass.
-
Create and Run Task VS Code build and test tasks are available; equivalent npm tasks were run successfully.
-
Launch the Project Not launched against MyFatoorah because no user token was supplied. The compiled stdio server is ready for MCP debugging.
-
Ensure Documentation is Complete README, Claude, agent, security, setup, host configuration, and API documentation are complete.
Project rules
-
Never write logs to stdout because it carries MCP stdio protocol messages. Use stderr for diagnostics.
-
Never commit, print, or return
MYFATOORAH_API_TOKEN; preserve token and Bearer-value redaction. -
Treat refunds as destructive financial operations and preserve explicit confirmation guards.
-
Prefer focused tools to the generic request tool. Keep generic requests restricted to safe relative
/v2/and/v3/paths. -
Verify endpoint or schema changes against the official MyFatoorah documentation index: https://docs.myfatoorah.com/llms.txt
-
Follow the stable MCP TypeScript SDK v2 documentation: https://ts.sdk.modelcontextprotocol.io/v2/
-
Follow the MCP specification: https://modelcontextprotocol.io/specification/latest
-
Before finishing changes, run
npm run format:check,npm run lint,npm run typecheck,npm test, andnpm run build. -
Work through each checklist item systematically.
-
Keep communication concise and focused.
-
Follow development best practices.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 43 lines · 539 tokens per session scan C ce1541ff52ab
myfatoorah-mcp copilot-instructions.md is an instructions file published in the GitHub repository kuwaitdevs/myfatoorah-mcp (0 stars, last pushed 9d ago), licensed MIT. It adds 539 tokens to every session, about $0.0027 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
robinhood-mcp AGENTS.md
Instructions for verygoodplugins/robinhood-mcp, covering agents.md, project overview, read-only is a hard invariant, build & development and install with dev dependencies (editable).
longbridge-mcp CLAUDE.md
Claude Code instructions for longbridge/longbridge-mcp, covering code formatting, code style, generic bounds, imports and comments.
freetaxusa-mcp CLAUDE.md
Claude Code instructions for schwarztim/freetaxusa-mcp, covering freetaxusa mcp server, architecture, commands, tool categories and phase 1 (implemented).
swiss-snb-mcp CLAUDE.md
Claude Code instructions for malkreide/swiss-snb-mcp, covering claude.md, teil 1 — konventionen (portfolio-weit), vor der arbeit, tests and wenn etwas rot ist.
lobbywatch-mcp CLAUDE.md
Claude Code instructions for malkreide/lobbywatch-mcp, covering claude.md, teil 1 — portfolio-konventionen, vor der arbeit, tests and wenn etwas rot ist.
apra-mcp CLAUDE.md
Claude Code instructions for Bigred97/apra-mcp, covering apra-mcp, source, curated datasets (13), repo-specific module set and repo-specific gotchas.