run402 AGENTS.md

Repository instructions for run402, a monorepo—a single repository containing several related projects—with a TypeScript SDK, command-line tool, MCP server, and cloud services.

In plain words
What is it for?
Use them when modifying run402 code or documentation, locating one of its interfaces, preparing isolated work, or running its tests.
Why use it?
They describe the platform’s components, documentation sources, Git worktree workflow, and testing rules so agents can navigate the codebase safely.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/kychee-com/run402/agents-md
Clone the repo
git clone --depth 1 https://github.com/kychee-com/run402

Made for: Codex, OpenCode.

Per session 16,288 This file is loaded in full into every session.
When invoked 16,288 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.16288 $0.16288
Opus 5 $0.08144 $0.08144
Sonnet 5 $0.03258 $0.03258
Haiku 4.5 $0.01629 $0.01629

Measured 2d ago against content hash 1b80ce6c08c1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

run402 AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- **auth-aware SSR (v3.0+).** Browser sessions are opaque server-side handles backed by `internal.sessions` — `__Host-Http-r402_session=v1.<session_id>.<secret>` cookie carries no client-readable identity; the gateway re
AGENTS.md · 336 lines

How it starts

The opening of the file, as written. The whole thing — 336 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This file is the single source of truth for AI coding agents working in this repository (Claude Code, Codex, Cursor, Cline, OpenClaw, etc.). CLAUDE.md imports it via @AGENTS.md.

Updating docs? See documentation.md — the map of every doc surface, with target audience, content summary, and update triggers. Scan it before merging code changes.

What This Is

run402 is a developer platform that ships Postgres databases, content-addressed CDN storage, static site hosting, Node 22 serverless functions, email, image generation, and KMS-backed Ethereum signing — provisioned by AI agents and paid for autonomously via x402 USDC on Base, MPP pathUSD on Tempo, or Stripe credits. Prototype tier is free on testnet.

This monorepo ships six interfaces:

  • SDK (sdk/) — typed TypeScript client for the run402 API. Used by external integrators, MCP/CLI/OpenClaw, and (eventually) inside deployed functions. Published as @run402/sdk on npm. Two entry points: root (isomorphic — works in Node 22, Deno, Bun, V8 isolates) and /node (zero-config Node defaults — keystore + allowance + x402).
  • MCP server (root src/) — published as run402-mcp on npm. Each tool is a thin shim over an SDK call. Read by Claude Desktop / Cursor / Cline / Claude Code.
  • CLI (cli/) — standalone CLI published as run402 on npm. Each subcommand is a thin shim over an SDK call; argv parsing and JSON output stay at the CLI edge.
  • Functions library — in-function helper imported inside deployed serverless functions. Exposes auth.* (the canonical auth namespace — auth.user, requireUser, requireRole, requireMembership, requireFresh, fetch, csrfToken/csrfField, sessions.*, identities.link), db(req?), adminDb(), email, ai, and assets. Published as @run402/functions on npm (v3.0+). Source lives in the public run402-core repo under packages/functions; Run402 Cloud consumes the published npm package when it bundles deployed functions. Distinct from the SDK: this is the request-scoped, in-function shape; the SDK is the typed external client. The two are complementary, not redundant.
  • OpenClaw skill (openclaw/) — script-based skill for OpenClaw agents, re-exports from CLI modules.
  • Astro integration (astro/) — framework integration that wires the SDK into Astro's build pipeline. Ships an <Image> component (build-time scan + variant rewrite), an assetsDir/manifest pattern for data-driven sites, and runtime helpers (resolveVariants, renderPicture) for the recommended AssetRef-persistence pattern where consumers store the full AssetRef returned by r.assets.put in their data rows. Published as @run402/astro on npm.
  • Buzz integration (buzz/) — self-contained run402-buzz skill with global CLI/profile setup, dual-proof fixtures/helper, four-state human/community/agent control-plane reporting, verified no-deployment readiness, bounded enrollment offers, and an approval-gated org-of-one fallback. It never accepts or derives from a Nostr private key, and public proof alone grants no authority.

Read the full file on GitHub · 336 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 336 lines · 16,288 tokens per session scan A 1b80ce6c08c1

Subscribe to this mod's changes

run402 AGENTS.md is an instructions file published in the GitHub repository kychee-com/run402 (24 stars, last pushed 2d ago), licensed MIT. It adds 16,288 tokens to every session, about $0.0814 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.