Borrowing it
Nothing to install: this file belongs to lacvietanh/aki-mcp-sv. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lacvietanh/aki-mcp-sv/main/CLAUDE.mdgit clone --depth 1 https://github.com/lacvietanh/aki-mcp-svWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md)<a href="https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md"><img src="https://agentmods.dev/badge/instructions/lacvietanh/aki-mcp-sv/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/lacvietanh/aki-mcp-sv/claude-md"><img src="https://agentmods.dev/badge/instructions/lacvietanh/aki-mcp-sv/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01383 | $0.01383 |
| Opus 5 | $0.00691 | $0.00691 |
| Sonnet 5 | $0.00277 | $0.00277 |
| Haiku 4.5 | $0.00138 | $0.00138 |
Grade A, and why
aki-mcp-sv CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Do not trust local `curl https://$HOST`** — macOS WireGuard mesh (`100.100.100.100`) returns a false 200. Always probe the public IP via `--resolve`: How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
aki-mcp-sv — project guidance
Local MCP server (filesystem, search, shell, agy) for claude.ai & ChatGPT over Tailscale Funnel + OAuth 2.1. Entry: npm start → scripts/start.js (foreground, manual stop/start). Rule loader: akirule skill.
RECURRING #1 — "Couldn't connect" / no POST /token: Tailscale Funnel desync, NOT the code
Signature: npm start is healthy, funnel status says "on", but client reports "Couldn't connect" and gatekeeper stops at POST /authorize -> 302 with no POST /token. The local serve-config did not sync to Tailscale's public edge; external calls fail at the TLS layer.
- Do not debug
scripts/oauth.jsorscripts/gatekeeper.js— OAuth & bridge code are correct. - Do not trust local
curl https://$HOST— macOS WireGuard mesh (100.100.100.100) returns a false 200. Always probe the public IP via--resolve:HOST=$(tailscale status --json | jq -r .Self.DNSName | sed 's/\.$//'); PUB=$(dig @8.8.8.8 $HOST +short | head -1) curl --resolve $HOST:443:$PUB https://$HOST/.well-known/oauth-authorization-server # exit 35 / 000 = desync - Reset cycle:
tailscale funnel --https=443 off && tailscale serve reset && tailscale funnel --bg 9999 - Bypass / Ingress precedence:
--tunnel <cred.json>(Cloudflare) >PUBLIC_ORIGIN> Tailscale Funnel.
Two client paths, one OAuth server
scripts/oauth.js serves both without handler-level branching:
- Claude: Pre-registered confidential client in
oauth-client.json(client_secret_post). - ChatGPT: Public client via RFC 7591 DCR (
POST /register), PKCE only, stored inoauth-dcr-clients.json. - Invariants:
resolveClient()is the single SSoT lookup for both. Redirect URIs are strictly allowlisted inisAllowedRedirect(claude.ai,chatgpt.com,googleusercontent.com,grok.com). Auth codes and refresh tokens are bound to their issuing client ID.
OS-agnostic by decision, not by accident
- Data tables only: Platform differences exist strictly as declarative maps indexed by
process.platform(LAUNCHERinopen-browser.js,WIN_EXTRAinallowlist.js). Never branch business logic (if (win32)). - Prerequisites over fallbacks: Windows runs Unix binaries via Git for Windows (
grep,find). Do not add pure-JS reimplementations. - Permanently removed:
scripts/chrome.jsstays deleted (Chrome 136 blocks remote debugging on default profile) and native folder picker stays removed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +68 tokens per session b4c50daf35ca
- 6d ago Changed · +144 tokens per session 91efc9e744d3
- 12d ago First seen · 51 lines · 1,171 tokens per session scan A 067690024f78
aki-mcp-sv CLAUDE.md is an instructions file published in the GitHub repository lacvietanh/aki-mcp-sv (130 stars, last pushed 4d ago), licensed MIT. It adds 1,383 tokens to every session, about $0.0069 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
plan-forge database.instructions.md
Database patterns for .NET — Dapper/EF Core, parameterized queries, migration strategy.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.