lightpaper CLAUDE.md

A set of project instructions for Lightpaper, a web application built with FastAPI, PostgreSQL, and a React writing interface. It documents the application structure, important files, local development, and tests.

In plain words
What is it for?
It helps with work on authentication, publishing, search, documents, books, writing sessions, the web interface, configuration, and related application services.
Why use it?
It gives a coding agent the project context needed to navigate the codebase and follow its existing architecture.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/lightpaperorg/lightpaper/claude-md
Clone the repo
git clone --depth 1 https://github.com/lightpaperorg/lightpaper
Per session 5,450 This file is loaded in full into every session.
When invoked 5,450 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.05450 $0.05450
Opus 5 $0.02725 $0.02725
Sonnet 5 $0.01090 $0.01090
Haiku 4.5 $0.00545 $0.00545

Measured 2d ago against content hash 71917725e418, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

lightpaper CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 353 lines

How it starts

The opening of the file, as written. The whole thing — 353 lines — stays where its author put it; the contents beside it link to each section on GitHub.

lightpaper.org — Claude Code Instructions

Architecture

FastAPI + async SQLAlchemy + PostgreSQL 16. Single-process async app deployed on Google Cloud Run.

Key Files

File Purpose
app/main.py FastAPI app, middleware (CORS, security headers, body size, rate limiting)
app/config.py Pydantic settings from env vars
app/auth.py API key + email OTP + LinkedIn OAuth authentication
app/models.py SQLAlchemy ORM models (18 tables)
app/schemas.py Pydantic request/response schemas with size limits
app/rate_limit.py slowapi limiter singleton
app/utils.py get_client_ip() for Cloud Run proxy
app/routes/publish.py POST /v1/publish — the core endpoint
app/routes/search.py GET /v1/search — full-text + gravity ranking
app/routes/documents.py CRUD /v1/documents/{id}, notifies search engines on update/delete
app/routes/books.py Book publishing: POST /v1/books, chapter management
app/routes/write.py Writing IDE API: sessions, chat, files, publish
app/routes/ide.py Serves the React SPA at /write
app/services/wave_engine.py Wave Method system prompts per wave
app/ide/ React + Vite frontend for the Writing IDE
app/routes/reading.py GET /{slug}, GET /books/{slug} — content negotiation (HTML/JSON)
app/routes/discovery.py robots.txt, sitemap.xml, feed.xml, llms.txt, OG images, IndexNow + Google ping
app/routes/auth.py Email OTP + LinkedIn OAuth login/signup endpoints
app/routes/linkedin.py LinkedIn OAuth verification for existing accounts
app/routes/verification.py Domain DNS, ORCID verification, gravity status
app/routes/credentials.py Agent-driven credential verification
app/routes/narration.py Audiobook narration: estimate, create, status, callback
app/routes/print.py Print PDF export: preview, interior, cover, certificate
app/services/narration.py ElevenLabs TTS, markdown→plaintext, GCS upload
app/services/print_pdf.py WeasyPrint interior PDF + certificate generation
app/services/print_cover.py Pillow cover PDF generation (300 DPI)
app/services/licenses.py License info map, copyright notice generator
app/services/renderer.py markdown-it-py + nh3 HTML sanitization
app/services/quality.py Deterministic quality scoring (0-100)
app/services/gravity.py Non-hierarchical author gravity (0-5)
app/services/slug.py URL slug generation + reserved slug list
app/services/og_image.py Pillow-based OG image generation
app/services/api_keys.py API key generation utility
app/services/email.py Resend API email delivery for OTP
mcp/server.py MCP server with 25 tools + 3 prompts (stdio transport)
app/routes/mcp_http.py Remote MCP endpoint (Streamable HTTP transport at /mcp)
lightpaper_mcp/ Standalone PyPI package for MCP server distribution
AGENTS.md OpenAI AGENTS.md standard — project-level agent instructions
init.sql Database schema (13 tables)
migrations/*.sql Idempotent SQL migrations (run at startup)

Read the full file on GitHub · 353 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 353 lines · 5,450 tokens per session scan A 71917725e418

Subscribe to this mod's changes

lightpaper CLAUDE.md is an instructions file published in the GitHub repository lightpaperorg/lightpaper (0 stars, last pushed 2mo ago), licensed MIT. It adds 5,450 tokens to every session, about $0.0272 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.