Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/marianfoo/btp-cf-mcp/agents-mdgit clone --depth 1 https://github.com/marianfoo/btp-cf-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/marianfoo/btp-cf-mcp/agents-md)<a href="https://agentmods.dev/instructions/marianfoo/btp-cf-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/marianfoo/btp-cf-mcp/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02969 | $0.02969 |
| Opus 5 | $0.01484 | $0.01484 |
| Sonnet 5 | $0.00594 | $0.00594 |
| Haiku 4.5 | $0.00297 | $0.00297 |
Grade A, and why
btp-cf-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 146 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Guidance for AI coding agents working in this repo. Single source of truth — CLAUDE.md imports it.
Keep it terse: task → files + ≤1 gotcha per row. Deep detail lives in docs/ (read on demand).
If you need the full project story, read docs/agent/onboarding.md; for docs placement/naming, read
docs/docs-conventions.md.
Project Overview
btp-cf-mcp is a TypeScript MCP (Model Context Protocol) server for SAP BTP + Cloud Foundry management,
deployed on BTP Cloud Foundry, running IAS-first per-user auth. Tool surface (ADR-016/S3): reads and writes are
SEPARATE tools — CFInspect / BTPInspect (reads, readOnlyHint:true) + CFApps / BTPServices
(writes, blast-radius-grouped, hidden by default, not-yet-implemented). It reuses @arc-mcp/xsuaa-auth patterns
and the arc-1 scope/safety model.
Status & DECIDED direction — read the plan before touching auth or tools. The code below is the as-built PoC plus partial IAS/per-user spike code. Decided 2026-06-30: move to IAS-first inbound where the server issues its own MCP token and holds the IAS credential sealed (ADR-009/017); per-user CF and BTP (BTP via the CLI Server, ADR-004; CIS demoted to fallback, ADR-003); and a ≤12 resource-split
CF*/BTP*tool surface with reads separated from writes (ADR-016). Build toward the plan, not toward the current PoC shape.
Design Principles
- Read-only by default, opt-in power —
ALLOW_WRITES=false; every mutation refused until enabled + target allowlisted. - Two authz layers — the MCP scope gate (
read/write/admin) is defense-in-depth + LLM-surface control; the real authz is the user's BTP/CF roles (per-user) or the technical identity's (shared). - Fail closed — no auth method configured ⇒ refuse to start (unless
ALLOW_OPEN); per-user scopes only narrow the server ceiling. - Call the REST APIs the CLIs use — not the CLI binaries (Cloud Controller API + CIS REST), unless
cf push/exotic commands force it. - Per-credential scope — one CIS key / one CF identity = one subaccount/GA; no roaming.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 146 lines · 2,969 tokens per session scan A a9e7f53d7e35
btp-cf-mcp AGENTS.md is an instructions file published in the GitHub repository marianfoo/btp-cf-mcp (2 stars, last pushed 5d ago), licensed MIT. It adds 2,969 tokens to every session, about $0.0148 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
aks-mcp copilot-instructions.md
Copilot instructions for Azure/aks-mcp, covering copilot instructions, project overview, architecture, high-level structure and key components.
sap-mcp-servers AGENTS.md
Instructions for marianfoo/sap-mcp-servers, covering agents.md — sap-mcp-servers monorepo, what this repo is, the one thing to know: build order, first-time setup and everyday commands (run from repo root).
sap-mcp-servers CLAUDE.md
Instructions for marianfoo/sap-mcp-servers: This repo's contributor/agent guide lives in AGENTS.md — read that. It applies to all agents (Claude Code, Codex, Cursor, …), not just Codex, and covers the workspace layout, the build order (auth first), the env contract, secrets policy, and the release/publish flow.
VCF Orchestrator Agent
Practical operating instructions for AI agents working on the VCF Automation Orchestrator MCP server.
sap-adt-mcp CLAUDE.md
Claude Code instructions for engoetz/sap-adt-mcp, covering claude.md, what this is, commands, architecture and invariants that are easy to break.
sap-adt-mcp AGENTS.md
AGENTS.md instructions for engoetz/sap-adt-mcp, covering sap adt python — agent instructions, available mcp tools, abap development workflow, first-time setup (once per environment) and before editing any abap object.