Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/markusneusinger/cite-citadel/copilot-instructionsgit clone --depth 1 https://github.com/MarkusNeusinger/cite-citadelWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.14711 | $0.14711 |
| Opus 5 | $0.07355 | $0.07355 |
| Sonnet 5 | $0.02942 | $0.02942 |
| Haiku 4.5 | $0.01471 | $0.01471 |
Grade A, and why
cite-citadel copilot-instructions.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- cite-citadel CLAUDE.md — 91% identical, 9 lines differ
How it starts
The opening of the file, as written. The whole thing — 676 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Copilot instructions — cite-citadel
Repository guidance for GitHub Copilot. Generated from CLAUDE.md — do not edit
this file by hand: change CLAUDE.md and regenerate with
CITADEL_WRITE_COPILOT_DOC=1 uv run pytest tests/test_packaging.py -k copilot -q. The drift guard in
tests/test_packaging.py fails whenever the two disagree.
What this is
cite-citadel (CLI: citadel, PyPI package: cite-citadel) is an LLM-maintained, fully-cited
personal wiki in Google's Open Knowledge Format, with an MCP server so an
AI can search and read it. It implements Karpathy's LLM-Wiki pattern: drop arbitrary text-bearing
files into raw/, and one agentic CLI session per source folds each into a cross-linked OKF wiki
under wiki/. Pure Python 3.12, KISS. Runtime deps are only mcp, pyyaml, pypdf, and rich
(all pure-Python, no native weight) — there is no LLM SDK and no API key: ingest shells
out to a coding-agent CLI you already have logged in
(claude/copilot/agy).
Commands
Setup: uv sync (creates .venv, installs deps + the dev group + the citadel script).
Use the portable invocation everywhere — it works identically on Linux/macOS/Windows and needs
no .exe (the uv run citadel … shorthand often breaks on Windows because AV quarantines uv's
generated citadel.exe):
uv run python -m citadel <subcommand>
Subcommands: init [DIR] (scaffold a workspace: citadel.toml marker, .env, raw/, wiki/;
idempotent), ingest [paths…] (fold raw/ into the wiki; --verbose/-v streams the agent
session, --log-dir DIR writes a transcript per source, --quiet drops the live progress display,
--jobs N/-j folds N sources in CONCURRENTLY (default 1 = serial; CITADEL_JOBS),
--full-rescan distrusts the manifest's stat cache and re-hashes every tracked source,
--force <paths> deliberately re-reads already-ingested sources as a reconcile — it requires
explicit paths and is refused without them, --reingest <paths> goes one step further: each named
tracked source is re-imported FRESH — a kind="delete" cleanup session strips its previous facts
(manifest entry dropped), then the same run ingests it as a brand-new source under the current
model + rules — the full re-think reconcile's keep-the-existing-treatment rule deliberately avoids
(requires explicit paths like --force; the two flags and --retry refuse to combine; a failed
cleanup blocks that source's fresh session), --retry re-runs everything STUCK without naming
paths: every failed source still on disk plus every ingested source no wiki page cites — the
zero-entry sources the run report flags as no_pages and status marks NO PAGES — as forced
reconciles; it refuses paths/--force and exits 0 when nothing is stuck, --guidance TEXT hands
this ONE run a free-text steer ("create one machine registry from the maintenance lists") appended
to each source-reading session's prompt — within the rules, never overriding citations; max 2000
chars, CITADEL_INGEST_GUIDANCE is the env twin, the MCP wiki_ingest takes it as a per-call
argument, and the steer joins the resume checkpoint identity),
refresh [--limit N] [--min-age-days D] [--dry-run] [--jobs N]
(the THIRD lifecycle: re-verify the least-recently-checked sources — ordered by the manifest's
ingested_at stamp, oldest/stampless first — through forced reconcile sessions on an explicit
per-run budget of N sources; the sustainable alternative to regenerating the wiki after a model
upgrade), curate [--dry-run] [--limit N] [--stale-rules] [--diff PATH] [--retry] [--guidance TEXT] [paths…] (the SECOND lifecycle: improve EXISTING pages —
re-sort/split/re-ground/resolve
contradictions/fix locators — against a recomputed findings checklist; --guidance is the curate
twin of ingest's steer — STRUCTURAL only, carried in the cluster's findings file, and the paths it
names (a page, a folder, a glob) are curated even when no detector flagged them), status (read-only
per-source state table: ingested / failed / skipped-duplicate / ignored / oversized / pending; MCP twin
wiki_status), doctor
(read-only setup health check — OK/WARN/FAIL lines for workspace / rules / config-parse fallbacks /
agent CLI / the configured ingest model / raw roots / wiki placement
(the wiki nested inside a raw root) / child paths (the UNC-vs-drive-letter cwd) /
manifest / billing / the HTTP-serve posture / wiki-git state / a best-effort PyPI update check / workspace coherence; needs no workspace, exits 1 only on a FAIL),
serve [--http [--host H] [--port P] [--path /mcp] [--read-only]] (the MCP server — stdio by
default; --http serves the SAME surface over MCP's Streamable HTTP transport for a client that is
not on this machine, mandatory bearer token, loopback default, optional read-only), capture <text> [--from WHO] [--topic T] (append one attributed note from a
conversation to the raw/ capture log raw/captures/YYYY-MM.md; - reads stdin; the next ingest
folds it in — the conversational-capture bridge, MCP twin wiki_capture),
search <query> [--tag T] [--limit N], define <term> / read <rel_path> /
raw <key> [--locator L] / neighbors <rel_path> / index / sources (CLI twins of the
wiki_define/wiki_read/wiki_raw/wiki_neighbors/wiki_index/wiki_sources MCP tools
— full CLI↔MCP parity),
tags [tag], lint [--stale-days N] (exit 3 when the report is not clean — its own code, distinct
from the usage/no-workspace exit 2), check [paths…], view [--out PATH] [--no-open] [--obsidian], rules list|show|eject. citadel --version prints the version and (like --help)
needs no workspace.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 676 lines · 14,711 tokens per session scan A add199328c3c
cite-citadel copilot-instructions.md is an instructions file published in the GitHub repository MarkusNeusinger/cite-citadel (2 stars, last pushed 4d ago), licensed MIT. It adds 14,711 tokens to every session, about $0.0736 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
pdf-reader-mcp AGENTS.md
AGENTS.md instructions for SylphxAI/pdf-reader-mcp, covering pdf-reader-mcp — local agent notes only, boundary hazards, local commands, validation notes and backend false-authority fence.
obsidian-mcp-server AGENTS.md
Instructions for cyanheads/obsidian-mcp-server, covering agent protocol, what's next?, core rules, patterns and tool — obsidianlisttags.
agentic AGENTS.md
Instructions for soulcodex/agentic, covering agentic library — agent instructions, what this repo contains, rules for working in this repo, file authoring and skill authoring.
student-llm-wiki AGENTS.md
Instructions for IssacW228/student-llm-wiki, covering student llm wiki — agent instructions, 操作规则 operation rules, token预算规则(最高优先级), 架构 architecture and 命令 commands.
llmwiki-cli CLAUDE.md
Instructions for doum1004/llmwiki-cli, covering llm wiki cli — ai / agent context, what this is, tech stack, llm agent skill guide and project structure.
llm-wiki CLAUDE.md
Instructions for ddsyasas/llm-wiki, covering project brief for claude code, read this first, core principles, do not violate, stack lock-in and working conventions.