What is server AGENTS.md?

Project-specific instructions for the mcpambassador/server codebase. They describe its documentation, review agreements, required checks, and the conditions a change must meet before it is considered complete.

Use them when changing this repository to find the right project documents, obtain required reviews, update status records, and run builds, linting, type checks, formatting checks, and tests.

They give a coding agent the repository's local rules and prevent unfinished changes from being treated as done. The CI gate, meaning the same build and test checks used in automated integration, makes completion verifiable.

server AGENTS.md — Instructions file by mcpambassador

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/mcpambassador/server/agents-md

Clone the repo

git clone --depth 1 https://github.com/mcpambassador/server

Made for: Codex, OpenCode.

Per session 411 This file is loaded in full into every session.

When invoked 411 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00411	$0.00411
Opus 5	$0.00205	$0.00205
Sonnet 5	$0.00082	$0.00082
Haiku 4.5	$0.00041	$0.00041

Measured 2d ago against content hash cff3f8d7625c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

server AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 36 lines

What it actually says

Project Instructions

Current State

Development plan: mcpambassador_docs/dev-plan.md
Architecture: mcpambassador_docs/architecture.md
Status: mcpambassador_docs/status.md

Working Agreements

All code changes require Code Reviewer review before merge
Security Engineer signs off on auth, crypto, and external API changes
Database Engineer signs off on schema changes
Write outputs to mcpambassador_docs/ — not just chat
Update mcpambassador_docs/status.md after completing any task
Append to mcpambassador_docs/lessons-learned.md, never overwrite

Definition of Done — CI Gate (MANDATORY)

No code change is considered complete until ALL of the following pass locally:

pnpm -r build        # All 8+ packages compile
pnpm -r lint         # 0 errors (warnings OK)
pnpm format:check    # All files match Prettier style
pnpm -r typecheck    # tsc --noEmit passes in every package
pnpm -r test         # All tests pass

If any step fails, the agent MUST fix the issue before calling the task complete. These mirror the GitHub Actions CI workflow (.github/workflows/ci.yml).

Common gotchas

Prettier: After editing ANY .ts, .json, or .md file, run pnpm format before committing
ESLint: The config is eslint.config.js (ESLint 10 flat config). No .eslintrc.* files.
Typecheck: Each package has its own tsconfig.json extending tsconfig.base.json. Changes to shared types can break downstream packages.
Node version: CI runs on Node 20. Do not use APIs added after Node 20 (e.g., import.meta.dirname requires Node 21.2+).

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 36 lines · 411 tokens per session scan A cff3f8d7625c

Subscribe to this mod's changes

server AGENTS.md is an instructions file published in the GitHub repository mcpambassador/server (3 stars, last pushed 7d ago), licensed Apache-2.0. It adds 411 tokens to every session, about $0.0021 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

admin-dashboard ai-tools audit authentication authorization docker

server AGENTS.md

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

What it actually says

Project Instructions

Current State

Working Agreements

Definition of Done — CI Gate (MANDATORY)

Common gotchas

What this file has done since we first saw it

Other instructions, from other repositories

gvray-admin CLAUDE.md

thunderid AGENTS.md

thunderid copilot-instructions.md

cloakbrowser-mcp AGENTS.md

KACHOW-Teknofest-2026 AGENTS.md

gh-mcp CLAUDE.md