rocannon AGENTS.md

Repository instructions for Rocannon, an MCP server that exposes installed Ansible modules as typed tools. Ansible is software for automating system and application setup.

In plain words
What is it for?
Use them when developing Rocannon, setting up its uv environment, understanding where module discovery happens, or running the required checks before committing.
Why use it?
They explain the project's architecture, required setup, and quality checks before an agent changes code. This helps keep changes compatible with the repository's strict formatting, type-checking, and test requirements.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/msradam/rocannon/agents-md
Clone the repo
git clone --depth 1 https://github.com/msradam/rocannon

Made for: Codex, OpenCode.

Per session 1,936 This file is loaded in full into every session.
When invoked 1,936 The same file — it is already loaded in full.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01936 $0.01936
Opus 5 $0.00968 $0.00968
Sonnet 5 $0.00387 $0.00387
Haiku 4.5 $0.00194 $0.00194

Measured 2d ago against content hash 673f5fd6e1b9, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

rocannon AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

`conda`. If `uv` is missing, install it (`brew install uv` or `curl -LsSf https://astral.sh/uv/install.sh | sh`) before doing anything

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`conda`. If `uv` is missing, install it (`brew install uv` or `curl
AGENTS.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Instructions for AI coding agents working on this repo (Claude Code, Cursor, Bob, Codex, etc.). Humans, start with README.md.

What Rocannon is

An MCP server that registers every installed Ansible module as a typed MCP tool. One server, every module auto-discovered from ansible-doc at startup. There is no plugin abstraction: Ansible is the engine. Module discovery and tool registration live in src/rocannon/ansible.py; cross-cutting concerns (middleware, profile switching, save/replay) live in src/rocannon/server.py.

Setup

uv sync                     # all dev deps including the `ansible` extra
./tests/check.sh            # ruff format + ruff check + mypy + pytest

uv is required. Do not use pip, python -m venv, pipx, or conda. If uv is missing, install it (brew install uv or curl -LsSf https://astral.sh/uv/install.sh | sh) before doing anything else.

Quality gates

Every change must pass ./tests/check.sh before commit. The script runs four steps and exits on the first failure:

  1. ruff format --check
  2. ruff check
  3. mypy --strict (against src/ and tests/)
  4. pytest -x -q (unit tests only; integration suite is opt-in)

Auto-fix mode: ./tests/check.sh --fix (format and lint auto-fix; type and test errors still surface).

Mypy runs in strict mode. The codebase has targeted # type: ignore[<code>] comments where the static and dynamic type systems meet (FastMCP dynamic signatures, the rare untyped third-party import). Do not broaden these to bare # type: ignore and do not add new ignores without a specific error code.

Architecture

src/rocannon/
├── cli.py              Typer entrypoint. Subcommands: mcp serve|doctor,
│                       repl, run, doctor, doc, search, ls, playbook.
├── config.py           Pydantic Config model + YAML profile loader.
│                       Resolves profile-relative paths against the profile
│                       file's parent, not the process CWD.
├── profiles.py         .rocannon/profiles/ discovery, ProfileRegistry,
│                       RuntimeContext for runtime profile switching.
├── ansible.py          register_ansible_modules(): reads ansible-doc,
│                       registers one typed MCP tool per module, plus the
│                       rocannon://inventory and rocannon://module/<fqcn>
│                       resources.
├── server.py           create_server(). Wires middleware, calls
│                       register_ansible_modules, registers save_playbook +
│                       commit_session + rocannon_{list,current,use}_profile.
├── schema.py           ansible-doc parsing, module expansion, type mapping.
├── executor.py         ansible-runner Python-API wrapper + result parsing.
├── playbook.py         Playbook model {tool, args}. Persisted as YAML,
│                       loaded as MCP prompts.
├── repl.py             Operator REPL: same in-process MCP server, prompt
│                       toolkit shell, history, .save, optional .ai mode.
├── inventory.py        ansible-inventory subprocess wrapper.
├── history.py          In-memory ring buffer feeding save_playbook.
├── correlation.py      Request correlation IDs for the audit log.
└── redaction.py        Secrets redaction in audit records.

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 190 lines · 1,936 tokens per session scan C 673f5fd6e1b9

Subscribe to this mod's changes

rocannon AGENTS.md is an instructions file published in the GitHub repository msradam/rocannon (5 stars, last pushed 1mo ago), licensed MIT. It adds 1,936 tokens to every session, about $0.0097 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.