Borrowing it
Nothing to install: this file belongs to Ninh-Duong/mcp-pr-companion. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Ninh-Duong/mcp-pr-companion/master/AGENTS.mdgit clone --depth 1 https://github.com/Ninh-Duong/mcp-pr-companionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ninh-duong/mcp-pr-companion/agents-md)<a href="https://agentmods.dev/instructions/ninh-duong/mcp-pr-companion/agents-md"><img src="https://agentmods.dev/badge/instructions/ninh-duong/mcp-pr-companion/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ninh-duong/mcp-pr-companion/agents-md"><img src="https://agentmods.dev/badge/instructions/ninh-duong/mcp-pr-companion/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.05322 | $0.05322 |
| Opus 5.5 | $0.02129 | $0.02129 |
| Sonnet 5.5 | $0.01064 | $0.01064 |
| Haiku 4.5 | $0.00532 | $0.00532 |
Grade A, and why
mcp-pr-companion AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md: operating manual for AI agents
This repository is built almost entirely by AI agents. Any agent that edits it (Claude, Codex, Gemini, Cursor, Copilot, …) must follow this file. When something here conflicts with your habits, this file wins. When it conflicts with the code, the code is a bug: fix the code or ask the user. Do not quietly change the rule.
What this is: a read-only MCP server (stdio) plus a terminal CLI. Both turn Bitbucket Cloud pull requests into privacy-sanitized, paged context for AI agents. Most of the time it runs as a child of mcp-hub, which renames its tools to pr__<tool>.
1. Invariants (never break these)
| # | Rule | Why | Enforced by |
|---|---|---|---|
| 1 | stdout carries only JSON-RPC. Never use console.log / process.stdout in src/mcp/, src/core/ or src/utils/. Log through Logger (src/utils/logger.ts), which writes to stderr and Logs/mcp-server.log. console.log is allowed only in src/cmd/ (the interactive CLI). |
One stray line corrupts the MCP stream and the hub drops the server. | tests/stdio.test.ts |
| 2 | Bitbucket is read-only. Only GET requests, all through src/core/bitbucket/bitbucket.client.ts (or pagination.ts), which call fetchWithRetry in http.ts, the only fetch() call site. Never add approve, merge, comment or any other write call. The token needs only read:user, read:pullrequest and read:repository. |
The product promise and the token scopes in .env.example. |
review |
| 3 | Nothing unsanitized leaves the process. Stored PR data passes through DataStore.saveRevision (allowlist projection → PIISanitizer → SecretScanner → PathSanitizer). Live PR text uses the same sanitizers before return. Tool errors pass through SecretScanner. Never return raw API responses, and never put a token, email or full path in an error message. |
Users point agents at private repositories. | tests/security.test.ts, tests/server.test.ts §8 |
| 4 | Tool output is bounded. Any growing text is paged with offset / max_chars through PRContextService.page() or explicitly capped. Lists take a limit. |
A hub client has a context budget. One unbounded diff fills it. | tests/server.test.ts §7 |
| 5 | The disk is the source of truth. No in-memory caches of PR data. current.json is the commit point: it is written last, after RevisionValidator passes. PRs live under a status directory; after a valid new revision is published, retained revisions in old directories are migrated. |
Several processes (CLI, MCP) share ai-context/. |
tests/atomic_write.test.ts, tests/integrity.test.ts |
| 6 | Paths are relative to the working directory, and the launcher sets it. Every entry point runs through bin/cli.js, which spawns with cwd = project root. Keep using relative paths (ai-context/, Logs/, .mcp-pr-companion/) and never hardcode absolute paths. Tests rely on this: tests/run.mjs runs each file in a temp cwd. |
Portable across machines and isolated in tests. | tests/run.mjs |
| 7 | The schema v4 on-disk format is frozen. Do not rename current.json, manifest.json, files.index.jsonl, commits.jsonl, coverage.json, files/<id>/change.json, patch.diff, the file_NNNN id format or any schema field. Additive optional fields are fine; update the zod schema in src/core/output/schema/ in the same change. |
Existing ai-context/ folders and other tools read them. |
tests/contract.test.ts |
| 8 | No new dependency without a row in docs/DEPENDENCIES.md explaining why stdlib or an installed package cannot do it. | Supply chain and startup time. Every child of the hub runs npm ci. |
review |
| 9 | Configuration lives only in env vars (.env, loaded by bin/cli.js via process.loadEnvFile; under mcp-hub, bin/cli.js first fills unset Bitbucket values from the hub's bitbucket block in CENTRAL_CONFIG_PATH: process env > hub > .env, empty = unset, see docs/HUB_INTEGRATION.md §2). Read env in src/config/config.manager.ts only. Add each new variable to .env.example and the README config table. Never read .env from code, never print values, never commit .env. |
One place to look, and secrets stay out of git. | .gitignore |
| 10 | ALLOWED_EMAILS is enforced on every path. The CLI checks it at login; the MCP path checks it in BitbucketCollector's constructor. Do not construct a BitbucketClient from env credentials anywhere else. |
Lets a team lock the tool to known accounts. | tests/server.test.ts §12 |
| 11 | ai-context is encrypted at rest; only secure-file.ts touches its bytes. Read and write every file under ai-context/ through readSecure / writeSecure (src/core/storage/secure-file.ts), usually via OutputReader / RevisionWriter. Never fs.readFileSync / writeFileSync a file there, never decrypt elsewhere, and never put content in a file or folder name. An entry point must await AccessGate.unlock(workspace, repo) before reading or writing. The key material (repository UUID) stays in memory: never log it, return it or write it to disk. PRC1 and the HKDF info string are frozen. See docs/ENCRYPTION.md. |
Users must not be able to read synced PR data without a successful Bitbucket check. | tests/secure-file.test.ts, tests/server.test.ts §9a |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +13 tokens per session ab99497014da
- 7d ago Changed · +222 tokens per session 7ffb0e2ee155
- 10d ago Changed · +125 tokens per session ec77c89456b6
- 17d ago Changed · +5 lines · +674 tokens per session d7e9113ff8d9
- 19d ago First seen · 116 lines · 4,288 tokens per session scan A 3748dbcb3004
mcp-pr-companion AGENTS.md is an instructions file published in the GitHub repository Ninh-Duong/mcp-pr-companion (0 stars, last pushed 5d ago), licensed MIT. It adds 5,322 tokens to every session, about $0.0213 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-20.
mcp-pr-companion AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| mcp-pr-companion AGENTS.mdNinh-Duong/mcp-pr-companion | Instructions file | 0 | 5d ago | MIT | A | 5,322 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,516 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | yesterday | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | today | MIT | A | 4,680 | Codex, OpenCode |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| vscode model-prompts.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 2,022 | GitHub Copilot |