What is devnotes CLAUDE.md?

Project instructions for the ohnotnow/devnotes repository, including how to get oriented and how its web app, command-line tool, and MCP server fit together. An MCP server lets AI tools interact with an application through a standard interface.

Use them at the start of work in this repository and when changing its Laravel app, Go command-line tool, API, or MCP server.

They provide the project context needed before making decisions, including where shared notes, authentication, and API behavior fit in.

devnotes CLAUDE.md — Instructions file by ohnotnow

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/ohnotnow/devnotes/claude-md

Clone the repo

git clone --depth 1 https://github.com/ohnotnow/devnotes

Per session 7,474 This file is loaded in full into every session.

When invoked 7,474 The same file — it is already loaded in full.

Security scan B 1 finding. Scan, not verified.

Origin 98% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.07474	$0.07474
Opus 5	$0.03737	$0.03737
Sonnet 5	$0.01495	$0.01495
Haiku 4.5	$0.00747	$0.00747

Measured today against content hash 93dd803ab7b0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

devnotes CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

Do not try and run any commands or tools that interact with the database. Either lando or artisan or boost. The user will run migrations for you if you ask.

Origin

This is a copy

98% identical to devnotes AGENTS.md — 24 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

CLAUDE.md · 533 lines

How it starts

The opening of the file, as written. The whole thing — 533 lines — stays where its author put it; the contents beside it link to each section on GitHub.

devnotes

A scrappy "wiki meets GitHub gists" for our small dev team: tiny markdown notes capturing gotchas and lessons, findable later. One Laravel app; the web UI, a Go CLI (sibling repo ../devnotes-cli), and the MCP server (live, Passport OAuth) are all clients of the same notes data - the first two via /api/v1 + Sanctum tokens. Frictionless capture is the thing to protect; recall matters as much as capture.

Get oriented (do this before deciding anything)

ant foundation - the vision and settled decisions (wiki-style editing IS the product; users are the gate, no allow-list; soft deletes; #id = real Eloquent id).
ant search "handover" - the session handover note has the full state, pending user decisions, and every hard-won gotcha (.env leaks into tests, apiResource route-name theft, soft-delete-vs-FK trap, Flux a11y defaults, permission gates).
ait ready and ait log - what's open and what shipped. The API contract lives in the epic descriptions, including two clarifying notes (everything is data-wrapped; PATCH needs full payloads).
The session-start surfacing design (ait show devnotes-UkLWZ) is deliberately undecided - it's a conversation with the user, never a guess.

House specifics for this repo

Local dev: lando at https://devnotes.lndo.site, login admin2x / secret (seeded). lando mfs (migrate:fresh + TestDataSeeder) is fine to run. Tests: php artisan test --compact - in-memory sqlite, no migrations needed; phpunit.xml pins the SSO_* keys because .env leaks into any key it doesn't pin.
Models use #[Fillable] attributes (see app/Models/User.php), not $fillable.
Any new model whose rows travel through export/import needs a ulid column minted on creation (see Note::booted()) - the ulid is the cross-install identity that keeps re-imports idempotent. Codes/ids do not survive merging two pots; ulids do.
Flux UI everywhere; create/edit forms use flux:modal variant="flyout". New screens need: flux:heading level=, autofocus in modals, aria-labels on switches - the a11y bar is real for us (.ac.uk).
Commits: agent-commit only (explicit file list, preview then --yes TOKEN, no attribution). The user has permitted its use; never push to GitHub without their say-so.
After finishing a piece of PHP work, run ./vendor/bin/phpstan analyse --memory-limit=2G - the repo holds PHPStan level 5 clean, so fix anything it reports before calling the work done.

Read the full file on GitHub · 533 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today First seen · 533 lines · 7,474 tokens per session scan B 93dd803ab7b0

Subscribe to this mod's changes

devnotes CLAUDE.md is an instructions file published in the GitHub repository ohnotnow/devnotes (0 stars, last pushed yesterday), licensed MIT. It adds 7,474 tokens to every session, about $0.0374 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). It is 98% identical to devnotes AGENTS.md, differing in 24 lines, and is treated as a copy.

Backend and APIs Languages Productivity

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,182 tokens

buildNext

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

devnotes CLAUDE.md