zotkit: Instructions file for Codex

AGENTS.md

zotkit AGENTS.md is an instructions file for Codex, OpenCode from oldantique/zotkit. It costs 1,786 tokens per session, scanned A, original, MIT.

A set of instructions for AI agents that manage Zotero libraries with zotkit. Zotero is a reference manager, and zotkit can access it through its online API without the Zotero desktop app.

In plain words
What is it for?
Installing and configuring zotkit, checking its setup, and managing a user’s Zotero library while avoiding exposure of credentials.
Why use it?
It gives agents a defined installation and setup process, including how to handle API keys and optional WebDAV file storage safely.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: reads .claude/ paths; mentions CLAUDE.md.

This is oldantique/zotkit's own configuration. It tells Codex and OpenCode how to work on zotkit itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything zotkit configures →

Reuse

Borrowing it

Nothing to install: this file belongs to oldantique/zotkit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/oldantique/zotkit/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/oldantique/zotkit

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for zotkit AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/oldantique/zotkit/agents-md/github.svg)](https://agentmods.dev/instructions/oldantique/zotkit/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/oldantique/zotkit/agents-md"><img src="https://agentmods.dev/badge/instructions/oldantique/zotkit/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for zotkit AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/oldantique/zotkit/agents-md"><img src="https://agentmods.dev/badge/instructions/oldantique/zotkit/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,786 This file is loaded in full into every session.
When invoked 1,786 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01786 $0.01786
Opus 5.5 $0.00714 $0.00714
Sonnet 5.5 $0.00357 $0.00357
Haiku 4.5 $0.00179 $0.00179

Measured 9d ago against content hash 3c1821e43cef, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

zotkit AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 127 lines

How it starts

The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Instructions for AI agents

You (an AI agent) were likely given this repo because your user wants you to manage their Zotero library with zotkit. Here is exactly how to proceed. (Developing zotkit itself instead? Read CLAUDE.md, not this file.)

1. Install

pipx install zotkit    # or: uv tool install zotkit / pip install zotkit

Requires Python 3.11+. Works on macOS, Windows, Linux — no Zotero desktop app needed.

2. Configure (interactive — involve the user)

Create the credentials file from .env.example at ./.env, ~/.config/zotkit/env, or $ZOTKIT_ENV:

  • Ask the user to create an API key (with write access) at https://www.zotero.org/settings/keys and tell you the key + the numeric userID shown on that page.
  • If they sync attachment files via WebDAV, ask them to open the Zotero desktop app → Settings → Sync → File Syncing and read you the WebDAV URL/username/password; append /zotero/ to the URL. (If they use Zotero Storage, skip the WEBDAV_* lines entirely — attach/fetch automatically use Zotero Storage instead.)
  • Never print, cat, echo, or commit the .env or any credential.

After writing the .env, run zotkit doctor — it validates config, API access, and attachment storage, and says what to fix. Don't proceed until it prints "all good". A "⚠ Zotero schema" line is a warning, not a failure: mention it to the user.

Optionally set up tag conventions from conventions.example.toml — do this WITH the user; read docs/organizing-with-agents.md first for the design principles (shallow single-axis collections, namespaced facet tags).

If the user asks you to clean up or reorganize their library — whether it's a mess or already organized — docs/organizing-with-agents.md is the complete playbook: design principles, the backup → read-only proposals → reviewed serial writes loop, and the audit checklist for second passes.

Read the full file on GitHub · 127 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago Changed · +30 lines · +461 tokens per session 3c1821e43cef
  2. 27d ago Changed · +3 lines · +37 tokens per session 19d1823447f2
  3. 1mo ago Changed · +5 lines · +71 tokens per session d98ab4e64d36
  4. 2mo ago First seen · 89 lines · 1,217 tokens per session scan A e0e6604474c4

Subscribe to this mod's changes

zotkit AGENTS.md is an instructions file published in the GitHub repository oldantique/zotkit (27 stars, last pushed 10d ago), licensed MIT. It adds 1,786 tokens to every session, about $0.0071 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

zotkit AGENTS.md compared with instructions from other repositories

zotkit AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
zotkit AGENTS.mdoldantique/zotkitInstructions file2710d agoMITA1,786Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode