Borrowing it
Nothing to install: this file belongs to plumpslabs/matcha. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/plumpslabs/matcha/main/AGENTS.mdgit clone --depth 1 https://github.com/plumpslabs/matchaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/plumpslabs/matcha/agents-md)<a href="https://agentmods.dev/instructions/plumpslabs/matcha/agents-md"><img src="https://agentmods.dev/badge/instructions/plumpslabs/matcha/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/plumpslabs/matcha/agents-md"><img src="https://agentmods.dev/badge/instructions/plumpslabs/matcha/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03245 | $0.03245 |
| Opus 5.5 | $0.01298 | $0.01298 |
| Sonnet 5.5 | $0.00649 | $0.00649 |
| Haiku 4.5 | $0.00325 | $0.00325 |
Grade C, and why
matcha AGENTS.md scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- **Shield Protection Active:** Command execution is guarded by `matcha-shield.js` and MCP tools (`matcha_shield_check`, `matcha_post_write_scan`). Destructive commands (`rm -rf /`, `git push --force`, `git reset --hard` How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🍵 matcha — Core AI Directives
Simple. Efficient. Deliberate. Never twice.
Engineering philosophy for AI coding agents. Enforces deliberate, modular, and scalable thinking before, during, and after implementation.
<matcha_balance>
🧭 The Matcha Balance: Scalable & Modular, Not Golfed (Anti-Overengineering)
- Deliberate over Extreme Brevity: Matcha rejects code-golfing and artificial brevity. Do NOT write code that is as short as possible at the expense of readability, types, explicit error handling, modularity, or scalability. Terseness that creates brittle, hard-to-maintain code is technical debt. Build production-ready, clean, scalable code based on project conventions (
MATCHA_PROJECT.md). - Anti-Overengineering: Simplicity and efficiency are non-negotiable. Do NOT invent speculative abstractions, premature generalizations, or complex design patterns for simple problems. Never write 50-line plans for 2-line fixes.
- Proportionality Anchor: Match ceremony to reality:
- 🟢 Trivial (≤5 LOC, 1 file, no logic): Fast pass. Implement directly, verify with existing tests, no ceremonial overhead.
- 🟡 Standard / Feature (1-5 files): Modular, clean architecture, typed, test coverage.
- 🔴 Large / High Blast Radius (Cross-cutting, Auth, DB, Crypto): Full Intent Discovery, threat model, review gate. </matcha_balance>
<execution_filter>
The 6-Checkpoint Filter
🎯 Purpose → 🔎 Reuse → 🔍 Stack → 🛠️ Implementation → 🧹 Cleanup → ✅ Verify → 🔒 Review
| # | Checkpoint | Rule |
|---|---|---|
| 🎯 | Purpose + Reuse | Intent Discovery with evidence (file:line, metrics). Can't answer Why/How? → STOP unless trivial (≤5 LOC, 1 file, no logic) — then proceed on a recorded assumption. Search codebase first (src/, lib/, pkg/, app/). Never duplicate. |
| 🔍 | Stack | Scan manifests (package.json, Cargo.toml, go.mod, etc.) for service overlap. |
| 🛠️ | Implementation | No hardcode. Explicit errors. One function = one responsibility. Simpler path? → Use it. Deliberate-choice comments → // matcha: marker at write time (not cleanup). |
| 🧹 | Cleanup | Done = working AND clean. Mark deliberate shortcuts with // matcha: [reason] — standard format + English only. |
| ✅ | Verify | Run empirical test/build command. Fail? → STOP and fix immediately. |
| 🔒 | Review | Risk-tiered gate. L0/L1 async (non-blocking, verdict lands in background); L2/L3 blocking until PASS / EXPERT_REQUIRED. Catch bugs, performance, security, architecture. Nothing ships without PASS. |
| </execution_filter> |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +11 tokens per session 74c7234e1eb3
- 22d ago Changed · +7 lines · +302 tokens per session 8654dfd1cfd2
- 1mo ago Changed · +10 lines · +315 tokens per session 4becf00b9bb7
- 1mo ago Changed · +38 lines · +747 tokens per session f28f1a1629e0
- 1mo ago First seen · 88 lines · 1,870 tokens per session scan C 32d9a0bfcb1b
matcha AGENTS.md is an instructions file published in the GitHub repository plumpslabs/matcha (2 stars, last pushed 5d ago), licensed MIT. It adds 3,245 tokens to every session, about $0.0130 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.