Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/polygraphso/litmus/claude-mdgit clone --depth 1 https://github.com/polygraphso/litmusWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01877 | $0.01877 |
| Opus 5 | $0.00938 | $0.00938 |
| Sonnet 5 | $0.00375 | $0.00375 |
| Haiku 4.5 | $0.00188 | $0.00188 |
Grade A, and why
litmus CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
litmus — workspace context for Claude
This repo is the open @polygraphso/litmus harness — the behavioral litmus test for
MCP servers, its onchain proof (EAS attestation on Base), and the agent-gate. It is the
engine; the hosted, operator-run grading service that runs it lives in a separate
private repo and is not here.
This repository is public. Every commit, file, and history entry is world-readable. Never add secrets, credentials, internal hostnames, customer data, ops/infra config, the runner, or
.envfiles..env.examplecarries config shape only. Openness is the point: the grade is reproducible precisely because the harness is public, so anyone can re-run it and disprove a false grade.
Where to look first
README.md— what this repo is, the layout, build/test/release.packages/litmus/README.md— the npm-facing usage docs.- The methodology + proof spec live at polygraph.so (the prose docs
are not kept in this repo). The open source here —
packages/probes(the probes/grading) andpackages/onchain(the EAS schema/encode) — is the source of truth; anchor against the code and the published methodology, don't relitigate them.
What we're building (one paragraph)
A harness connects to an MCP server like an agent would — stdio for local packages, Streamable
HTTP for remote URLs — fingerprints the exact tool surface (tools/list → canonical JSON →
sha256 → bytes32), then runs four probe categories: C-01 tool-output injection, C-02
permission overreach (egress, in a hardened default-deny Docker sandbox with a sinkhole),
C-03 sensitive-data handling (planted canaries), C-04 adversarial-input handling
(malformed/oversized + jailbreak inputs; fails on crash, internals-leak, or amplification →
caps at D). It grades A–F and produces a
deterministic, content-addressed evidence bundle. This package grades and verifies only —
it does not mint (no pin-to-IPFS, no EAS write, no /mint hand-off). packages/onchain
keeps the EAS read/encode/decode + the agent-gate, so an agent can still verify a published
attestation; producing one is out of scope. The grade is reproducible — the harness is open
and deterministic, so anyone can re-run it against the same server and disprove a false grade.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 106 lines · 1,877 tokens per session scan A 3fd287dbcb7d
litmus CLAUDE.md is an instructions file published in the GitHub repository polygraphso/litmus (8 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 1,877 tokens to every session, about $0.0094 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
langgraph AGENTS.md
AGENTS.md instructions for langchain-ai/langgraph, covering agents instructions, corridor security analysis, libraries and dependency map.
agentgateway copilot-instructions.md
Copilot instructions for agentgateway/agentgateway: Do not check for, speculate about, or report compilation errors during code review. Compilation diagnostics from review are frequently incorrect; rely on CI to detect and report compilation failures.
hatch3r CLAUDE.md
Instructions for hatch3r/hatch3r, covering hatch3r — development instructions, architecture, development commands, two-axis pillar framework (2.0.0) and orchestrator self-discipline (bypass protection).
aeon CLAUDE.md
Instructions for aeonfun/aeon, covering aeon, how aeon works, strategy, voice and soul file hierarchy (read in this order).
ken CLAUDE.md
Instructions for townsendmerino/ken, covering claude.md, what this is, repository ownership (read this first), commands and embedding parity & golden fixtures (now in aikit).
gangsta GEMINI.md
Instructions for kucherenko/gangsta, a project described as: AI agentic skills framework for spec-driven development, built on the organizational model of mafia.