Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/popstas/windows-mqtt/agents-mdgit clone --depth 1 https://github.com/popstas/windows-mqttWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/popstas/windows-mqtt/agents-md)<a href="https://agentmods.dev/instructions/popstas/windows-mqtt/agents-md"><img src="https://agentmods.dev/badge/instructions/popstas/windows-mqtt/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04365 | $0.04365 |
| Opus 5 | $0.02183 | $0.02183 |
| Sonnet 5 | $0.00873 | $0.00873 |
| Haiku 4.5 | $0.00436 | $0.00436 |
Grade A, and why
windows-mqtt AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 269 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS Instructions
This repo contains a Node.js project for controlling a PC via MQTT, wrapped in a Tauri v2 desktop app.
Environment
Run source "$HOME/.cargo/env" before any cargo/rust commands.
ESM-соглашения
Весь JS в проекте — ES-модули ("type": "module" в package.json). При правке кода:
- Относительные импорты обязаны нести расширение
.js(./foo.js, не./foo). - CJS-зависимости импортируются дефолтом и деструктурируются
(
import pkg from 'x'; const { thing } = pkg;), а не именованными импортами — именованные экспорты из CJS зависят отcjs-module-lexer, который ненадёжен на пакетах с нативными аддонами. - Если у зависимости в
exportsесть ключrequire, но нетimport, голыйimportуходит вdefaultи может отличаться от того, что отдавалrequire()— именно так одна строка молча сменила протокол OBS на msgpack вместо JSON (src/modules/obs.js, обходится импортом подпутиobs-websocket-js/json). Перед переводом любой зависимости стоит сверитьimport.meta.resolve('pkg')с прежнимrequire.resolve('pkg'). - Тот же механизм уже стоил второго модуля:
wsпод ESM резолвится вwrapper.mjs, чейdefault— классWebSocketБЕЗ статик, поэтомуnew WebSocket.Server()изsrc/modules/tabs.jsпадал с TypeError с самого перехода на ESM (глоталinitModules()). Сервер берётся только именованным импортомimport { WebSocketServer } from 'ws'—wrapper.mjsнастоящий ESM, оговорка проcjs-module-lexerк нему не относится. require()в проекте больше нет.- Планка рантайма:
import.meta.dirnameтребует Node ≥ 20.11 (боевой код),registerHooks— Node ≥ 22.15 (только тесты,test/modules-registry.test.js). Поляenginesвpackage.jsonнамеренно нет. data/под.gitignoreи содержит CommonJS-файлы (data/index.jsи т. п.), поэтому там лежит собственныйdata/package.jsonс{"type":"commonjs"}— на свежем клоне его надо создать заново.
Tauri Architecture
- Tauri v2 (not v1, not Electron). Config schema:
https://schema.tauri.app/config/2 - Rust backend in
src-tauri/src/main.rs— resolves an "app root" (dev: project root; bundled:resource_dir/_up_) viaresolve_app_root, spawns the Node.js server fromsetup()as a child process viatauri-plugin-shell, and kills it gracefully on Quit (sendsapp/shutdownIPC action, then hard-kills after 800ms) - Permissions defined in
src-tauri/capabilities/default.json(replaces v1allowlist) - Tray icon built inside
.setup()usingTrayIconBuilder, withon_menu_eventandon_tray_icon_eventclosures - Shell commands use
app.shell().command()(fromShellExttrait), NOTtauri::api::process::Command CommandEvent::Stdout/StderrreturnsVec<u8>, convert withString::from_utf8_lossy- Build check:
cd src-tauri && cargo check - Типы без TypeScript:
jsconfig.jsonвключаетcheckJs,npm run typecheck(tsc --noEmit) гоняется первым шагомnpm test. Файлы остаются.js, шага сборки нет —bundle.resources,deploy-fast.jsи спавнsrc/index.jsиз Rust продолжают работать с россыпью исходников.strictнамеренно выключен: в нём проект даёт ~450 ошибок, из них ~380 — разметка implicit any без единого реального дефекта. Формы конфига описаны одним@typedef Configвsrc/config-loader.js(индексная сигнатура: ключи задаёт пользователь в YAML). Нетипизированные зависимости обязаны иметь@types/*в devDependencies — иначеallowJsзаставляетtscпроверять их собственный JS и сыпать сотней чужих ошибок. - JS tests:
npm test(npm run typecheck && node --test test/**/*.test.js). Pure logic only — never spawn Windows/native binaries in tests. Modules with native addons are covered bytest/native-modules.test.js, which auto-skips where those addons aren't installed (e.g. Linux). - JS/Rust config-path coupling:
resolveAppFile/resolveConfigPathinsrc/paths.jsmust stay in sync withconfig_candidates/resolve_config_pathinsrc-tauri/src/main.rs(same search order, sameconfig.example.ymlfallback). - Dev run:
npm run start-tauriorcargo tauri dev. The npm scripts usescripts/tauri-wrapper.jsto ensure MSVC linker is available when running from Git Bash (vcvars64.bat is invoked before Tauri). If you seeLNK1181: cannot open input file 'kernel32.lib', ensure the "Desktop development with C++" workload includes the Windows 10/11 SDK.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 269 lines · 4,365 tokens per session scan A b46b5f886b60
windows-mqtt AGENTS.md is an instructions file published in the GitHub repository popstas/windows-mqtt (10 stars, last pushed 18d ago), licensed MIT. It adds 4,365 tokens to every session, about $0.0218 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
cml-mcp AGENTS.md
AGENTS.md instructions for xorrkaz/cml-mcp, covering agents.md — cml mcp server, project overview, compatibility goal, repository layout and tool modules (src/cmlmcp/tools/).
brilliant_sdk AGENTS.md
Instructions for brilliantlabsAR/brilliant_sdk, covering brilliant sdk — agent guide, how an app works (the pattern behind everything), minimal reading paths, verify without hardware and testing.
NeoMind CLAUDE.md
Claude Code instructions for camthink-ai/NeoMind, covering neomind — edge ai platform for iot, development commands, ecosystem repositories, extension package contract (.nep) and device type template contract (json).
cad-cae-copilot copilot-instructions.md
Copilot instructions for armpro24-blip/cad-cae-copilot, covering github copilot — aieng workspace and essentials.
phone-mcp CLAUDE.md
Claude Code instructions for premex-ab/phone-mcp, covering claude.md, project overview, build commands, architecture and module layout.
zmk-config AGENTS.md
AGENTS.md instructions for urob/zmk-config, covering customization guide, ground rules, how the multi-board layout works, adding a new board and where to change what.