Borrowing it
Nothing to install: this file belongs to PostHog/posthog-foss. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PostHog/posthog-foss/master/AGENTS.mdgit clone --depth 1 https://github.com/PostHog/posthog-fossWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/posthog/posthog-foss/agents-md)<a href="https://agentmods.dev/instructions/posthog/posthog-foss/agents-md"><img src="https://agentmods.dev/badge/instructions/posthog/posthog-foss/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.10714 | $0.10714 |
| Opus 5 | $0.05357 | $0.05357 |
| Sonnet 5 | $0.02143 | $0.02143 |
| Haiku 4.5 | $0.01071 | $0.01071 |
Grade B, and why
posthog-foss AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- CI uploads test results to Trunk Flaky Tests; the `trunk` MCP server in `.mcp.json` queries per-test flakiness on a PR or `master` (authenticate via `/mcp`, or a `TRUNK_API_TOKEN` bearer header when headless) — see `/d How it starts
The opening of the file, as written. The whole thing — 301 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PostHog Development Guide
Codebase Structure
- Key entry points:
posthog/api/__init__.py(API URL routing skeleton; products register their own routes inproducts/<name>/backend/routes.pyviaregister_routes(routers)),posthog/settings/web.py(Django settings, INSTALLED_APPS),products/(product apps) - Monorepo layout - high-level directory structure (products, services, common, tools)
- Products README - how to create and structure products
- Products architecture - DTOs, facades, isolated testing
Commands
- Environment:
- This is a full dev environment, not a restricted patch-editing sandbox — it has
node,pnpm, a package mirror, andapt, so tools and dependencies that aren't present yet can be installed, and tests, Storybook, and the app can actually be run. A missingnode_modules, browser binary, or flox usually just means setup hasn't run yet (pnpm install,npx playwright install --with-deps chromium, or building the nested@posthog/quillworkspace thatglobal.scssimports), rather than that running things is impossible. - So the absence of a tool isn't evidence that a task can't be done — installing it is the first step. The honest signal that something genuinely can't run is an attempt that fails for a specific, nameable reason (no network access,
aptunavailable, out of memory), which is worth reporting alongside whatever fallback you take. - This matters most for visual and UX work, where reading the code isn't the same as seeing the result. Rendering the affected surface (for example in Storybook via a headless browser) and comparing before and after is what actually confirms such a change, and is usually worth the setup cost.
- Use flox when available — prefer
flox activate -- bash -c "<command>"if commands fail- Never use
flox activatein interactive sessions (it hangs if you try)
- Never use
- This is a full dev environment, not a restricted patch-editing sandbox — it has
- Tests:
- Universal:
hogli test <file_or_directory>— auto-detects test type (Python, Jest, Playwright, Rust, Go) - Single test:
hogli test path/to/test.py::TestClass::test_method - Watch mode:
hogli test path/to/test.py --watch - Changed files only:
hogli test --changed
- Universal:
- Lint:
- Python:
ruff check . --fixandruff format .
- Frontend:
pnpm --filter=@posthog/frontend fix(safe Oxlint fixes + Oxfmt; suggestion fixes are not applied).formatruns Oxfmt only;lintandformat:checkonly verify. - TypeScript check:
pnpm --filter=@posthog/frontend typescript:check
- Python:
- Build:
- Frontend:
pnpm --filter=@posthog/frontend build - Start dev:
./bin/startorhogli start(interactive TUI). Detached mode:hogli up -dpaired withhogli wait/hogli down- Cloud task VMs (prebaked dev-stack image): run
bootstrap-dev-stackfirst (restores compose host aliases, starts dockerd), thenuv sync,source .venv/bin/activate,hogli start -y -d, andhogli wait(the detached start returns while the stack is still booting;hogli waitblocks until every process is ready) — always detached: the sandbox has no TTY, and phrocs under a pseudo-TTY balloons in memory until OOM-killed - Cloud task VMs: on user-created runs the backend usually starts the stack itself. While it does,
hogli startexits without starting anything. Poll/tmp/posthog-preview/status.jsonuntilstateisreadyorfailed. Onready, runhogli wait; it reportsnot reachableuntil the backend reaches the phrocs step, so retry it rather than forcing a second start. Onfailed(the backend does not retry), start the stack yourself withhogli start -y -d - Cloud task VMs, frontend work:
pnpm install --frozen-lockfile --prefer-offlinelinks from the prebaked pnpm store, and Playwright Chromium is preinstalled; product/Storybook builds still run from source - Cloud task VMs, tests: scope every run to what you changed, with
hogli test --changedor the test files that cover the touched code. Run a whole module, package, or repo-wide suite at most once, right before you push, and only for a cross-cutting change. CI runs the full matrix; repeating it in the sandbox costs minutes per run and floods the context with output. In a sandboxhogli testruns pytest with-q(setHOGLI_TEST_VERBOSE=1to stream prints).pytest.inialready enables--reuse-db, and the prebaked dev-stack image seedstest_posthog; do not pass--create-dbor override pytestaddopts, because either discards the prewarmed schema. If pytest starts the full migration history, the VM image predates the database seed or the test database was replaced. Let that migration finish before retrying; interrupting it leaves a partial database that the next run must continue migrating.
- Cloud task VMs (prebaked dev-stack image): run
- Frontend:
- OpenAPI/types:
hogli build:openapi(regenerate after changing serializers/viewsets) - LSP: Pyright is configured against the flox venv. Prefer LSP (
goToDefinition,findReferences,hover) over grep when navigating or refactoring Python code. - Dev experience feedback:
hogli devex:feedback "<message>"sends feedback about repo tooling — hogli, the dev stack, tests, CI, migrations, this setup — straight to the devex team as ahogli_feedbackevent (add-c bug|idea|praise|question). Local agents must use it too: when a hogli command or local dev workflow is broken, slow, or confusing, run it — e.g.hogli devex:feedback -c bug "migrations:run failed with <error>". Do not run it from cloud tasks or agent-server sandboxes; the command is a no-op there.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · -21 lines · +101 tokens per session 34e7a04eaa8c
- 3d ago Changed · +24 lines · +303 tokens per session 8a38bb94e5f2
- 3d ago First seen · 298 lines · 10,310 tokens per session scan B ba2b9ff79ac1
posthog-foss AGENTS.md is an instructions file published in the GitHub repository PostHog/posthog-foss (714 stars, last pushed today), licensed MIT. It adds 10,714 tokens to every session, about $0.0536 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.