posthog-foss: Instructions file for Claude Code

AGENTS.md

posthog-foss AGENTS.md is an instructions file for Claude Code, Codex, OpenCode from PostHog/posthog-foss. It costs 10,714 tokens per session, scanned B, original, MIT.

A project guide for contributing to the PostHog open-source codebase, including its layout, development commands, and contribution process. It explains the monorepo, a single repository containing several related projects.

In plain words
What is it for?
Use it when starting a task, finding the right files, running development commands, or preparing commits and pull requests.
Why use it?
It gives coding agents the project context needed to navigate the repository and follow its development and pull-request conventions.

Instructions file for Claude CodeCodexOpenCode

Written for Claude Code and Codex and OpenCode: SessionStart hook event, but also the file is AGENTS.md. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions Claude Code.

This is PostHog/posthog-foss's own configuration. It tells Claude Code, Codex and OpenCode how to work on posthog-foss itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything posthog-foss configures →

Reuse

Borrowing it

Nothing to install: this file belongs to PostHog/posthog-foss. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/PostHog/posthog-foss/master/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/PostHog/posthog-foss

Made for: Claude Code, Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for posthog-foss AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/posthog/posthog-foss/agents-md.svg)](https://agentmods.dev/instructions/posthog/posthog-foss/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/posthog/posthog-foss/agents-md"><img src="https://agentmods.dev/badge/instructions/posthog/posthog-foss/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 10,714 This file is loaded in full into every session.
When invoked 10,714 The same file — it is already loaded in full.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.10714 $0.10714
Opus 5 $0.05357 $0.05357
Sonnet 5 $0.02143 $0.02143
Haiku 4.5 $0.01071 $0.01071

Measured yesterday against content hash 34e7a04eaa8c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade B, and why

posthog-foss AGENTS.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads MCP configurationmediumAgent snooping

mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.

- CI uploads test results to Trunk Flaky Tests; the `trunk` MCP server in `.mcp.json` queries per-test flakiness on a PR or `master` (authenticate via `/mcp`, or a `TRUNK_API_TOKEN` bearer header when headless) — see `/d
AGENTS.md · 301 lines

How it starts

The opening of the file, as written. The whole thing — 301 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PostHog Development Guide

Codebase Structure

  • Key entry points: posthog/api/__init__.py (API URL routing skeleton; products register their own routes in products/<name>/backend/routes.py via register_routes(routers)), posthog/settings/web.py (Django settings, INSTALLED_APPS), products/ (product apps)
  • Monorepo layout - high-level directory structure (products, services, common, tools)
  • Products README - how to create and structure products
  • Products architecture - DTOs, facades, isolated testing

Commands

  • Environment:
    • This is a full dev environment, not a restricted patch-editing sandbox — it has node, pnpm, a package mirror, and apt, so tools and dependencies that aren't present yet can be installed, and tests, Storybook, and the app can actually be run. A missing node_modules, browser binary, or flox usually just means setup hasn't run yet (pnpm install, npx playwright install --with-deps chromium, or building the nested @posthog/quill workspace that global.scss imports), rather than that running things is impossible.
    • So the absence of a tool isn't evidence that a task can't be done — installing it is the first step. The honest signal that something genuinely can't run is an attempt that fails for a specific, nameable reason (no network access, apt unavailable, out of memory), which is worth reporting alongside whatever fallback you take.
    • This matters most for visual and UX work, where reading the code isn't the same as seeing the result. Rendering the affected surface (for example in Storybook via a headless browser) and comparing before and after is what actually confirms such a change, and is usually worth the setup cost.
    • Use flox when available — prefer flox activate -- bash -c "<command>" if commands fail
      • Never use flox activate in interactive sessions (it hangs if you try)
  • Tests:
    • Universal: hogli test <file_or_directory> — auto-detects test type (Python, Jest, Playwright, Rust, Go)
    • Single test: hogli test path/to/test.py::TestClass::test_method
    • Watch mode: hogli test path/to/test.py --watch
    • Changed files only: hogli test --changed
  • Lint:
    • Python:
      • ruff check . --fix and ruff format .
    • Frontend: pnpm --filter=@posthog/frontend fix (safe Oxlint fixes + Oxfmt; suggestion fixes are not applied). format runs Oxfmt only; lint and format:check only verify.
    • TypeScript check: pnpm --filter=@posthog/frontend typescript:check
  • Build:
    • Frontend: pnpm --filter=@posthog/frontend build
    • Start dev: ./bin/start or hogli start (interactive TUI). Detached mode: hogli up -d paired with hogli wait / hogli down
      • Cloud task VMs (prebaked dev-stack image): run bootstrap-dev-stack first (restores compose host aliases, starts dockerd), then uv sync, source .venv/bin/activate, hogli start -y -d, and hogli wait (the detached start returns while the stack is still booting; hogli wait blocks until every process is ready) — always detached: the sandbox has no TTY, and phrocs under a pseudo-TTY balloons in memory until OOM-killed
      • Cloud task VMs: on user-created runs the backend usually starts the stack itself. While it does, hogli start exits without starting anything. Poll /tmp/posthog-preview/status.json until state is ready or failed. On ready, run hogli wait; it reports not reachable until the backend reaches the phrocs step, so retry it rather than forcing a second start. On failed (the backend does not retry), start the stack yourself with hogli start -y -d
      • Cloud task VMs, frontend work: pnpm install --frozen-lockfile --prefer-offline links from the prebaked pnpm store, and Playwright Chromium is preinstalled; product/Storybook builds still run from source
      • Cloud task VMs, tests: scope every run to what you changed, with hogli test --changed or the test files that cover the touched code. Run a whole module, package, or repo-wide suite at most once, right before you push, and only for a cross-cutting change. CI runs the full matrix; repeating it in the sandbox costs minutes per run and floods the context with output. In a sandbox hogli test runs pytest with -q (set HOGLI_TEST_VERBOSE=1 to stream prints). pytest.ini already enables --reuse-db, and the prebaked dev-stack image seeds test_posthog; do not pass --create-db or override pytest addopts, because either discards the prewarmed schema. If pytest starts the full migration history, the VM image predates the database seed or the test database was replaced. Let that migration finish before retrying; interrupting it leaves a partial database that the next run must continue migrating.
  • OpenAPI/types: hogli build:openapi (regenerate after changing serializers/viewsets)
  • LSP: Pyright is configured against the flox venv. Prefer LSP (goToDefinition, findReferences, hover) over grep when navigating or refactoring Python code.
  • Dev experience feedback: hogli devex:feedback "<message>" sends feedback about repo tooling — hogli, the dev stack, tests, CI, migrations, this setup — straight to the devex team as a hogli_feedback event (add -c bug|idea|praise|question). Local agents must use it too: when a hogli command or local dev workflow is broken, slow, or confusing, run it — e.g. hogli devex:feedback -c bug "migrations:run failed with <error>". Do not run it from cloud tasks or agent-server sandboxes; the command is a no-op there.

Read the full file on GitHub · 301 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · -21 lines · +101 tokens per session 34e7a04eaa8c
  2. 3d ago Changed · +24 lines · +303 tokens per session 8a38bb94e5f2
  3. 3d ago First seen · 298 lines · 10,310 tokens per session scan B ba2b9ff79ac1

Subscribe to this mod's changes

posthog-foss AGENTS.md is an instructions file published in the GitHub repository PostHog/posthog-foss (714 stars, last pushed today), licensed MIT. It adds 10,714 tokens to every session, about $0.0536 per session on Opus 5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other instructions, from other repositories

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,182 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,469 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens