Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/pre-ceo/pre/claude-mdgit clone --depth 1 https://github.com/pre-ceo/preWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02617 | $0.02617 |
| Opus 5 | $0.01308 | $0.01308 |
| Sonnet 5 | $0.00523 | $0.00523 |
| Haiku 4.5 | $0.00262 | $0.00262 |
Grade B, and why
pre CLAUDE.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- ssh + sudo 远端命令需在 `ssh_sudo_allowlist` 命中才放行. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- HTTP `/api/v1/*` 端口存在主要给浏览器 GUI (`pre_ui`); **agent 不应自己 curl HTTP** How it starts
The opening of the file, as written. The whole thing — 182 lines — stays where its author put it; the contents beside it link to each section on GitHub.
pre — 给 Claude Code agent 看的项目说明
本项目实现 Claude Code 的 PreToolUse / Stop hook + Master/Node/Driver 消息总线. 在这个仓库内工作时, 请遵循以下原则.
项目定位
- 平台代码层 (portable, git-tracked).
- 用户级规则与运行时状态在
pre_rule(sibling 仓库, 不入此 git). - 浏览器 GUI 在
pre_ui(sibling 仓库).
Agent 接入路径
MCP 是 agent ↔ master 主路径, 不是可选附件:
- agent 通过 stdio JSON-RPC 调
pre_mcp子进程 - 子进程在本机 loopback 经 HTTP 转发到 master
- 沿途强制 caller-id 前缀校验 / 跨 node read_pane 拒绝 / 60/min 限频 / 独立 audit
- HTTP
/api/v1/*端口存在主要给浏览器 GUI (pre_ui); agent 不应自己 curl HTTP
修改这一路径时连带改 4 处:
src/master/server.py— HTTP endpoint 行为pre_mcp/master_client.py— facade 调 endpointpre_mcp/tools.py— tool 包装层 + 校验pre_mcp/__main__.py— FastMCP@mcp.tool()注册
Token 来源 — 唯一出入口 ~/.pre/env
所有本机 caller 通过 ~/.pre/env 取对应 PRE_<KIND>_SECRET. agent 不得自己 curl
HTTP — 强制走 MCP. master 端按 (role, source IP) 差异化校验, 异常组合 → audit +
WARNING-master-caller-class-anomaly-{ts}.md finding.
5 类初始 token (chmod 600, 不入 git):
| env key | role | 用途 | 校验 |
|---|---|---|---|
PRE_NODE_SECRET |
node | src/node/ ↔ master ws + /files |
role=node, ws Upgrade /node |
PRE_MCP_SECRET |
mcp | pre_mcp 子进程 → master HTTP loopback |
mcp + agent_id binding + 必 loopback |
PRE_HOOK_SECRET |
hook | hook/runtime/CLI → master HTTP loopback | hook + 必 loopback |
PRE_GUI_SECRET |
gui | pre_ui browser (master /auth/init 颁发) |
role=gui |
PRE_OPERATOR_SECRET |
operator | 运维手敲 + admin 操作 | scope=admin.* |
Caller 侧:
- master / hook / runtime / scripts / node:
from common.token_resolver import resolve as _resolve_token_resolve_token("hook")(或对应 kind). 单点~/.pre/env, fail-fast (找不到 raise).
pre_mcp子进程 不能 importsrc/common(CLAUDE.md 隔离硬约束); 自己读os.environ["PRE_MCP_SECRET"], 行为对齐token_resolver._load_env_file.
加新 token 类型 (例 cron / audit-reader):
src/master/auth.py:ROLE_DEFAULT_SCOPES加 role + scopessrc/master/server.py:_classify_caller白名单加 (role, path, IP) 行scripts/pre_token.py issue --role <new>颁发, raw 写~/.pre/env的PRE_<KIND>_SECRETsrc/common/token_resolver.py:_KIND_TO_ENV_KEY加映射, caller 侧_resolve_token("<new>")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 182 lines · 2,617 tokens per session scan B 03f97b549aa7
pre CLAUDE.md is an instructions file published in the GitHub repository pre-ceo/pre (5 stars, last pushed 3mo ago), licensed MIT. It adds 2,617 tokens to every session, about $0.0131 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
next.js AGENTS.md
Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.