Borrowing it
Nothing to install: this file belongs to print-yuhuan/QQ-MCP-Server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/print-yuhuan/QQ-MCP-Server/main/AGENTS.mdgit clone --depth 1 https://github.com/print-yuhuan/QQ-MCP-ServerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/print-yuhuan/qq-mcp-server/agents-md)<a href="https://agentmods.dev/instructions/print-yuhuan/qq-mcp-server/agents-md"><img src="https://agentmods.dev/badge/instructions/print-yuhuan/qq-mcp-server/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/print-yuhuan/qq-mcp-server/agents-md"><img src="https://agentmods.dev/badge/instructions/print-yuhuan/qq-mcp-server/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01476 | $0.01476 |
| Opus 5 | $0.00738 | $0.00738 |
| Sonnet 5 | $0.00295 | $0.00295 |
| Haiku 4.5 | $0.00148 | $0.00148 |
Grade A, and why
QQ-MCP-Server AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- QQ-MCP-Server CLAUDE.md — 94% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
This file provides guidance to Codex (Codex.ai/code) when working with code in this repository.
项目概述
QQ-MCP-Server 把一个已登录的 NapCatQQ 机器人封装成 MCP Streamable HTTP 服务:对外讲 MCP(JSON-RPC over HTTP),对内调用用户自备的 NapCatQQ OneBot HTTP API。本项目只实现 MCP 服务本身,不负责安装/登录/维护 NapCatQQ。
命令
开发环境为 Windows + PowerShell,仓库自带 .venv。下列命令可直接用 python,或显式用 .\.venv\Scripts\python.exe。
pip install -e ".[dev]" # 安装运行 + 开发依赖(pytest)
pytest # 跑全部测试
pytest tests/test_logic.py # 跑单个文件
pytest tests/test_logic.py::test_send_group_message_parses_cq_at # 跑单个用例
python tests/smoke_initialize.py # 本地 MCP initialize 冒烟测试(不需真实 NapCat)
python -m qq_mcp_server # 本地启动服务(需先配置 .env)
bash deploy.sh # Linux 一键部署(装依赖 + 生成配置 + systemd)
- 测试用
asyncio_mode = "auto"(见 pyproject.toml),async 测试不需要写@pytest.mark.asyncio。 - 运行前至少要有
QQ_MCP_ACCESS_TOKEN和NAPCAT_BASE_URL两个环境变量(缺失会在Config.from_env()直接报错退出),可从.env.example复制。
架构
三层分明,依赖方向单向(server → logic → napcat):
config.py—Config冻结 dataclass,全部配置来自环境变量,入口是Config.from_env()。代码里不硬编码任何服务器/token/QQ 号。napcat.py—NapCatClient.call(action, payload)是对 OneBot HTTP(POST <base_url>/<action>)的唯一异步封装。它只返回 OneBot 响应里的data字段,并把传输错误、鉴权失败、API 级失败统一抛成NapCatError(ToolError子类)。调用方永远不用关心 HTTP 细节。logic.py— 真正的工具逻辑:参数校验、编排 NapCat 调用、整理返回结构。刻意与框架无关:每个函数接收NapCatClient+Config,返回纯 dict 或抛ToolError,因此能用tests/conftest.py里的FakeNapCat在不起 HTTP 的情况下单测。server.py— 用 FastMCP 注册工具。每个@mcp.tool都是薄包装:解出 client/config 后委托给logic,并统一经_execute()包装结果。build_mcp()的 lifespan 负责创建/关闭NapCatClient;create_app()把 ASGI app 包上AuthMiddleware并追加无鉴权的/health。auth.py— ASGI 中间件,对除/health外的所有 HTTP 请求校验 token,支持三种传递方式(Authorization: Bearer/X-API-Key/?token=),用hmac.compare_digest常量时间比较,无 token 配置时一律拒绝(fail closed)。errors.py— 统一响应信封与稳定错误码。成功{"ok": true, "data": ...},失败{"ok": false, "error": {"code", "message", "detail"}}。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 56 lines · 1,476 tokens per session scan A 0f534efa3994
QQ-MCP-Server AGENTS.md is an instructions file published in the GitHub repository print-yuhuan/QQ-MCP-Server (2 stars, last pushed 2mo ago), licensed MIT. It adds 1,476 tokens to every session, about $0.0074 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.