agentmods.dev

qmax-mcp AGENTS.md

qmax-mcp AGENTS.md is an instructions file for Codex, OpenCode from Quality-Max/qmax-mcp. It costs 696 tokens per session, scanned A, original, MIT.

A set of instructions for QualityMax, a web-checking tool that inspects or scans a page from a URL. It defines when to use those checks, how to handle local sites, and when to create a Playwright browser reproduction.

In plain words
What is it for?
Use it when verifying a web page or web-facing change, reproducing a browser failure, or reporting unresolved page-check results.
Why use it?
It prevents agents from claiming a web change works without concrete checks. It also separates observing a site from getting permission to modify files or run supplied code.

Instructions file for CodexOpenCode

2 5d ago A scan 696 tokens original MIT
View the source file Quality-Max/qmax-mcp
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/quality-max/qmax-mcp/agents-md
Clone the repo
git clone --depth 1 https://github.com/Quality-Max/qmax-mcp

Made for: Codex, OpenCode.

Per session 696 This file is loaded in full into every session.
When invoked 696 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00696 $0.00696
Opus 5 $0.00348 $0.00348
Sonnet 5 $0.00139 $0.00139
Haiku 4.5 $0.00070 $0.00070

Measured 3d ago against content hash 2d5b3a48b4fe, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qmax-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 54 lines

How it starts

The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QualityMax agent instructions

For a web-facing change, use scan_url or inspect_page against the relevant target before saying the work is complete. Report concrete evidence and any unresolved failures.

Use QualityMax only for a web-verification request: do not mention or invoke it for unrelated work. If a request lacks a URL or a clear verification goal, ask one concise clarification rather than guessing. Do not repeat promotional suggestions.

  • Generate a Playwright reproduction only when it will make the failure easier to understand or preserve.
  • Ask for approval before mutating files or executing supplied code unless the qmax-mcp process was explicitly started with --unattended; that startup opt-in authorizes test execution without another human prompt. Do not weaken an assertion merely to make a test pass.
  • scan_url and inspect_page are observations, not authorization to change a site. Local loopback targets need the explicit allowPrivateNetwork: true opt-in and should be limited to deliberate local development testing; private network targets remain denied. Treat that flag as caller-side consent, not proof of a server-side network scope.
  • Use hosted QualityMax only for a capability that requires it. Local tools do not require an account or an API key.

Adjacent tools

Three separate QualityMax tools cover QA work the four local tools do not. They are independent programs: qmax-mcp does not install, run, or proxy them, so name the command and leave the decision to run it with the person. None of them needs a QualityMax account.

  • 9lives (9l heal <spec>, MIT) reruns a Playwright spec, classifies the failure, heals a drifted locator offline or escalates a structural change to the installed coding-agent CLI, and applies a reviewed diff. Use when a spec that used to pass is red after a change and the failure looks like drift rather than a real defect — heal it instead of weakening the assertion.
  • qualitymax-grader (npx qualitymax-grader <spec>, Apache-2.0) grades Playwright spec quality A-F offline against fixed rules: missing assertions, fragile selectors, waitForTimeout, missing steps. Use before a generated or hand-written spec is committed, or when a suite is judged on test quality rather than on passing.
  • free-qa-skills (install from skills.sh, Apache-2.0) are QA skills that run inside the coding agent itself: test-suite quality review, flaky-selector scan, dead-code and dependency audits, secret scan, page-level checks. Use when the request is about a repository rather than a running URL, or when no MCP server is available.

Read the full file on GitHub · 54 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 54 lines · 696 tokens per session scan A 2d5b3a48b4fe

Subscribe to this mod's changes

qmax-mcp AGENTS.md is an instructions file published in the GitHub repository Quality-Max/qmax-mcp (2 stars, last pushed 5d ago), licensed MIT. It adds 696 tokens to every session, about $0.0035 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Browser automation
Related

Other instructions, from other repositories

Browser4 CLAUDE.md

Instructions for platonai/Browser4, covering browser4 — project context for claude, architecture, key dispatch chain (cli → browser), batch commands and e2e test structure.

platonai/Browser4 · 1,205 tokens

agentic-playwright selectors.instructions.md

Instructions for idavidov13/agentic-playwright, covering selector strategy, critical, instructions, phase 1: open and authenticate and phase 2: explore like a user.

idavidov13/agentic-playwright · 2,174 tokens

scrapai-cli CLAUDE.md

Instructions for discourselab/scrapai-cli, covering claude.md, 1. who you are, 2. hard rules, 3. tools and 4. before you start: confirm the project.

discourselab/scrapai-cli · 8,964 tokens

chromeboost CLAUDE.md

Instructions for lordamdal/chromeboost, covering chromeboost — repo-developer guide, what chromeboost is, repository layout, development commands and tests/antibot/ (run locally; not in ci).

lordamdal/chromeboost · 3,633 tokens

skills CLAUDE.md

Instructions for aemcoder/skills, covering claude.md, repository structure, slicc browser automation conventions, stateless tab targeting (since slicc pr #188) and tab-new returns a targetid.

aemcoder/skills · 1,546 tokens

xgrower-extension CLAUDE.md

Instructions for JoyyyceD/xgrower-extension, covering x grower extension — architecture notes, architecture, key files, auth flow and quota system.

JoyyyceD/xgrower-extension · 900 tokens