Borrowing it
Nothing to install: this file belongs to schplitt/mc8yp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/schplitt/mc8yp/main/AGENTS.mdgit clone --depth 1 https://github.com/schplitt/mc8ypWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/schplitt/mc8yp/agents-md)<a href="https://agentmods.dev/instructions/schplitt/mc8yp/agents-md"><img src="https://agentmods.dev/badge/instructions/schplitt/mc8yp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/schplitt/mc8yp/agents-md"><img src="https://agentmods.dev/badge/instructions/schplitt/mc8yp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.15209 | $0.15209 |
| Opus 5.5 | $0.06084 | $0.06084 |
| Sonnet 5.5 | $0.03042 | $0.03042 |
| Haiku 4.5 | $0.01521 | $0.01521 |
Grade A, and why
mc8yp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 431 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Project Overview
mc8yp is a Cumulocity IoT MCP server.
The project exposes a single code-mode tool to AI agents instead of a large fixed toolset:
codemoderuns an async JavaScript function in a sandbox where API discovery, documentation search, and typed live API calls are all available as globals:codemode.search(query)/codemode.describe(target?)— ranked method search and on-demand TypeScript interface rendering over operations derived from the OpenAPI specsdocs.search(query, opts?)/docs.read(id)— MiniSearch-backed fuzzy full-text search over spec prose (tag docs like query-language grammars, info blocks, operation/parameter descriptions)c8y(core, always present) plus one namespace per service available on the tenant (e.g.dtm) — one typed method per derived operation. Namespaces are the COMPLETE sandbox surface: there is no raw-request escape hatch, and the backing protocol (OpenAPI vs MCP) is deliberately invisible to the agent- services that declare
exposeMcpServersin their manifest are wrapped from their MCP server instead (one typed method per MCP tool) — MCP is preferred over the OpenAPI spec when a service has both, with a per-connection opt-out (mc8yp-no-mcpheader /noMcpquery /--no-mcpCLI flag) that falls back to the spec - external MCP servers supplied by the connection itself (
mc8yp-mcp-serverheader, repeatable, JSON per entry;--mcp-serverCLI flag) get a namespace too — absolute URL, their own credentials, tenant-independent, scoped to that connection/session sandbox(server mode only, opt-in — disabled by default) — an in-memory shell + virtual filesystem (just-bash, core shell only:jq/awk/grep/sed/sort/sqlite3, no network, no host FS) for wrangling fetched data. Mirrors Flue'sSandboxApiplus an mc8yp-onlyclear(). One sandbox per MCP session (persists across codemode calls, keyed byctx.sessionId), idle-evicted after 15 minutes; nothing touches disk. A connection only gets it after opting in via themc8yp-enable-sandboxheader /enableSandboxquery param — a general-purpose shell + virtual FS is a bigger blast radius than any single typed API call, so it must be explicitly requested. CLI mode never exposes it regardless — local harnesses bring their own file I/O. Backed by a swappable adapter so the provider can change later.
statusis available only in CLI mode: it lists the active tenant, stored credentials, and the API namespaces currently visible. It accepts{ refresh: true }to force a fresh API discovery on demand (noop when no tenant is active). Server mode has no in-protocol equivalent yet — use thePOST /refresh-apisHTTP route for ops-driven refresh; an in-protocol server-side flow will land in a separate PR.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · +163 tokens per session cbdece6646ff
- 1mo ago Changed · +15 lines · +1,199 tokens per session 2907ade4f2d8
- 1mo ago Changed · +2 lines · +350 tokens per session 180376330f2e
- 1mo ago Changed · +16 tokens per session d65e2d2a65f7
- 1mo ago Changed · +29 tokens per session ab8a9ce32650
- 2mo ago First seen · 414 lines · 13,452 tokens per session scan A 76d60f333e8a
mc8yp AGENTS.md is an instructions file published in the GitHub repository schplitt/mc8yp (6 stars, last pushed today), licensed MIT. It adds 15,209 tokens to every session, about $0.0608 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.