What is second AGENTS.md?

Project instructions for Second, a workspace for building internal tools, covering its code layout, deployment options, documentation, and local browser testing.

Use them when changing the Second codebase, especially its Next.js web app, documentation, deployment setup, or user interface.

They give an agent the project context needed to make changes that fit the repository and its deployment models.

How Second-Inc/second configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to Second-Inc/second. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/Second-Inc/second/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/Second-Inc/second

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/second-inc/second/agents-md/github.svg)](https://agentmods.dev/instructions/second-inc/second/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/second-inc/second/agents-md"><img src="https://agentmods.dev/badge/instructions/second-inc/second/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/second-inc/second/agents-md"><img src="https://agentmods.dev/badge/instructions/second-inc/second/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 2,623 This file is loaded in full into every session.

When invoked 2,623 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.02623	$0.02623
Opus 5.5	$0.01049	$0.01049
Sonnet 5.5	$0.00525	$0.00525
Haiku 4.5	$0.00262	$0.00262

Measured 2mo ago against content hash ffd0709c5c49, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

second AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 103 lines

How it starts

The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Second

Second is a generative workspace, which allows teams to build internal tools.

This is a monorepo containing everything.

Layout

apps/web: nextjs + shadcn

General instructions (not necessarlly task dependent)

For big tasks (or whenever you feel like it), please first of all read the docs/ to understand about this project. Read them also to orient yourself in this project, find relevant files, understand the overall architecture and the code base. Obviously they might be outdated so the code is the real truth eventually.

In this repo, identify key files, the architecture, what this project is about, and how everything works (in they way which is relevant for this task) using the docs/.

Remember that we have currently 2 deployment models:

Local, using npx @second-inc/cli ...
On prem - on GCP (AWS is also not currently supported but it will and should be sometime). On prem can be either on the customer's cloud OR a managed instance - where I deploy it on Second's cloud and help them register the Auth provider, etc.

We are now in the open source repo. You should probably only work on the open source repo (this was just context for you).

Also important: Whatever you do, it's very important that this will be enforced securely and beautifully and will actually work and will not have any security issues. Also keep in mind tenant isolation (critical). I mean I know that right now we haven't released our SAAS solution yet, but still it's very important. Keep all of the best practices from the docs and the current structure.

It's also very important to keep everything very secure and go with the security best practices and everything that we currently have set up and fixed to not regress and to not introduce any security issues.

About app UI changes

Before changing app UI, inspect strong local references such as apps/web/src/components/ai-elements/tool-card.tsx, apps/web/src/components/ai-elements/agents-card.tsx, apps/web/src/app/w/[workspaceId]/apps/[appId]/agents/page.tsx, and apps/web/src/app/w/[workspaceId]/settings/integrations/page.tsx.
Match the existing restrained shadcn/Radix theme: compact rows, muted borders, mono metadata, semantic badges, and polished tool-call / agent-card patterns.

Read the full file on GitHub · 103 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 103 lines · 2,623 tokens per session scan A ffd0709c5c49

Subscribe to this mod's changes

second AGENTS.md is an instructions file published in the GitHub repository Second-Inc/second (79 stars, last pushed yesterday), licensed Apache-2.0. It adds 2,623 tokens to every session, about $0.0105 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Browser automation Frontend Testing TypeScript agent-management ai-agents on-prem self-hosted shadcn-ui

second AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
second AGENTS.mdSecond-Inc/second	Instructions file	79	yesterday	Apache-2.0	A	2,623	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

second: Instructions file for Codex