What is agentgate AGENTS.md?

A repository guide for AgentGate, a TypeScript server built with Fastify and SQLite. It also gives instructions for AI assistants working on the project.

Use it when changing Fastify routes, validating input, updating settlement logic, writing state-transition tests, or checking and publishing changes.

It keeps changes small and testable while ensuring the beginner-focused project follows its required build, test, commit, and push workflow.

How selfradiance/agentgate configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to selfradiance/agentgate. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/selfradiance/agentgate/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/selfradiance/agentgate

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/selfradiance/agentgate/agents-md/github.svg)](https://agentmods.dev/instructions/selfradiance/agentgate/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/selfradiance/agentgate/agents-md"><img src="https://agentmods.dev/badge/instructions/selfradiance/agentgate/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/selfradiance/agentgate/agents-md"><img src="https://agentmods.dev/badge/instructions/selfradiance/agentgate/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 1,113 This file is loaded in full into every session.

When invoked 1,113 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01113	$0.01113
Opus 5.5	$0.00445	$0.00445
Sonnet 5.5	$0.00223	$0.00223
Haiku 4.5	$0.00111	$0.00111

Measured 1mo ago against content hash 0a32248256c4, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

agentgate AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 116 lines

How it starts

The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Commands

npm install installs project dependencies
npm run dev starts the local Fastify server with reload
npm run build compiles TypeScript
npm run test runs the automated test suite
npm run lint runs the TypeScript typecheck used as linting

Conventions

Keep the implementation minimal and local-first
Use Fastify route handlers with zod parsing for request validation
Use SQLite through better-sqlite3; prefer :memory: in tests
Keep bond settlement logic in src/service.ts
Add tests for state transitions through Fastify injection rather than only unit-level helpers

AgentGate: Instructions for Any AI Assistant

This repository is developed with help from AI. These rules apply regardless of model or tool.

User skill level

The user is a beginner.
Use baby steps.
Provide clear, small, actionable steps.

Non-negotiable workflow (always)

For any meaningful change:

Make the smallest safe change.
Verify:
- run typecheck/build (as applicable)
- run demo script(s) / minimal tests
Commit with a clear message.
Push to GitHub immediately after committing. Do not leave commits unpushed unless explicitly told to hold off.
Update README with:
- what changed
- how to verify
- next steps

If verification fails, stop and fix before proceeding.

Security priorities

Treat auth/token/nonce/replay/transport logic as high risk.
Prefer safety and clarity over speed.
Never weaken security checks to “make it work”.
Log security-relevant events (without leaking secrets).

Secrets and sensitive data

Never hardcode secrets.
Never commit tokens/keys/.env.
Use example files and documented env vars instead.

Working style

Ask before large refactors.
Prefer small diffs and incremental steps.
Keep diffs under ~100 lines per change. If a change exceeds 300 lines, stop and break it into smaller pieces before proceeding.
When uncertain, propose 2 options with tradeoffs and default to safer.
Do not claim something is verified unless you list what you ran/checked.

Read the full file on GitHub · 116 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 116 lines · 1,113 tokens per session scan A 0a32248256c4

Subscribe to this mod's changes

agentgate AGENTS.md is an instructions file published in the GitHub repository selfradiance/agentgate (5 stars, last pushed 6mo ago), licensed MIT. It adds 1,113 tokens to every session, about $0.0045 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

accountability agent-governance agent-security agentgate ai-agents ai-security

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,715 tokens

agentgate: Instructions file for Codex