Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/shenyangs/guanlan/agents-mdgit clone --depth 1 https://github.com/shenyangs/GuanlanWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.09171 | $0.09171 |
| Opus 5 | $0.04585 | $0.04585 |
| Sonnet 5 | $0.01834 | $0.01834 |
| Haiku 4.5 | $0.00917 | $0.00917 |
Grade C, and why
Guanlan AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`curl -fsSL -H 'Cache-Control: no-cache' https://pypi.org/pypi/guanlan/json | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])'` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -fsSL -H 'Cache-Control: no-cache' https://pypi.org/pypi/guanlan/json | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])'` How it starts
The opening of the file, as written. The whole thing — 379 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
This repository is designed as a CLI-first search productivity tool for AI agents.
Memory rule: treat AGENTS.md, docs/agent-playbook.md, docs/agent-usage.md, and
guanlan/skill/SKILL.md as the durable memory surfaces for how to operate Guanlan. Before building
new benchmarks, automations, or MCP workflows, reread at least AGENTS.md and
docs/agent-playbook.md.
Commit/release language rule: Guanlan is a Chinese-web research tool. Use Chinese-first
commit subjects, changelog entries, and release notes. Keep conventional prefixes such as
feat: / fix: / docs: when useful, but write the description in Chinese, for example
feat: 扩展垂直路由和搜索质量反馈. In public-facing update text, commit subjects,
release notes, and changelog summaries, do not proactively mention telemetry/遥测 unless the user
explicitly asks for that topic or the change is specifically about its user-facing controls.
Version bump rule: every commit to Guanlan must increase the project version by 0.0.1.
Before committing, bump the patch version across pyproject.toml, guanlan/__init__.py,
uv.lock, README.md, docs/full-guide.md, docs/telemetry.md, website/index.html, and
CHANGELOG.md; then run scripts/pre_release_status.sh or an equivalent version-sync check. Do
not make a code/docs commit on main that leaves the package version unchanged.
Release sync rule: when shipping a new Guanlan version, keep the public distribution surfaces in
lockstep. Do not call a release complete until the GitHub repo/tag, PyPI/uv install path, Homebrew
tap formula (shenyangs/homebrew-tap), and official website (website/index.html plus any deployed
site flow) all reflect the same version and positioning. If Homebrew reports an older stable version,
run brew update first; if the tap itself is stale, update and push Formula/guanlan.rb before
telling users Homebrew is current. If the website carries version, install, capability, or release
copy, update and deploy it in the same release pass.
Use scripts/publish_release.sh for real releases so pushing main and pushing the matching v*
tag happen together; PyPI publishing is tag-triggered, so a version commit without a tag is not a
complete release. Pushing main alone is never the end of a release. After the version commit lands,
you must continue through scripts/publish_release.sh or an equivalent full release path until tag,
PyPI, Homebrew tap, website deploy, and local installer verification all succeed for that same version.
Install/update rule: after installing or upgrading Guanlan, always do a full reinstall, not an
incremental upgrade, before configuring MCP, optional channels, or auth. Prefer one clean path:
uv tool install --force --upgrade --refresh --default-index https://pypi.org/simple guanlan; if the user explicitly wants Homebrew, run
brew update && brew reinstall shenyangs/tap/guanlan; for pipx, run pipx install --force guanlan.
For uv, --force alone is not enough because it can reinstall the previously locked version; include
--upgrade and --refresh.
Then refresh shell command lookup with hash -r when available, run command -v guanlan and
which -a guanlan (or the platform equivalent), and run guanlan version. If the version does not
match README/release notes, stop and report the path/version mismatch instead of configuring MCP or
using the tool. If an Agent reports PyPI as older than GitHub, verify with direct PyPI JSON and pip's
index source instead of search-result snippets or cached app text:
curl -fsSL -H 'Cache-Control: no-cache' https://pypi.org/pypi/guanlan/json | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])'
and python3 -m pip index versions guanlan --index-url https://pypi.org/simple. If Homebrew is stale, switch to the uv path.
Post-update smoke rule: after a full reinstall, run guanlan capabilities, guanlan doctor --install-check, guanlan doctor --trace,
guanlan search "人工智能 政策" --profile china --limit 5 --trace, and
guanlan read "https://example.com/" --backend direct --no-fallback-search --format json, and
guanlan hotnews today --limit 5 --trends. Report the exact version, executable path, and smoke
results to the user. Do not treat an old global executable as a successful update.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 379 lines · 9,171 tokens per session scan C e79e835b1714
Guanlan AGENTS.md is an instructions file published in the GitHub repository shenyangs/Guanlan (55 stars, last pushed 2d ago), licensed MIT. It adds 9,171 tokens to every session, about $0.0459 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
mirascope AGENTS.md
Instructions for Mirascope/mirascope, covering ai agent context guide, primary context sources, codebase overview, key principles and quick reference.
qucs-mcp CLAUDE.md
Claude Code instructions for leonardoAB1/qucs-mcp, covering qucs-mcp, critical: qucssim.exe requires a netlist, not a .sch file, verified netlist format, simulator cli and environment variables.
autoharness AGENTS.md
Instructions for tigerless-labs/autoharness: This repo uses Open Knowledge — collaborative markdown via MCP. .open-knowledge/config.yml (with optional /.open-knowledge/config.yml; CLI/env may override) is the path contract: content.dir is the root for relative paths; content.include lists globs that add markdown…
python-cheatsheet copilot-instructions.md
Copilot instructions for labex-labs/python-cheatsheet, covering python cheatsheet - ai coding assistant instructions, project overview, architecture & key patterns, content structure and routing & layout system.
openings-mcp AGENTS.md
Instructions for amikai/openings-mcp, a project described as: 💼 One MCP server to search job boards and company career sites.
ZipAgent AGENTS.md
Instructions for JiayuXu0/ZipAgent, covering repository guidelines, project structure & module organization, build, test & development commands, coding style & naming conventions and testing guidelines.