What is qwen-omni-mcp AGENTS.md?

A set of repository instructions for AI agents working on the qwen-omni-mcp project. It defines rules for handling secrets, Git hooks, quality checks, and coding standards.

Use it as the operating rules for code changes in the repository, including secret handling, environment setup, Git hooks, formatting, type checking, linting, and tests.

It prevents accidental leaks and keeps automated checks from being bypassed. It also clarifies what must pass before code is committed or pushed.

How sommio/qwen-omni-mcp configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to sommio/qwen-omni-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/sommio/qwen-omni-mcp/develop/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/sommio/qwen-omni-mcp

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/sommio/qwen-omni-mcp/agents-md/github.svg)](https://agentmods.dev/instructions/sommio/qwen-omni-mcp/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/sommio/qwen-omni-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/sommio/qwen-omni-mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/sommio/qwen-omni-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/sommio/qwen-omni-mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 1,891 This file is loaded in full into every session.

When invoked 1,891 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01891	$0.01891
Opus 5	$0.00945	$0.00945
Sonnet 5	$0.00378	$0.00378
Haiku 4.5	$0.00189	$0.00189

Measured 12d ago against content hash 7337ce2b0fe2, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

qwen-omni-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — Rules for AI agents working on this repo

Hard rules. Follow exactly. These exist to keep agents from shipping broken or leaky code.

Secrets (highest priority)

Never commit secrets, API keys, tokens, or .env files. Keys live only in .env (gitignored) or environment variables.
Never hardcode a key in source, tests, configs, or docs. Read it from DASHSCOPE_API_KEY via src/config.ts.
Never paste a real key into a fixture. Tests use dummy values (sk-test, sk-secret-key-…). The pre-commit check-secrets.mjs blocks sk-ws-… (real Bailian keys); don't try to evade it.
If you accidentally stage a secret: unstage it, rotate the key immediately, and tell the maintainer.

Git hooks — never bypass

Never use git commit --no-verify or git push --no-verify. Hooks run secret scan, lint, format, type-check, and tests for a reason.
If a hook fails, fix the cause. Do not work around it.
After first clone: run npm install (the prepare script installs husky hooks). Verify with git config core.hooksPath → .husky.

Quality gates — all must pass before push

Run these locally before considering work done:

npm run typecheck   # tsc --noEmit, strict + noUncheckedIndexedAccess + exactOptionalPropertyTypes
npm run lint        # eslint, typescript-eslint strictTypeChecked, --max-warnings 0
npm run format:check
npm test            # vitest, unit + mocked e2e (live tests auto-skip without LIVE=1)
npm run build       # tsc -p tsconfig.build.json -> dist/

CI runs the same on Node 20 and 22. Local green ≠ CI green if you skip a step.

Code standards

TypeScript strict. No any in src/ (allowed sparingly in test/ for fixture typing). No @ts-ignore. No non-null assertions in src/.
Prefer narrow types and unknown over any when parsing external JSON (see src/bailian.ts).
The DashScope payload builder (buildPayload) is intentionally injectable — if the video_url/image_url/input_audio content block shape changes, change it in one place (contentBlock / audioBlock in src/bailian.ts).
Do not add a new runtime, language, or heavy dependency without explicit maintainer approval.
Match existing style; let prettier and eslint --fix handle formatting.

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 75 lines · 1,891 tokens per session scan A 7337ce2b0fe2

Subscribe to this mod's changes

qwen-omni-mcp AGENTS.md is an instructions file published in the GitHub repository sommio/qwen-omni-mcp (2 stars, last pushed 1mo ago), licensed MIT. It adds 1,891 tokens to every session, about $0.0095 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

qwen-omni-mcp: Instructions file for Codex