Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/sstraus/tuicommander/agents-mdgit clone --depth 1 https://github.com/sstraus/tuicommanderWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.06697 | $0.06697 |
| Opus 5 | $0.03349 | $0.03349 |
| Sonnet 5 | $0.01339 | $0.01339 |
| Haiku 4.5 | $0.00670 | $0.00670 |
Grade B, and why
tuicommander AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -X POST http://localhost:9876/diagnostics -d '{"enabled":true}' -H 'Content-Type: application/json' Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
3. **CLI probing** — `curl` HTTP endpoints, `grep` for patterns How it starts
The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TUICommander — Project Rules
Doc Sync
Read docs/sync-matrix.md before any feature/API/config change — it maps code areas to docs that MUST be updated.
Tests
- Tests are the spec. When a test fails after a code change, investigate BOTH sides before deciding which to fix.
- Finding a story partially implemented does NOT mean it's done. When you pick up a story and discover the feature already exists, verify EVERY part of the story is honored — each acceptance criterion, edge case, and requirement — before marking it complete. Never assume the whole story is satisfied just because one part is implemented. Check each criterion against the code and prove it, or the story isn't done.
to-test.mdtracks features awaiting manual testing — add items there for minor features.[HUMAN]is a last resort. Before marking a to-test item[HUMAN], you MUST attempt verification through this escalation ladder:- Code inspection — read the source, confirm the logic exists at file:line
- Test execution —
cargo nextest run(doctests:cargo test --doc),vitest runwith relevant filter - CLI probing —
curlHTTP endpoints,grepfor patterns - MCP maccontrol — take screenshots, click UI elements, verify visual state
- MCP invoke/JS — call Tauri commands, inspect store state, trigger actions programmatically
Only use
[HUMAN]when the item genuinely requires real hardware (audio, IME, touch), multi-app interaction (drag to Finder, global hotkey from another app), or timing-sensitive observation that none of the above can capture. When code-verifying, change[HUMAN]to[x]with a_(verified: file:line explanation)_annotation. When code reveals the description is wrong, change to[ ]with a_(NOTE: ...)_correction.
Test instance vs orchestrator instance — READ BEFORE TESTING
There are TWO running TUICommander instances; do not confuse them:
- Orchestrator instance — the one this agent is embedded in. The
tuicommanderMCP tools anddebug invoke_jstarget THIS instance (Mission Control on:14319, app logs on:9876). It does NOT run your worktree build, so testing it proves nothing about your changes. - Test instance — the worktree dev build you start with
make dev. Test your changes against it only via its HTTP API onhttp://127.0.0.1:9877. MCP/invoke_jscannot reach it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 309 lines · 6,697 tokens per session scan B 21dbcad0c83e
tuicommander AGENTS.md is an instructions file published in the GitHub repository sstraus/tuicommander (125 stars, last pushed 6d ago), licensed Apache-2.0. It adds 6,697 tokens to every session, about $0.0335 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
agentic-playwright selectors.instructions.md
Instructions for idavidov13/agentic-playwright, covering selector strategy, critical, instructions, phase 1: open and authenticate and phase 2: explore like a user.
agentic-playwright playwright-cli.instructions.md
Instructions for idavidov13/agentic-playwright, covering browser automation with playwright-cli, quick start, open new browser, navigate to a page and interact with the page using refs from the snapshot.
antigravity-testing-kit GEMINI.md
Instructions for anhtester/antigravity-testing-kit, covering gemini ai - global automation agent rules, git pull restriction rule, browser rules (mandatory), 🖥️ viewport & mode and 🔄 thứ tự debug bắt buộc (playwright mcp).
mcp-screenshot-server CLAUDE.md
Instructions for sethbang/mcp-screenshot-server, covering claude.md, what this is, commands, environment variables and architecture.
Vigilis AGENTS.md
Instructions for piyushpathakqa/Vigilis, covering what this project is, where to find things, the one-sentence architecture, conventions and commands.
mcp-ie-migration-vrt AGENTS.md
AGENTS.md instructions for rayven122/mcp-ie-migration-vrt, covering agents.md, file map, architecture, conventions and adding a tool.