Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/stoa-platform/stoa/claude-mdgit clone --depth 1 https://github.com/stoa-platform/stoaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/stoa-platform/stoa/claude-md)<a href="https://agentmods.dev/instructions/stoa-platform/stoa/claude-md"><img src="https://agentmods.dev/badge/instructions/stoa-platform/stoa/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03597 | $0.03597 |
| Opus 5 | $0.01799 | $0.01799 |
| Sonnet 5 | $0.00719 | $0.00719 |
| Haiku 4.5 | $0.00360 | $0.00360 |
Grade B, and why
stoa CLAUDE.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Règles binaires GO/NOGO. Détail on-demand dans `.claude/docs/<rule>.md`. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- stoactl > curl/bash. Lire `.claude/context/cli-reference.md` avant de scanner src/. How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — STOA Platform
Project
STOA Platform — "The European Agent Gateway"
- API Management AI-Native Open Source (Apache 2.0)
- Kill feature: UAC (Universal API Contract) — "Define Once, Expose Everywhere"
- Legacy-to-MCP Bridge: connect traditional APIs to AI agents
UAC / Agent Contract Doctrine
Canonical rule from ADR-067:
UAC describes.
MCP projects.
Smoke proves.
For any API operation exposed to agents:
- UAC is the primary product contract; MCP tools are projections of UAC operations.
- LLM metadata is endpoint-level, not contract-level.
- V1: missing
endpoint.llmmetadata is a warning/review note; malformed metadata is an error. - V2 target: new MCP-exposed endpoints must be LLM-ready before merge.
side_effects=destructiverequiresrequires_human_approval=true.- A feature exposed to an agent should not exist only in code; it must be attached to a UAC operation or flow contract.
Load .claude/docs/uac-llm-ready.md when touching UAC schemas, UAC examples, MCP tool generation, smoke tests for MCP projections, or API operations exposed to agents.
Architecture
CONTROL PLANE (Cloud) DATA PLANE (On-Premise)
┌────────────────────────────┐ ┌──────────────────────┐
│ Portal Console API Auth │ ←sync→ │ STOA GW webMethods │
│ (React) (React) (Py) (KC) │ │ (Rust) Kong/Envoy │
└────────────────────────────┘ └──────────────────────┘
Components
| Component | Tech | Path |
|---|---|---|
| Control Plane API | Python 3.11, FastAPI, SQLAlchemy | control-plane-api/ |
| Console UI | React 19, TypeScript, Keycloak-js | control-plane-ui/ |
| Developer Portal | React, Vite, TypeScript | portal/ |
| STOA Gateway | Rust, Tokio, axum | stoa-gateway/ |
| STOA Go (stoactl + stoa-connect) | Go 1.25, Cobra, keyring | stoa-go/ |
| CLI (legacy) | Python, Typer, Rich | cli/ |
| E2E Tests | Playwright, BDD, Gherkin | e2e/ |
| Helm Chart | Helm 3 | charts/stoa-platform/ |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 250 lines · 3,597 tokens per session scan B 3aac1103f9bc
stoa CLAUDE.md is an instructions file published in the GitHub repository stoa-platform/stoa (5 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 3,597 tokens to every session, about $0.0180 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
bifrost AGENTS.md
AGENTS.md instructions for maximhq/bifrost, covering agents.md — bifrost ai gateway, what is bifrost?, repository layout, go workspace and build, test & dev commands.
tingly-box CLAUDE.md
Claude Code instructions for tingly-dev/tingly-box, covering tingly-box, guideline, ux-first (highest priority), frontend and icons.
duragraph go.instructions.md
Instructions for Duragraph/duragraph, covering go code review instructions, project overview, strict layer rules, domain aggregate pattern and run state machine.
duragraph ci.instructions.md
Instructions for Duragraph/duragraph, covering duragraph control plane — general instructions, build & test commands, required toolchain, build and test.
Agent-Span AGENTS.md
AGENTS.md instructions for oxbshw/Agent-Span, covering agents.md, build & test, crate layout, adding a channel and adding an mcp tool.
aura-llm-gateway AGENTS.md
Instructions for UmaiTech/aura-llm-gateway, covering aura llm gateway, project overview, tech stack, project structure and development commands.