Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/tarekkharsa/agentstack/claude-mdgit clone --depth 1 https://github.com/Tarekkharsa/agentstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00562 | $0.00562 |
| Opus 5 | $0.00281 | $0.00281 |
| Sonnet 5 | $0.00112 | $0.00112 |
| Haiku 4.5 | $0.00056 | $0.00056 |
Grade A, and why
agentstack CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 52 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — AgentStack
Shipped Rust workspace. Extend existing seams; do not reimplement working trust, policy, gateway, runtime, recording, import, render, or restore paths. Prefer clear, boring, idiomatic Rust; explain non-obvious ownership/lifetime/ trait/error choices briefly.
crates/
core/ manifest, lockfile, digests
trust/ content-bound consent and signatures
policy/ machine-first policy intersection
adapters/ native config compilers for supported CLIs
recorder/ call and run evidence
runtime/ sandbox orchestration
egress/ enforced network proxy
executor/ policy-agnostic governed execution domain
workflow/ self-contained Boa workflow engine
mcp/ MCP protocol boundary, RMCP confined behind a JSON backend
cli/ binary, orchestration, JSON/action APIs
Authorities: STRATEGY.md (strategy), TODO.md (the only work queue),
docs/ARCHITECTURE.md + docs/ENFORCEMENT.md (what the code does and
enforces). docs/archive/ is history, never direction. The CLI is the primary
surface and source of authority; t3code is an optional companion calling stable
read APIs and fixed actions, never an enforcement boundary. Never recreate a
second UI.
Invariants
The non-negotiable invariants live in STRATEGY.md ("What never changes")
and docs/ENFORCEMENT.md; every change must preserve them. Hooks always get
the full consent ceremony; trust and policy stay small review boundaries;
new dependencies need maintainer approval; Boa stays isolated in workflow.
Hard rules — context and tests
- Never run the full test suite locally. Loop:
cargo check -p <crate>while iterating;cargo test -p <crate>(or--test <name>) only for crates the change can break; full suite belongs to CI. - Before handoff:
cargo check --workspace --all-targets(the only cheap check that sees all test targets),cargo fmt --check, relevant clippy.
Hard rules — build cache
- Building in
.claude/worktrees/*: exportCARGO_TARGET_DIR="$HOME/.cache/agentstack-target"first, so every worktree shares one incremental cache instead of recompiling the workspace per tree. - Debug builds by default;
--releaseonly when CI parity demands it. - Removing a worktree: delete its local
target/with it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 52 lines · 562 tokens per session scan A f1b7d77b08de
agentstack CLAUDE.md is an instructions file published in the GitHub repository Tarekkharsa/agentstack (3 stars, last pushed 19d ago), licensed Apache-2.0. It adds 562 tokens to every session, about $0.0028 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
jarvis-registry AGENTS.md
AGENTS.md instructions for ascending-llc/jarvis-registry, covering jarvis registry — agent guide, project overview, ⚠️ plan mode instructions ⚠️, my engineering preferences and 1. architecture review.
Unla CLAUDE.md
Claude Code instructions for AmoyLab/Unla, covering claude.md, project overview, development commands, go backend and run tests.
mcphub AGENTS.md
AGENTS.md instructions for samanhappy/mcphub, covering mcphub — agent guide, always apply, project-specific build checks and scoped guides.
agent CLAUDE.md
Instructions for 1mcp-app/agent, covering claude.md, repository information, development commands, setup and build & run.
mcphub CLAUDE.md
Claude Code instructions for samanhappy/mcphub, a project described as: Self-hosted MCP gateway and management platform for connecting, managing, and operating MCP servers.
jarvis-registry registry-gateway.instructions.md
Instructions for ascending-llc/jarvis-registry, covering jarvis registry agent/mcp gateway, discovery chain, execution gate (critical), message construction for executeagent and examples.