Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/theuncharted/zapcode/claude-mdgit clone --depth 1 https://github.com/TheUncharted/zapcodeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01620 | $0.01620 |
| Opus 5 | $0.00810 | $0.00810 |
| Sonnet 5 | $0.00324 | $0.00324 |
| Haiku 4.5 | $0.00162 | $0.00162 |
Grade A, and why
zapcode CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 188 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
AI coding assistant instructions for the
zapcodeproject. See AGENTS.md for the full architecture reference. This file adds Claude-Code-specific guidance on top of it.
Git
Do not add Co-Authored-By trailers to git commits.
Read AGENTS.md first
Before writing any code in this repository, read AGENTS.md in full. It defines:
- What Zapcode is and what it must never do
- The full architecture (parser → IR → bytecode → VM → snapshot)
- The five sandbox invariants that must never be violated
- The definition of "done" for any feature
Do not skip this. The sandbox invariants in particular will save you from introducing security vulnerabilities that are hard to detect and easy to ship.
Codebase orientation
Start here when working on a new area:
| Area | Entry point |
|---|---|
| Parsing TypeScript | crates/zapcode-core/src/parser/mod.rs |
| IR definition | crates/zapcode-core/src/parser/ir.rs |
| Bytecode instructions | crates/zapcode-core/src/compiler/instruction.rs |
| Compiler (IR → bytecode) | crates/zapcode-core/src/compiler/mod.rs |
| VM main loop + dispatch | crates/zapcode-core/src/vm/mod.rs |
| Built-in functions | crates/zapcode-core/src/vm/builtins.rs |
| Value / type system | crates/zapcode-core/src/value.rs |
| Snapshot / resume | crates/zapcode-core/src/snapshot.rs |
| Resource limits | crates/zapcode-core/src/sandbox.rs |
| Error types | crates/zapcode-core/src/error.rs |
| JS bindings API | crates/zapcode-js/src/lib.rs |
| Python bindings API | crates/zapcode-py/src/lib.rs |
| WASM bindings API | crates/zapcode-wasm/src/lib.rs |
When in doubt about where something belongs: zapcode-core is pure Rust with zero I/O.
Bindings crates only translate types and marshal calls into zapcode-core. Never put
business logic in binding crates.
How to add a new language feature
- Check the supported subset table in AGENTS.md first. If the feature is explicitly listed as unsupported, do not add it without opening a discussion. Features are excluded intentionally.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 188 lines · 1,620 tokens per session scan A 23d109e202e5
zapcode CLAUDE.md is an instructions file published in the GitHub repository TheUncharted/zapcode (89 stars, last pushed 3d ago), licensed MIT. It adds 1,620 tokens to every session, about $0.0081 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
intelligent-terminal rust.instructions.md
Concise Rust coding conventions for this repository.
InvestSkill GEMINI.md
Instructions for yennanliu/InvestSkill, covering investskill — gemini cli setup & usage guide, installation & setup, quick start, navigate to the investskill directory and start gemini cli (loads gemini.md automatically).
she-love-me CLAUDE.md
Instructions for 863401402/she-love-me, covering claude.md and 唯一工作流.
sprites-ex CLAUDE.md
Instructions for superfly/sprites-ex, covering sprites elixir sdk, quick reference, common commands, install dependencies and compile.
wayland-core copilot-instructions.md
Instructions for FerroxLabs/wayland-core, covering ijfw rules, output discipline, memory routing, context discipline and cross-audit.
ZipAgent AGENTS.md
Instructions for JiayuXu0/ZipAgent, covering repository guidelines, project structure & module organization, build, test & development commands, coding style & naming conventions and testing guidelines.