cantrips AGENTS.md

cantrips AGENTS.md is an instructions file for Codex, OpenCode from toverux/cantrips. It costs 2,954 tokens per session, scanned A, original, MIT.

Project instructions for working on cantrips, a collection of coding-agent skills and workflow guides.

In plain words
What is it for?
Use them when adding or revising skills, editing manifests and catalogue files, and following the project’s engineering workflow.
Why use it?
They explain the repository structure and prevent you from looking for build, test, or package commands that the project does not have.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/toverux/cantrips/agents-md
Clone the repo
git clone --depth 1 https://github.com/toverux/cantrips

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cantrips AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/toverux/cantrips/agents-md.svg)](https://agentmods.dev/instructions/toverux/cantrips/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/toverux/cantrips/agents-md"><img src="https://agentmods.dev/badge/instructions/toverux/cantrips/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 2,954 This file is loaded in full into every session.
When invoked 2,954 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02954 $0.02954
Opus 5 $0.01477 $0.01477
Sonnet 5 $0.00591 $0.00591
Haiku 4.5 $0.00295 $0.00295

Measured 3d ago against content hash ed3591796bfa, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cantrips AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 119 lines

How it starts

The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Project overview

cantrips is a multi-harness (Claude Code + Codex) plugin of curated agent skills: the core engineering loop (/grilling → /spec → /tickets → /implement + /tdd → /simplify → /review-gate → /commit → /compound) plus its supporting skills. A feature's spec and tickets are disposable working material under a gitignored .scratch/, deleted once the feature closes (docs/agents/cantrips-loop.md); what survives is the skills, git history, the decision records in docs/adr/, and the deferred ideas in IDEAS.md.

The repository is the plugin: the manifests, the skills tree, and the catalog files that publish it all sit at the root, and an install copies the whole checkout. Everything else here (docs/, this file) therefore rides along into an install; keep it small and keep nothing secret in it.

There is no build

This repository is content, not code: no dependencies, no package manager, no build, no test suite, no lint step. Nothing needs installing to work on it, and nothing gates an edit: there is no command to run before or after one. The one mechanical convention is .editorconfig (LF, UTF-8, two-space indent, trailing newline, 100-column guide). What tooling exists is convenience: mise.toml wraps the scripts in scripts/, mise run dev:sync-install mirroring the working tree over the local installs (Claude Code and Codex CLI) so unreleased edits are usable from other projects, and mise run dev:fork-diff reporting how far a fork has drifted from its upstream without ever asserting — it defines no expected state and exits zero whatever it finds.

Consequently the invariants below are honored by hand. Nothing fails when one drifts, so check them yourself whenever you touch the files they cover.

Repository structure

  • skills/<skill>/SKILL.md: the one shared skills tree; both harnesses auto-discover it.
  • .claude-plugin/plugin.json + .codex-plugin/plugin.json: the dual manifests; shared fields must stay identical.
  • .claude-plugin/marketplace.json + .agents/plugins/marketplace.json: the catalog files that publish this repo as an installable plugin (Claude Code takes a string source, Codex CLI the object form; both point at ./).
  • FORKS.md: the fork divergence ledger — every upstream skill listed, forks with how they deliberately differ and why, the rest marked not ported; /sync-upstream and human readers both consult it.
  • docs/agents/cantrips-loop.md: the per-repo loop config — what the six storage verbs translate to here, and which knowledge stores are enabled (docs/adr/ on, docs/solutions/ off). Storage-touching skills read it instead of skills/setup-cantrips-loop/defaults.md; /setup-cantrips-loop rewrites it.
  • .scratch/<feature>/: the spec and tickets of a feature in flight, gitignored and disposable — deleted when the feature closes, which is the human's act. .scratch/sync/ is not feature material but dev:fork-diff's cache of upstream files, outliving any one feature and safe to delete wholesale.
  • docs/adr/: durable decision records with supersession chains, written only through /compound's user gate and read back by /spec.
  • docs/research/: primary-source research notes, written by /research.
  • scripts/: repository tooling — the bodies mise.toml's tasks wrap, kept in files so a task definition reads as what it runs. Root scripts/ maintains this repository, unlike the scripts/ directories inside skill folders, which are shipped assets an installed skill invokes; no skill in the plugin's tree may reference anything here. mise.toml runs these directly, so stage anything added here with git add --chmod=+x — a plain add records mode 100644 and the task then fails on a fresh Unix checkout.

Read the full file on GitHub · 119 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 119 lines · 2,954 tokens per session scan A ed3591796bfa

Subscribe to this mod's changes

cantrips AGENTS.md is an instructions file published in the GitHub repository toverux/cantrips (2 stars, last pushed 4d ago), licensed MIT. It adds 2,954 tokens to every session, about $0.0148 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.