Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/trycoin-ai/agentrisk/agents-mdgit clone --depth 1 https://github.com/trycoin-ai/agentriskWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00710 | $0.00710 |
| Opus 5 | $0.00355 | $0.00355 |
| Sonnet 5 | $0.00142 | $0.00142 |
| Haiku 4.5 | $0.00071 | $0.00071 |
Grade A, and why
agentrisk AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working on AgentRisk
Instructions for coding agents (and humans) contributing to this repository.
Setup and verification
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest # full suite; must be green
ruff check . # lint; must be clean
mypy # types; must be clean
python examples/agent_loop.py # end-to-end smoke test
Rules that are not negotiable
- The core stays pure. Nothing under
src/agentrisk/may make network calls, call an LLM, or read credentials. Mutable file I/O is limited to the policy file, its history, and the audit log, all viastore.pyandaudit.py. The one other read is the bundled classification data insrc/agentrisk/data/, loaded read-only throughimportlib.resources. - Fail closed. A missing policy or invalid input must produce BLOCK, never a pass. Do not weaken this.
- Exits are never trapped. Selling or closing a position must never be blocked by a concentration or asset-class rule.
- All user-facing wording lives in
messages.py. Never use the words "safe", "approved", or "recommended" in output. Always attribute limits to the user ("your 25% limit"). - Determinism. Same inputs must produce byte-identical output. No calls to
datetime.now()inside check logic without thenowparameter plumbed through.
Golden fixtures
Any intentional change to check math or message wording requires regenerating the golden snapshots and reviewing the diff:
AGENTRISK_REGEN=1 pytest tests/test_golden.py
git diff tests/golden
Unexplained golden diffs mean you broke something.
Layout
src/agentrisk/models.py: pydantic schemas, strict validation, Decimal money.src/agentrisk/check.py: trade simulation, aggregation, and thecheck_trade_riskentry point.src/agentrisk/checks.py: the risk-check catalog, one function per rule.src/agentrisk/overrides.py: one-time override tiering and application.src/agentrisk/analyze.py: portfolio report and compliance audit.src/agentrisk/policy.py: policy lifecycle, diff, confirm gate, history.src/agentrisk/mcp_server.py: thin MCP adapter; contains no business logic.src/agentrisk/cli.py: theagentriskcommand; wraps the three tools, no logic.src/agentrisk/data/: classification seed data; lint intests/test_seed_data.py.skills/agentrisk/SKILL.md: the optional Agent Skill; a thin protocol, no logic..claude-plugin/and.mcp.json: Claude Code plugin manifest, its marketplace, and the bundled MCP server registration (launched via uvx); lint intests/test_skill.py.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 67 lines · 710 tokens per session scan A 549e1215763a
agentrisk AGENTS.md is an instructions file published in the GitHub repository trycoin-ai/agentrisk (2 stars, last pushed 16d ago), licensed MIT. It adds 710 tokens to every session, about $0.0036 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
OpenQuantum AGENTS.md
Instructions for xi-zhao/OpenQuantum, covering openquantum, 四个职责面, 扩展对象不可混用, 不变量 and 代码位置.
clawock AGENTS.md
Instructions for KCNyu/clawock, covering agents.md - your workspace, every session, kcn 偏好, git hook (one-time setup per clone) and git auto-commit rules.
clawock CLAUDE.md
Instructions for KCNyu/clawock, covering claude.md, identity & user, required reads (every session, in order), what lives where and cron run loop (what openclaw fires).
regulated-mcp-insurance-deployment AGENTS.md
AGENTS.md instructions for waalwalker1/regulated-mcp-insurance-deployment, covering agents.md — regulated mcp insurance reference architecture, architectural invariants, developer command interface, architecture & verification ledgers and subsystem & file ownership.
mcp-shopline CLAUDE.md
Instructions for asgard-ai-platform/mcp-shopline, covering claude.md, project overview, setup & running, run the mcp server directly (stdio json-rpc 2.0) and or auto-detected via .mcp.json when opened in claude code.
centrapay-mcp CLAUDE.md
Claude Code instructions for CedricConday/centrapay-mcp, covering centrapay-mcp — claude code instructions, what this project is, credentials, build and test and architecture.