twzrd-trust AGENTS.md

twzrd-trust AGENTS.md is an instructions file for Codex, OpenCode from twzrd-sol/twzrd-trust. It costs 725 tokens per session, scanned A, original, MIT.

Repository instructions for working on twzrd-trust, including which directories contain real source code and which contain published build outputs. They also describe the project’s package, command-line tools, and development limits.

In plain words
What is it for?
They help an agent locate the developable package, run its checks, and understand its Node.js and npm setup. They also explain that the project is a TypeScript library and command-line tool rather than a long-running server.
Why use it?
They prevent an agent from trying to build or test directories that lack their source files or depend on unavailable private packages. They provide the project-specific rules needed to work in the correct service.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/twzrd-sol/twzrd-trust/agents-md
Clone the repo
git clone --depth 1 https://github.com/twzrd-sol/twzrd-trust

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for twzrd-trust AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/twzrd-sol/twzrd-trust/agents-md.svg)](https://agentmods.dev/instructions/twzrd-sol/twzrd-trust/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/twzrd-sol/twzrd-trust/agents-md"><img src="https://agentmods.dev/badge/instructions/twzrd-sol/twzrd-trust/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 725 This file is loaded in full into every session.
When invoked 725 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00725 $0.00725
Opus 5 $0.00362 $0.00362
Sonnet 5 $0.00145 $0.00145
Haiku 4.5 $0.00072 $0.00072

Measured yesterday against content hash ab0d0edc2718, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

twzrd-trust AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 45 lines

How it starts

The opening of the file, as written. The whole thing — 45 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Cursor Cloud specific instructions

Repo layout / what is actually developable

This repo is a public mirror. Most top-level directories are published-artifact mirrors, not buildable source:

  • twzrd-x402-gate/ — the only package with real src/ + test/. All development, linting, building, and testing happens here.
  • eliza-plugin/, plugin-trustgate/, twzrd-mcp-server/ — ship dist/ only (no src/, no lockfile). Their package.json test/build scripts reference files that are not in this mirror, so they are not buildable/testable here. Don't try to npm install/build them.
  • server/ — static docs + .well-known only. Its Dockerfile installs a private Python package (twzrd-agent-intel) that is not in this repo, so it cannot be built/run here.

twzrd-x402-gate (the one service)

Node 22 / npm 10 (package engines requires node >=18). Package manager is npm (package-lock.json). It is an ESM-only TypeScript library + CLI, not a long-running server — there is nothing to "serve"; you run it via tests, example scripts, or its bin/ CLIs. All commands run from twzrd-x402-gate/.

  • Lint: there is no separate lint script. npm run typecheck (tsc --noEmit -p tsconfig.check.json, covers src + test) is the lint/static-check.
  • Build: npm run build (tsc → emits dist/, src only).
  • Test: npm test — runs ~40 tsx test files sequentially; the run stops at the first failing file. Tests are self-contained (no external services needed).
  • Run / demo (core "hello world"): npm run gate-eval-refuse runs the buyer trust gate end-to-end and proves it refuses payment to a bad merchant before the wallet signs (signer_invocation_count: 0, usdc_spent: 0). Other example scripts live under examples/ and in the scripts block of package.json.

Non-obvious gotchas

  • The bin/ CLIs (e.g. gate-eval-refuse) load from dist/, so npm run build must have run before invoking them (the update script installs deps but does not build; run npm run build first if dist/ is stale or missing).
  • gate-eval-refuse and several examples/* make live network calls to https://intel.twzrd.xyz (free preflight, no key/signup). They need outbound egress; they spend no USDC. If egress is blocked these demos fail even though unit tests pass.
  • The x402/Solana peer deps are declared as optional peerDependencies but are present as devDependencies, so a plain npm ci in twzrd-x402-gate/ is enough to build and test.

Read the full file on GitHub · 45 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 45 lines · 725 tokens per session scan A ab0d0edc2718

Subscribe to this mod's changes

twzrd-trust AGENTS.md is an instructions file published in the GitHub repository twzrd-sol/twzrd-trust (1 stars, last pushed today), licensed MIT. It adds 725 tokens to every session, about $0.0036 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.