Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/vectorlyapp/bluebox/claude-mdgit clone --depth 1 https://github.com/VectorlyApp/blueboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03431 | $0.03431 |
| Opus 5 | $0.01716 | $0.01716 |
| Sonnet 5 | $0.00686 | $0.00686 |
| Haiku 4.5 | $0.00343 | $0.00343 |
Grade A, and why
bluebox CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Verify: `curl http://127.0.0.1:9222/json/version` How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bluebox Development Guide
This file provides context and guidelines for working with the bluebox codebase.
Bash Commands
Development Setup
uv venv bluebox-env && source bluebox-env/bin/activate- Create and activate virtual environment (recommended)python3 -m venv bluebox-env && source bluebox-env/bin/activate- Alternative venv creationuv pip install -e .- Install package in editable mode (faster with uv)pip install -e .- Install package in editable mode (standard)
Testing
pytest tests/ -v- Run all tests with verbose outputpytest tests/unit/test_js_utils.py -v- Run specific test filepytest tests/unit/test_js_utils.py::test_function_name -v- Run specific testpython scripts/dev/run_benchmarks.py- Run routine discovery benchmarkspython scripts/dev/run_benchmarks.py -v- Run benchmarks with verbose output
CLI Tools
bluebox-monitor --host 127.0.0.1 --port 9222 --output-dir ./cdp_captures --url about:blank --incognito- Start browser monitoringbluebox-discover --task "your task description" --cdp-captures-dir ./cdp_captures --output-dir ./routine_discovery_output --llm-model gpt-5.2- Discover routines from capturesbluebox-execute --routine-path example_data/example_routines/amtrak_one_way_train_search_routine.json --parameters-path example_data/example_routines/amtrak_one_way_train_search_input.json- Execute a routinebluebox-api-index --cdp-captures-dir ./cdp_captures --task "your task" --output-dir ./api_indexing_output --model gpt-5.2 --post-run-analysis- Run the API indexing pipeline (exploration + routine construction)bluebox-agent-adapter --agent NetworkSpecialist --cdp-captures-dir ./cdp_captures- Start HTTP adapter for programmatic agent interaction (see Agent HTTP Adapter section below)bluebox-agent-adapter --list-agents- List all available agents and their required data
Chrome Debug Mode
- macOS:
/Applications/Google Chrome.app/Contents/MacOS/Google Chrome --remote-debugging-address=127.0.0.1 --remote-debugging-port=9222 --user-data-dir="$HOME/tmp/chrome" --remote-allow-origins='*' --no-first-run --no-default-browser-check - Verify:
curl http://127.0.0.1:9222/json/version
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 295 lines · 3,431 tokens per session scan A 877105bf2efb
bluebox CLAUDE.md is an instructions file published in the GitHub repository VectorlyApp/bluebox (201 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 3,431 tokens to every session, about $0.0172 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
obscura AGENTS.md
Instructions for h4ckf0r0day/obscura, covering agents.md, build, rendering and stealth, no rendering, with rustls or stealth and test.
browser-harness AGENTS.md
Instructions for browser-use/browser-harness, covering code priorities and contributing.
browser-harness CLAUDE.md
Instructions for browser-use/browser-harness, a project described as: Browser Harness | Self-healing harness that enables LLMs to complete any task.
terminal AGENTS.md
Instructions for browser-use/terminal, covering agent notes, rust rewrite verification loop and terminal ui testing standard.
rustwright AGENTS.md
Instructions for Skyvern-AI/rustwright, covering repository instructions, public boundary, pull-request review, local verification and browser launches.
Uni-CLI AGENTS.md
Instructions for olo-dot-io/Uni-CLI, covering uni-cli, agent routing rule, always-on writing rule, what you can do and web (183+ sites).