vercel-labs/dev3000 is a local web debugging runtime that records a web app's server logs, browser events, errors, network activity, interactions, and screenshots in one timestamped timeline. Coding agents use it to run and inspect web applications while reproducing bugs. Its catalogue add-ons teach agents how to operate the runtime and examine its debugging evidence.
Borrowing it
Nothing to install: this file belongs to vercel-labs/dev3000. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vercel-labs/dev3000/main/AGENTS.mdgit clone --depth 1 https://github.com/vercel-labs/dev3000Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/vercel-labs/dev3000/agents-md)<a href="https://agentmods.dev/instructions/vercel-labs/dev3000/agents-md"><img src="https://agentmods.dev/badge/instructions/vercel-labs/dev3000/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/vercel-labs/dev3000/agents-md"><img src="https://agentmods.dev/badge/instructions/vercel-labs/dev3000/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01388 | $0.01388 |
| Opus 5.5 | $0.00555 | $0.00555 |
| Sonnet 5.5 | $0.00278 | $0.00278 |
| Haiku 4.5 | $0.00139 | $0.00139 |
Grade A, and why
dev3000 AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
This file is the source of truth for agent guidance in this repo. CLAUDE.md is symlinked here.
Runtime
- Use the unified d3k runtime in
src/runtime/.d3k,dev3000, andd3k-runtimeexpose the same commands. - From the target app, use
node <checkout>/skills/d3k/scripts/runtime.mjsto test unreleased source. Do not use a previously published package for source validation. - Before local startup, run
d3k portless status --json. Canonical port-free HTTPS must be ready. If needed rund3k portless setup, wait for one-time administrator authorization, then verify again. Do not start the local app or browser before it is ready. - Run
d3k startin a retained background tool session. Keep it alive across edits and user testing; do not ask the user to launch it. - Use
start --command '<dev command>'for custom servers. Startup and browser-navigation timeout values are milliseconds. - Inspect
d3k status, retain its session ID and cursor, then readd3k events --session <id> --after <cursor>. Continue whilehasMoreis true.logsanderrors --contextare views over the same bounded timeline. - Drive the exact monitored browser with
d3k browser snapshot -iandd3k browser click @e2. The runtime owns CDP; do not launch a second browser or override connection/profile options through the browser command. - Stop with
d3k stopwhen asked. Persist only session discovery and browser profiles. Export screenshots throughd3k browser screenshot <absolute-path>only on request. - Sandbox mode currently requires macOS; d3k downloads Chrome for Testing automatically on first use and reuses it afterward. Chrome runs under filesystem confinement; do not bypass it. Gateway keys are not automatically provisioned or forwarded. Sandbox mode runs the project remotely with local Chrome:
d3k --project <team/project>ord3k sandbox --project <team/project>. No local project checkout is required. Sandbox apps usehttps://<project>.d3k.localhost; use--hostname songbookforhttps://songbook.d3k.localhost. Canonical Portless runs on the laptop. Use--no-shellto retain the companion in a background session. Private repos require an already provisioned sandbox and--attach <name>. Used3k --resumeto list saved sandbox sessions andd3k --resume <id>to recreate the browser connection; Ctrl-C prints the resume command. - Optional
--harness fx|codex|claudestarts the selected harness after readiness in an interactive terminal, using temporary d3k skill context. The CLI does not install local harness packages, persist logs, capture automatic screenshots/screencasts, or automatically upgrade itself. - Do not run
bun run devorbun run buildforwww/. www/is a public landing page and changelog. Hosted dev agents, skill runners, workflows, authentication, and blob storage have been removed; do not recreate those surfaces. Sandbox support belongs in the CLI.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · -24 lines · +116 tokens per session 63d107aab00b
- 14d ago Changed · -6 lines · -48 tokens per session e7a34aa8bfbc
- 2mo ago First seen · 119 lines · 1,320 tokens per session scan A 70f791423514
dev3000 AGENTS.md is an instructions file published in the GitHub repository vercel-labs/dev3000 (1,597 stars, last pushed 7d ago), licensed MIT. It adds 1,388 tokens to every session, about $0.0056 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
dev3000 AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| dev3000 AGENTS.mdvercel-labs/dev3000 | Instructions file | 1.6k | 7d ago | MIT | A | 1,388 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | today | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |