open-agents AGENTS.md

open-agents AGENTS.md is an instructions file for Codex, OpenCode from vercel-labs/open-agents. It costs 1,250 tokens per session, scanned A, original, MIT.

Project instructions for coding agents working in the Open Agents repository, including authentication, database changes, migrations, and links to architecture and coding guidance.

In plain words
What is it for?
Guiding work on authentication, sessions, database schemas, migrations, environment variables, and project documentation.
Why use it?
It gives agents the repository-specific rules they need to avoid incorrect edits, such as changing database schemas without creating migration files.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/vercel-labs/open-agents/agents-md
Clone the repo
git clone --depth 1 https://github.com/vercel-labs/open-agents

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for open-agents AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/vercel-labs/open-agents/agents-md.svg)](https://agentmods.dev/instructions/vercel-labs/open-agents/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/vercel-labs/open-agents/agents-md"><img src="https://agentmods.dev/badge/instructions/vercel-labs/open-agents/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 1,250 This file is loaded in full into every session.
When invoked 1,250 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01250 $0.01250
Opus 5 $0.00625 $0.00625
Sonnet 5 $0.00250 $0.00250
Haiku 4.5 $0.00125 $0.00125

Measured 3d ago against content hash 3e9d5dd6cf68, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

open-agents AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 110 lines

How it starts

The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This file provides guidance for AI coding agents working in this repository.

This is a living document. When you make a mistake or learn something new about this codebase, add it to Lessons Learned.

Authentication

Authentication uses Better Auth with Vercel OAuth (sign-in) and GitHub OAuth (repo access). Config lives in apps/web/lib/auth/config.ts. Sessions are managed by better-auth's built-in session system — there is no manual JWE/encryption layer.

Key env vars: BETTER_AUTH_SECRET (session signing), NEXT_PUBLIC_VERCEL_APP_CLIENT_ID + VERCEL_APP_CLIENT_SECRET (Vercel OAuth), plus GitHub App credentials for repo access. See apps/web/.env.example for the full list.

Database & Migrations

Schema lives in apps/web/lib/db/schema.ts. Migrations are managed by Drizzle Kit.

After modifying schema.ts, always generate a migration:

pnpm --dir apps/web db:generate   # Creates a new .sql migration file

Commit the generated .sql file alongside the schema change. Do not use db:push except for local throwaway databases.

Migrations run automatically during pnpm build (via lib/db/migrate.ts), so every Vercel deploy — both preview and production — applies pending migrations to its own database.

Environment isolation

Neon database branching is enabled in the Vercel project settings. Every preview deployment automatically gets its own isolated database branch forked from production. This means preview deployments never read or write production data. Production deployments use the main Neon database.

Commands

# Development
pnpm web            # Run web app

# Quality checks (REQUIRED after making any changes)
pnpm run ci                             # Required: run format check, lint, typecheck, and tests
turbo typecheck                            # Type check all packages

# Linting and formatting (Ultracite - oxlint + oxfmt, run from root)
pnpm check                              # Lint and format check all files
pnpm fix                                # Lint fix and format all files

# Filter by package (use --filter)
turbo typecheck --filter=web # Type check web app only

# Testing
bun test                                              # Run all tests
bun test path/to/file.test.ts                         # Run single test file
bun test --watch                                      # Watch mode
pnpm test:verbose                                  # Run tests with JUnit reporter streamed to stdout (useful in non-interactive shells)
pnpm test:verbose path/to/file.test.ts             # Same verbose output for a single test file

Read the full file on GitHub · 110 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 110 lines · 1,250 tokens per session scan A 3e9d5dd6cf68

Subscribe to this mod's changes

open-agents AGENTS.md is an instructions file published in the GitHub repository vercel-labs/open-agents (5,798 stars, last pushed 5d ago), licensed MIT. It adds 1,250 tokens to every session, about $0.0063 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.