Borrowing it
Nothing to install: this file belongs to vineetu/simple-host. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vineetu/simple-host/main/CLAUDE.mdgit clone --depth 1 https://github.com/vineetu/simple-hostWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/vineetu/simple-host/claude-md)<a href="https://agentmods.dev/instructions/vineetu/simple-host/claude-md"><img src="https://agentmods.dev/badge/instructions/vineetu/simple-host/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/vineetu/simple-host/claude-md"><img src="https://agentmods.dev/badge/instructions/vineetu/simple-host/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02596 | $0.02596 |
| Opus 5.5 | $0.01038 | $0.01038 |
| Sonnet 5.5 | $0.00519 | $0.00519 |
| Haiku 4.5 | $0.00260 | $0.00260 |
Grade B, and why
simple-host CLAUDE.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
by hand: `sudo systemctl start sh-plugin-repo-sync`, or `DRY_RUN=1 bash scripts/publish-claude-plugin-repo.sh` to preview. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl -s -o /dev/null -w '%{http_code}\n' https://simple-host.app/healthz` → 200 How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
Working rules for any agent (Claude Code, Codex, Cursor, ...) changing this repo. Simple Host is one Go binary that hosts static sites with a small per-site JSON backend; it is live at https://simple-host.app and runs in production for real users.
Before you change anything
- Read
INTENT.md(what it is for, non-goals, decisions with dates), thenFEATURES.md(what it does today), thenARCHITECTURE.md(where it lives). git fetchand fast-forward first. Two sessions have overwritten each other in production.- Map every surface a change touches before coding: routes,
openapi.yaml,llms.txt, the skills, the dashboard and the showcase page, the MCP tools, the Claude and OpenAI plugins. - If a request conflicts with
INTENT.md, say so in one line and ask. When the owner rules on something, add it to INTENT's decisions with the date and reason.
In the same commit as a feature change
- Update
FEATURES.mdand add a line toCHANGELOG.md(newest first, plain language). - Route changed: update
internal/handler/static/openapi.yaml(the contract), regenerateopenapi.jsonwithpython3 -c "import yaml,json;json.dump(yaml.safe_load(open('internal/handler/static/openapi.yaml')),open('internal/handler/static/openapi.json','w'),indent=2)", thenllms.txtand the skills if it is user-facing.scripts/check-docs-sync.shfails on drift. - Skills changed: bump
versioninsimple-host-website/.claude-plugin/plugin.json(the stale-skill notice reads it from the embedded file), then runbash scripts/sync-claude-plugin.sh. Never hand-editplugins/simple-host/skills/. - The plugin repos github.com/vineetu/simple-host-plugin and simple-hack-plugin are published
from origin/main by the hourly
sh-plugin-repo-sync.timer(it runs bothscripts/publish-*claude-plugin-repo.sh); by hand:sudo systemctl start sh-plugin-repo-sync, orDRY_RUN=1 bash scripts/publish-claude-plugin-repo.shto preview. - Schema changed: edit
db/schema.sqlAND add a file underdb/migrations/(hosted batches:<batch>-<what>.sql; lexical order is apply order). The file must be plain SQL, idempotent (ADD COLUMN IF NOT EXISTS,CREATE ... IF NOT EXISTS) and safe on a live database (additive, defaults, no long locks, noCONCURRENTLY):simple-host migrateruns every file not yet recorded inschema_migrations, including on databases built fromschema.sqlthat already have its effect. Full rule:db/migrations/migrations.go. The historical files listed there as baseline are never run. Small boxes migrate frominstall.shon every run; the server never migrates on start. Production: apply the file by hand before deploying (the binary refuses to start if a column it reads is missing), thensimple-host migrate -mark <file>(or justsimple-host migrate);migrate -statuslists what is pending. - Parity with Simple Host Enterprise (
PARITY.md, identical in both repos): any security fix in one repo is checked against the other the same day (note it in PARITY.md). A new or changed feature updates PARITY.md in the same commit.scripts/check-parity.sh(incheck-docs-sync.sh) fails if a## N.section of FEATURES.md has no PARITY.md row. - Design docs in
docs/designs/carry a status line at the top; update it when you ship or drop the thing. Finished plans go todocs/history/.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +3 lines · +69 tokens per session 9dd7205a0aa6
- 6d ago Changed · +34 tokens per session 0e32690cc505
- 13d ago Changed · +5 lines · +89 tokens per session 5f8756dc2b46
- 16d ago Changed · +3 lines · +101 tokens per session e50f034617dd
- 20d ago Changed · +12 tokens per session 17ce6bc9176f
- 1mo ago Changed · +7 lines · +170 tokens per session 897633c3c69f
- 1mo ago Changed · +19 lines · -1,122 tokens per session scan A → B aa3c6b5c34c5
- 1mo ago Changed · +2 lines · +495 tokens per session ce29f1caafaf
- 1mo ago Changed · +1 lines · +162 tokens per session abfc8bfceb5e
- 1mo ago First seen · 104 lines · 2,586 tokens per session scan A 7adc46124458
simple-host CLAUDE.md is an instructions file published in the GitHub repository vineetu/simple-host (1 stars, last pushed today), licensed MIT. It adds 2,596 tokens to every session, about $0.0104 per session on Opus 5.5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.