Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/wbopan/things-cloud-mcp/agents-mdgit clone --depth 1 https://github.com/wbopan/things-cloud-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/wbopan/things-cloud-mcp/agents-md)<a href="https://agentmods.dev/instructions/wbopan/things-cloud-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/wbopan/things-cloud-mcp/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01567 | $0.01567 |
| Opus 5 | $0.00783 | $0.00783 |
| Sonnet 5 | $0.00313 | $0.00313 |
| Haiku 4.5 | $0.00157 | $0.00157 |
Grade A, and why
things-cloud-mcp AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Use `THINGS_BASIC_AUTH` for local curl examples; never place an email/password or encoded credential in source files, shell history, or logs. How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Build and test
Use the Go toolchain on PATH (on the current macOS workstation it is /opt/homebrew/bin/go).
go test ./...
go test -race ./...
go vet ./...
go build ./...
Run the same four checks in things-cloud-sdk/ after SDK changes. The server defaults to port 8080.
Environment variables:
PORT: HTTP port.DATA_DIR: SQLite and credential-key directory (defaultdata/).JWT_SECRET: base64 JWT signing key; generated when absent.CREDENTIALS_SECRET: durable high-entropy secret used to derive the AES key for Things passwords at rest. When absent, the server createsDATA_DIR/credentials.keywith mode0600.THINGS_DEBUG: SDK debug logging.
Architecture and safety invariants
The single-package Go MCP server is in main.go, oauth.go, and landing.go. Requests authenticate with Basic credentials or OAuth bearer tokens. UserManager creates a per-account ThingsMCP; the cache binds an account to a digest of the authenticated credentials, never just an email address.
Key SDK types from github.com/arthursoares/things-cloud-sdk:
Task.CreationDateistime.Time;ScheduledDate,DeadlineDate, andCompletionDateare pointers.TaskType:0task,1project,2heading.TaskStatus:0pending,2canceled,3completed.TaskSchedule:0inbox,1anytime,2someday.Task.StartBucket:0default,1tonight (wire fieldsb).
Every operation for one account holds that account's opMu for the complete sync, validation, handler, and write lifecycle. Do not narrow this lock: history cursors and the in-memory task graph must advance atomically.
Synchronization is fail-closed:
- Resolve and use the history key returned by
Verify; never select the numerically largest history. - Initial load builds a candidate history and state, then swaps both only after every page and event validates.
- Incremental sync uses a cloned cursor and applies a fully validated delta atomically.
- Never automatically fall back to a full rebuild after an incremental error.
- Reject unknown schema versions, business-entity kinds, actions, malformed payloads, cursor regression, and no-progress pagination. Versioned
Settings<digits>records are the explicit exception: they are account metadata and must be ignored so settings-only version bumps cannot block the task graph.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 88 lines · 1,567 tokens per session scan A c9a628790b8b
things-cloud-mcp AGENTS.md is an instructions file published in the GitHub repository wbopan/things-cloud-mcp (23 stars, last pushed 14d ago), licensed MIT. It adds 1,567 tokens to every session, about $0.0078 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
mcp-server-things CLAUDE.md
Claude Code instructions for ebowman/mcp-server-things, covering things 3 mcp server - ai assistant instructions, project overview, ✨ latest features (v1.7.0), architecture and development guidelines.
things-mcp CLAUDE.md
Instructions for wbopan/things-mcp, covering claude.md, development commands, essential commands, testing commands and memories.
mcp-server-things AGENTS.md
AGENTS.md instructions for ebowman/mcp-server-things, covering agent instructions, quick reference, non-interactive shell commands, force overwrite without prompting and for recursive operations.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.