npm-packages: Instructions file for Codex

AGENTS.md

npm-packages AGENTS.md is an instructions file for Codex, OpenCode from WebMCP-org/npm-packages. It costs 3,268 tokens per session, scanned A, original, MIT.

Repository guidance for AI coding agents working on WebMCP npm packages, including their commands, folders, applications, and tests. npm packages are reusable JavaScript or TypeScript libraries.

In plain words
What is it for?
Use it when working on packages, the landing page, documentation, end-to-end tests, or WebMCP conformance tests.
Why use it?
It gives agents the project’s expected commands and structure, reducing mistakes when building, checking, testing, or changing packages and apps.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is WebMCP-org/npm-packages's own configuration. It tells Codex and OpenCode how to work on npm-packages itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything npm-packages configures →

Reuse

Borrowing it

Nothing to install: this file belongs to WebMCP-org/npm-packages. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/WebMCP-org/npm-packages/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/WebMCP-org/npm-packages

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for npm-packages AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/webmcp-org/npm-packages/agents-md/github.svg)](https://agentmods.dev/instructions/webmcp-org/npm-packages/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/webmcp-org/npm-packages/agents-md"><img src="https://agentmods.dev/badge/instructions/webmcp-org/npm-packages/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for npm-packages AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/webmcp-org/npm-packages/agents-md"><img src="https://agentmods.dev/badge/instructions/webmcp-org/npm-packages/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 3,268 This file is loaded in full into every session.
When invoked 3,268 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.03268 $0.03268
Opus 5.5 $0.01307 $0.01307
Sonnet 5.5 $0.00654 $0.00654
Haiku 4.5 $0.00327 $0.00327

Measured 1mo ago against content hash c15e780a943e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

npm-packages AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 220 lines

How it starts

The opening of the file, as written. The whole thing — 220 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Guidance for AI agents when working with this repository.

Commands

vp install            # Install dependencies
pnpm build            # Build all packages
pnpm typecheck        # Type checking
vp check --fix        # Lint, format, and fix (Oxlint + Oxfmt)
vp check              # Check without fixing (CI)
pnpm check-all        # All checks (typecheck + lint)
pnpm test:unit        # Unit tests only
pnpm test:e2e         # E2E tests only
pnpm test:wpt         # Pinned upstream WebMCP WPT (requires Chrome Canary)
vp test run           # Run tests in current package
vp pack               # Build current library package
pnpm changeset        # Create a changeset for versioning

Structure

packages/           # All NPM packages (@mcp-b/*)
apps/               # Deployed apps (landing-page, documentation-website)
e2e/                # E2E tests and test apps
docs/               # Technical documentation
.agents/skills/     # Agent skills and their bundled references/assets
.reference/         # Upstream reference repos (gitignored, shallow clones)

Apps (apps/*)

Both apps are pnpm workspace members.

apps/landing-page — @mcp-b/landing-page

Landing page at mcp-b.ai (also www.mcp-b.ai). Astro 7 (output: 'server') deployed to Cloudflare Workers via @astrojs/cloudflare v14. Dev runs on real workerd (Vite Environment API).

  • pnpm dev (wrangler types → astro dev), pnpm build (wrangler types → astro check → astro build), pnpm preview.
  • Cloudflare runtime: env via import { env } from 'cloudflare:workers'; Astro.request.cf; execution context at Astro.locals.cfContext. Do NOT use Astro.locals.runtime (removed from @astrojs/cloudflare in v13, used with Astro 6).
  • Secrets: npx wrangler secret put <KEY>; local secrets in .dev.vars.
  • Config: astro.config.mjs, wrangler.jsonc. Excluded from root pnpm build/check-all via --filter '!@mcp-b/landing-page'.

apps/documentation-website — @mcp-b/documentation-website

Read the full file on GitHub · 220 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +11 lines · +425 tokens per session c15e780a943e
  2. 2mo ago First seen · 209 lines · 2,843 tokens per session scan A 9d35bc37c653

Subscribe to this mod's changes

npm-packages AGENTS.md is an instructions file published in the GitHub repository WebMCP-org/npm-packages (106 stars, last pushed 2d ago), licensed MIT. It adds 3,268 tokens to every session, about $0.0131 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

npm-packages AGENTS.md compared with instructions from other repositories

npm-packages AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
npm-packages AGENTS.mdWebMCP-org/npm-packagesInstructions file1062d agoMITA3,268Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143kyesterdayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode