personal-edge-proxy AGENTS.md

A deployment guide for a personal proxy system on a VPS, a rented virtual server. It separates inbound connections from the VPS from outbound connections to destinations and defines several possible routes for each.

In plain words
What is it for?
Choosing a deployment profile, configuring connection methods into the server, selecting how traffic leaves it, and applying direct, alternative, or blocked routes.
Why use it?
It prevents these two traffic directions from being confused, which can lead to an incorrect or less reliable deployment.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/yding-git/personal-edge-proxy/agents-md
Clone the repo
git clone --depth 1 https://github.com/yding-git/personal-edge-proxy

Made for: Codex, OpenCode.

Per session 3,405 This file is loaded in full into every session.
When invoked 3,405 The same file — it is already loaded in full.
Security scan D 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.03405 $0.03405
Opus 5 $0.01702 $0.01702
Sonnet 5 $0.00681 $0.00681
Haiku 4.5 $0.00341 $0.00341

Measured 2d ago against content hash 0414f95c96df, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

personal-edge-proxy AGENTS.md scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- root or sudo access;

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@SERVER_IP "umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys"
AGENTS.md · 551 lines

How it starts

The opening of the file, as written. The whole thing — 551 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md — AI maintainer / deployer guide

Read this file before editing or deploying the repository.

1. Core model

Keep the architecture separated into two independent layers:

Inbound  = how the client reaches the VPS
Outbound = how the VPS reaches a destination

Do not confuse inbound redundancy with outbound identity/reputation.

Typical inbound roles:

Hysteria2                    primary daily entry
VLESS + REALITY + Vision     optional TCP backup
VLESS + WS + CF Tunnel       optional emergency entry

Typical outbound roles:

VPS direct       ordinary traffic
WARP             preferred selected-AI egress
fixed SOCKS5     optional stable egress for selected services
block            explicit deny / fail-closed

Profiles are not strictly cumulative. Use the profile that matches the user's real goal.

Profile A — minimum viable

Client -> HY2 -> VPS -> Direct

Use when the user only wants a simple working personal node.

Trade-off: AI services see the VPS data-center egress directly. On low-reputation or heavily reused data-center ranges, users may encounter more availability challenges, CAPTCHAs, regional mismatches, or account-security checks.

Do not claim that this guarantees account suspension or that data-center IPs are universally unusable.

Profile B — inbound-resilient direct egress

HY2 primary
+
REALITY backup
+
VPS Direct egress

This reduces inbound protocol failure risk when UDP is poor or unavailable.

It does not materially improve the final egress identity versus Profile A, because destinations still see the VPS Direct IP.

Profile C — WARP-selected AI egress

HY2 -> VPS
        |- ordinary traffic -> Direct
        `- selected AI      -> WARP Local Proxy

Use when the user wants to reduce dependence on the VPS's raw data-center egress for AI/SaaS traffic.

This is the preferred starting profile for an AI-heavy use case.

Read the full file on GitHub · 551 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 551 lines · 3,405 tokens per session scan D 0414f95c96df

Subscribe to this mod's changes

personal-edge-proxy AGENTS.md is an instructions file published in the GitHub repository yding-git/personal-edge-proxy (715 stars, last pushed 8d ago), licensed MIT. It adds 3,405 tokens to every session, about $0.0170 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.