yahoo-shopping-mcp: Instructions file for Codex

AGENTS.md

yahoo-shopping-mcp AGENTS.md is an instructions file for Codex, OpenCode from ymuichiro/yahoo-shopping-mcp. It costs 1,712 tokens per session, scanned A, original, MIT.

Project instructions for yahoo-shopping-mcp, an MCP server that wraps the Yahoo! Shopping product-search API. They document its tools, rate limits, caching, startup methods, environment settings, and project structure.

In plain words
What is it for?
Setting up the server, supplying its application ID, running it locally or in Docker, configuring hosts and rate limits, and running its tests.
Why use it?
They tell an agent how to configure, run, test, and safely change the server without guessing about its API or operational limits.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions AGENTS.md.

This is ymuichiro/yahoo-shopping-mcp's own configuration. It tells Codex and OpenCode how to work on yahoo-shopping-mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything yahoo-shopping-mcp configures →

Reuse

Borrowing it

Nothing to install: this file belongs to ymuichiro/yahoo-shopping-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ymuichiro/yahoo-shopping-mcp/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/ymuichiro/yahoo-shopping-mcp

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for yahoo-shopping-mcp AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ymuichiro/yahoo-shopping-mcp/agents-md/github.svg)](https://agentmods.dev/instructions/ymuichiro/yahoo-shopping-mcp/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/ymuichiro/yahoo-shopping-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/ymuichiro/yahoo-shopping-mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for yahoo-shopping-mcp AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/ymuichiro/yahoo-shopping-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/ymuichiro/yahoo-shopping-mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 1,712 This file is loaded in full into every session.
When invoked 1,712 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.01712 $0.01712
Opus 5 $0.00856 $0.00856
Sonnet 5 $0.00342 $0.00342
Haiku 4.5 $0.00171 $0.00171

Measured 9d ago against content hash de2dbec03574, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

yahoo-shopping-mcp AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 104 lines

How it starts

The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Project Summary

このリポジトリは Yahoo!ショッピング 商品検索 API v3 を安全にラップする MCP サーバーです。 主な責務は次の 3 つです。

  • MCP ツール search_products の提供
  • Yahoo API 呼び出しのレート制御とキャッシュ
  • アプリケーション全体に対するグローバルレート制限

サーバー本体は FastMCP を使っています。通常のローカル起動・Docker・セルフホストは Streamable HTTP で公開し、Glama managed 用にstdio専用エントリポイントも提供します。公開 HTTP ルートは /, /healthz, /mcp のみです。//healthz と同じヘルス応答を返します。

Common Commands

  • 初回セットアップ: make sync-dev
  • 起動: YAHOO_SHOPPING_APP_ID=... make run
  • コンテナ起動: make init-env && make up
  • Named Tunnel 起動: make up-tunnel
  • コンテナ停止: make down
  • テスト: make test
  • 依存だけ同期: make sync
  • ローカル状態を掃除: make clean

デフォルトのホストとポートは 127.0.0.1:8000 です。変更したい場合は make run HOST=0.0.0.0 PORT=8080 のように上書きします。

Environment Variables

必須:

  • YAHOO_SHOPPING_APP_ID

主要な任意設定:

  • YAHOO_SHOPPING_MCP_HOST
  • YAHOO_SHOPPING_MCP_PORT
  • YAHOO_SHOPPING_MCP_DATA_DIR
  • YAHOO_SHOPPING_MCP_CACHE_TTL_SECONDS
  • YAHOO_SHOPPING_MCP_BASE_RATE_SECONDS
  • YAHOO_SHOPPING_MCP_GLOBAL_RATE_LIMIT
  • YAHOO_SHOPPING_MCP_GLOBAL_WINDOW_SECONDS
  • YAHOO_SHOPPING_MCP_ALLOWED_HOSTS
  • YAHOO_SHOPPING_MCP_ALLOWED_ORIGINS
  • CLOUDFLARE_TUNNEL_TOKEN

Project Structure

  • src/yahoo_shopping_mcp/server.py MCP サーバー生成、lifespan 管理、HTTP ルート、stdio/HTTPエントリポイント、ツール定義
  • src/yahoo_shopping_mcp/yahoo_api.py Yahoo API 呼び出し、直列レート制御、リトライ、レスポンス整形
  • src/yahoo_shopping_mcp/storage.py JSON 永続化、原子的書き込み、グローバルレート制限、キャッシュ
  • src/yahoo_shopping_mcp/models.py 入出力モデル、永続化モデル
  • tests/test_http_routes.py HTTP ルートと公開 MCP 呼び出しの統合テスト
  • tests/test_yahoo_api.py Yahoo ラッパーのテスト
  • Dockerfile 本番用コンテナイメージ
  • compose.yaml ローカル公開と Named Tunnel を含む compose 構成
  • .env.example Compose 用の環境変数テンプレート

Development Guidelines

  • Yahoo への実リクエストをテストで送らないこと。テストは httpx.MockTransport でダミーレスポンスを返す。
  • レート制限を変える場合は、成功系だけでなく拒否系も追加でテストする。
  • search_products の入力契約を変える場合は、models.py、README、テストを同時に更新する。
  • search_products の返却では、商品データを MCP tool result の content[0].text に JSON として含めること。ChatGPT では structuredContent / outputSchema だけに置いた商品データが会話本文として認識されず、metadata だけが露出することがある。
  • content[0].text の JSON は、先頭キー resultsid, title, url, text, metadata を持つ商品リストを置く。metadata には少なくとも price, price_text, seller_name, image_url, badges を含める。
  • 商品カード UI は ui://yahoo-shopping/product-carousel-v4.html の MCP Apps Resource で提供する。tool metadata は標準の _meta.ui.resourceUri、Resource は text/html;profile=mcp-app と Yahoo 画像 CDN の最小 CSP を返す。
  • content[0].text の商品本文と、カルーセル用の structuredContent.products を併記する。tool の outputSchema は後者と同じ { products: [...] } に限定する。
  • UI は ChatGPT が推奨する MCP Apps ui/* bridge を使う。旧 window.openai や legacy metadata の互換経路を追加しない。
  • UI Resource の HTML/JS/CSS を変更したら URI のバージョンも上げ、ChatGPT のキャッシュを確実に更新する。
  • MCP Apps の bridge や structuredContent を触ったら、MCP Inspector で ui/initialize、カルーセル、商品画像、console error がないことを確認してから完了にする。
  • 診断情報や上流レスポンスは MCP tool result に返さないこと。LLM/host が検索結果として読む主データは results とし、詳細な診断はサーバー側だけで扱う。
  • Yahoo 向け直列レート制御とアプリ全体のグローバルレート制限は別物として扱う。目的を混同しない。
  • このプロジェクトは認証を使わない。認証やユーザー単位制御、UI 画面を再導入しないこと。
  • 過剰なフォールバックや用途不明の抽象化を追加しないこと。公開面は MCP + healthz に限定する。

Read the full file on GitHub · 104 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 104 lines · 1,712 tokens per session scan A de2dbec03574

Subscribe to this mod's changes

yahoo-shopping-mcp AGENTS.md is an instructions file published in the GitHub repository ymuichiro/yahoo-shopping-mcp (1 stars, last pushed 1mo ago), licensed MIT. It adds 1,712 tokens to every session, about $0.0086 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

vibetags com-example-service-PricingService.instructions.md

Instructions for PIsberg/vibetags, covering copilot instructions for pricingservice, context & focus, rules for method calculateprice, contract-frozen signature and rules for method applypromocode.

PIsberg/vibetags · 296 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,153 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens