What is hvtracker AGENTS.md?

A set of instructions for working on HVTracker, an AI-agent trust registry that assigns trust scores and grades. It describes the project's development rules and required checks.

Use it when developing HVTracker features, running its tests and site generator, or following its branching and release rules.

It tells coding agents how to change the repository safely and how to verify their work before proposing a merge or deployment.

hvtracker AGENTS.md — Instructions file by YugantM

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/yugantm/hvtracker/agents-md

Clone the repo

git clone --depth 1 https://github.com/YugantM/hvtracker

Made for: Codex, OpenCode.

Per session 4,868 This file is loaded in full into every session.

When invoked 4,868 The same file — it is already loaded in full.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.04868	$0.04868
Opus 5	$0.02434	$0.02434
Sonnet 5	$0.00974	$0.00974
Haiku 4.5	$0.00487	$0.00487

Measured 3d ago against content hash 5470e75d887d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hvtracker AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Prod is read-only checkable: `curl -A "Mozilla/5.0" https://hvtracker.net/healthz`

AGENTS.md · 260 lines

How it starts

The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

HVTracker (hvtracker.net) — AI-agent trust registry (HVTrust scores, grades A–D). FastAPI + static-site generator, deployed on Railway. This file is the session bootstrap: trust it instead of re-discovering the repo; verify only what you change.

Hard rules

One task = one branch (feat/<id>) = one PR off latest main. main is PR-only, squash-merge (linear history), 0 approvals required, CI not a gate.
Merging ≠ deploying. Deploy is manual railway up from a clean worktree. NEVER deploy or run railway commands unless explicitly told.
Never hand-edit generated output (agents/, ecosystem/, org/, data/, sitemap.xml, index.html, blog/, compare/*-vs-*/, changes/) — change the generator + re-render.
Never change production rank without an evidence gate (upset review); scoring changes ship as separate visible slices, never silent reweights.
Monetization on hold (visa): no billing/paid-tier code.
output/history/*.json daily snapshots are irreplaceable IP — never delete.

Gates — every PR, all three green

python -m pytest && python fetch_and_build.py --render-only && python tests/validate_html.py

CI additionally runs ruff check . (Python only), compileall, shellcheck.
--render-only churns generated artifacts; restore before committing: git checkout -- data/render_state.json og-v2.png
index.html, methodology.html, output/ are gitignored (server-rendered).
Tests need no Postgres: db.py falls back to agents.json when DATABASE_URL is unset; tests/test_api.py builds the site into a tmp OUTPUT_DIR.

Map — grep, don't read wholesale

fetch_and_build.py (~280KB, ~6k lines) — the generator. NEVER read whole; grep def <name>. Key: compute_weekly_changes (/changes/ + RSS via build_changes_rss), compute_movers (daily gainers/losers ticker, limit param), derive_agent_events (threshold events → recent_events → bell notifications), _load_prior_snapshot (rank Δ vs yesterday's history snapshot), compute_trust_score_v2 (runtime calibration — IS the production trust_score/rank/grade since methodology v4.0).
app.py — FastAPI serving, /healthz, 30-min signals-refresh scheduler.
auth.py — OAuth/password accounts, watchlist, /api/notifications (derive-on-read from recent_events in data/latest.json; needs DB for sign-in). auth.js — header widget incl. notification bell.
db.py — Postgres layer + file fallback. schema.sql idempotent DDL.
template.html — homepage (leaderboard, Δ column, ticker). templates/*.j2 — all other pages. Grade-B color #2c5282 is a design invariant.
Blog post = 4 surfaces: blog_static/<slug>/, blog_index card, sitemap_urls, blog_feed_items (all wired in fetch_and_build.py).
Scorecard data comes from our own CLI scan via the data branch (not deps.dev).

Read the full file on GitHub · 260 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

3d ago First seen · 260 lines · 4,868 tokens per session scan A 5470e75d887d

Subscribe to this mod's changes

hvtracker AGENTS.md is an instructions file published in the GitHub repository YugantM/hvtracker (5 stars, last pushed 3d ago), licensed MIT. It adds 4,868 tokens to every session, about $0.0243 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

AI Safety a2a ai-agents leaderboard mcp open-source

floe-guard AGENTS.md

Instructions for Floe-Labs/floe-guard, covering agents.md — floe-guard, what floe-guard is, add it to an agent — unattended steps, rules — get these right and the full govern-your-spend workflow (skill).

Floe-Labs/floe-guard · 1,175 tokens

AUTHENSOR AGENTS.md

Instructions for AUTHENSOR/AUTHENSOR, covering agents.md — authensor integration guide for ai agents, what authensor does for you, quick integration, if you have access to http and if you have access to npm / npx.

AUTHENSOR/AUTHENSOR · 1,298 tokens

AUTHENSOR CLAUDE.md

Instructions for AUTHENSOR/AUTHENSOR, covering authensor — claude code project context, what is this project, repository structure, key technical conventions and development commands.

AUTHENSOR/AUTHENSOR · 774 tokens

ardur AGENTS.md

Instructions for ArdurAI/ardur, covering ardur agent instructions, 0. first action in every new session, 1. what ardur is, and what it does not claim, 2. tl;dr commands and 3. architecture and trust boundaries.

ArdurAI/ardur · 6,115 tokens

ardur CLAUDE.md

Instructions for ArdurAI/ardur: This repository keeps a single, canonical set of agent instructions in AGENTS.md. This file exists only so that Claude Code loads them automatically; it deliberately holds no rules of its own, so that the two can never drift apart.

ArdurAI/ardur · 110 tokens

ardur GEMINI.md

Instructions for ArdurAI/ardur: This repository keeps a single, canonical set of agent instructions in AGENTS.md. This file exists only so that the Gemini CLI loads them automatically; it deliberately holds no rules of its own, so that the two can never drift apart.

ArdurAI/ardur · 95 tokens

hvtracker AGENTS.md