Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/adonai-labs/agent-runwayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/adonai-labs/agent-runway/api-design)<a href="https://agentmods.dev/rules/adonai-labs/agent-runway/api-design"><img src="https://agentmods.dev/badge/rules/adonai-labs/agent-runway/api-design/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/adonai-labs/agent-runway/api-design"><img src="https://agentmods.dev/badge/rules/adonai-labs/agent-runway/api-design.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01836 |
| Opus 5.5 | $0.00000 | $0.00734 |
| Sonnet 5.5 | $0.00000 | $0.00367 |
| Haiku 4.5 | $0.00000 | $0.00184 |
Grade A, and why
api-design scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 189 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Design Guidelines
Directives for designing and reviewing APIs. For detailed security patterns, defer to security.mdc and engineering-security.mdc.
REST Principles
Resource-based URLs
- Use nouns, not verbs:
/api/users,/api/orders— not/api/getUsersor/api/createOrder - Use plural nouns for collections:
/api/users— not/api/user - Nest resources only when there is a true parent-child relationship:
/api/users/123/posts - Avoid query params for resource identity: prefer
/api/users/123over/api/user?id=123
HTTP Methods and Status Codes
| Method | Use for | Success |
|---|---|---|
| GET | Read (idempotent) | 200 OK |
| POST | Create | 201 Created |
| PUT | Full replace | 200 OK |
| PATCH | Partial update | 200 OK |
| DELETE | Remove | 204 No Content |
| Status | Use when |
|---|---|
| 200 | Success with body |
| 201 | Created; include Location header |
| 204 | Success, no body |
| 400 | Validation error, bad request |
| 401 | Unauthenticated |
| 403 | Unauthorised (authenticated but forbidden) |
| 404 | Resource not found |
| 409 | Conflict (e.g. duplicate) |
| 429 | Rate limit exceeded |
| 500 | Internal server error |
Request/Response Models
- Define explicit DTOs for request bodies; do not accept raw
anyor untyped objects - Use separate DTOs for create vs update (create: required fields; update: optional fields)
- Wrap success responses in a consistent envelope; use a standard error envelope
- Exclude internal fields (e.g.
passwordHash) from response DTOs - Use ISO 8601 for dates in JSON
Success envelope: { data: T, message?: string, timestamp: string }
Error envelope: { error: { code: string, message: string, details?: object }, timestamp: string }
Versioning Strategies
| Strategy | When to use | Example |
|---|---|---|
| URL | Public APIs, breaking changes | /api/v1/users, /api/v2/users |
| Header | Content negotiation, same URL | Accept: application/vnd.company.api-v1+json |
| Query | Internal APIs, optional version | /api/users?version=1 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 189 lines · 0 tokens per session scan A f63d6597c3d6
api-design is a cursor rule published in the GitHub repository adonai-labs/agent-runway (2 stars, last pushed 17d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,836 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
salesforce-apex-cursorrules-prompt-file
Cursor rules for Salesforce development with Apex integration.
rails-cursorrules-prompt-file
Cursor rules for Rails development with basic setup.
django-best-practices
A broad set of coding rules for Django projects, covering views, models, forms, databases, APIs, security, testing, and project structure. Django is a Python web framework.
testing
Vitest toolchain and testing discipline - two runtimes, no watch for agents, authoring gate, junk patterns.
boffin-post-change-audit
Pre-flight review and post-change kernel audit.
refactoring
Refactoring: systematic approach, extract/inline, guard clauses, early returns.