1001-rails-controllers

1001-rails-controllers is a cursor rule for coding agents from andyw8/rails_rules. It costs 0 tokens per session (517 once invoked), scanned A, original, MIT.

A set of conventions for controllers in Ruby on Rails 8.0. Controllers handle web requests and responses, such as listing records, creating them, or returning errors.

In plain words
What is it for?
Use it when creating or editing Rails controllers, especially REST-style HTML or JSON endpoints that list, create, update, or delete records.
Why use it?
It keeps request handling predictable and consistent, including routes, authentication, pagination, redirects, response formats, and error statuses.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/andyw8/rails_rules/1001-rails-controllers
Clone the repo
git clone --depth 1 https://github.com/andyw8/rails_rules

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for 1001-rails-controllers

README.md
[![agentmods](https://agentmods.dev/badge/rules/andyw8/rails_rules/1001-rails-controllers.svg)](https://agentmods.dev/rules/andyw8/rails_rules/1001-rails-controllers)
Your own site
<a href="https://agentmods.dev/rules/andyw8/rails_rules/1001-rails-controllers"><img src="https://agentmods.dev/badge/rules/andyw8/rails_rules/1001-rails-controllers.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 517 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00517
Opus 5 $0.00000 $0.00259
Sonnet 5 $0.00000 $0.00103
Haiku 4.5 $0.00000 $0.00052

Measured 4d ago against content hash 6c03fc153bf3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

1001-rails-controllers scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

lib/generators/rails_rules/templates/1001-rails-controllers.mdc · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Rails Controller Standards

Context

  • In Ruby on Rails 8.0 controllers
  • Controllers should follow RESTful conventions
  • Comment style includes HTTP verb and path

Requirements

  • Add controller method comments with HTTP verb and full path
  • Use resource-based naming
  • Use before_action for common setup
  • Namespace API controllers under Api::V1
  • Use respond_to for format handling (HTML/JSON)
  • Use pagy for pagination: @pagy, @resources = pagy(Resource.sort_by_params(params[:sort], sort_direction))
  • Use status: :see_other for redirects after DELETE
  • Use status: :unprocessable_entity for failed creates/updates
  • Return 404 for records not found with rescue ActiveRecord::RecordNotFound
  • Use params.expect(:resource) instead of params.require
  • Include authentication callbacks where needed

Examples

GET /categories

def index @pagy, @categories = pagy(Category.sort_by_params(params[:sort], sort_direction)) end

POST /categories

def create @category = Category.new(category_params)

respond_to do |format|
  if @category.save
    format.html { redirect_to @category, notice: "Category was successfully created." }
    format.json { render :show, status: :created, location: @category }
  else
    format.html { render :new, status: :unprocessable_entity }
    format.json { render json: @category.errors, status: :unprocessable_entity }
  end
end

end

private

def set_category @category = Category.find(params.expect(:id)) rescue ActiveRecord::RecordNotFound redirect_to categories_path end

def category_params params.expect(category: [:name, :description]) end end

</example>

<example type="invalid">
```ruby
class CategoriesController < ApplicationController
  def index
    @categories = Category.all
  end

  def create
    @category = Category.new(params.permit(:name, :description))
    if @category.save
      redirect_to @category
    else
      render :new
    end
  end
end

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 83 lines · 0 tokens per session scan A 6c03fc153bf3

Subscribe to this mod's changes

1001-rails-controllers is a cursor rule published in the GitHub repository andyw8/rails_rules (4 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 517 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.