Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/anymouschina/tapcanvas/projectgit clone --depth 1 https://github.com/anymouschina/TapCanvasWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01679 | $0.01679 |
| Opus 5 | $0.00839 | $0.00839 |
| Sonnet 5 | $0.00336 | $0.00336 |
| Haiku 4.5 | $0.00168 | $0.00168 |
Grade A, and why
project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Conventions — new-api
Overview
This is an AI API gateway/proxy built with Go. It aggregates 40+ upstream AI providers (OpenAI, Claude, Gemini, Azure, AWS Bedrock, etc.) behind a unified API, with user management, billing, rate limiting, and an admin dashboard.
Tech Stack
- Backend: Go 1.22+, Gin web framework, GORM v2 ORM
- Frontend: React 18, Vite, Semi Design UI (@douyinfe/semi-ui)
- Databases: SQLite, MySQL, PostgreSQL (all three must be supported)
- Cache: Redis (go-redis) + in-memory cache
- Auth: JWT, WebAuthn/Passkeys, OAuth (GitHub, Discord, OIDC, etc.)
- Frontend package manager: Bun (preferred over npm/yarn/pnpm)
Architecture
Layered architecture: Router -> Controller -> Service -> Model
router/ — HTTP routing (API, relay, dashboard, web)
controller/ — Request handlers
service/ — Business logic
model/ — Data models and DB access (GORM)
relay/ — AI API relay/proxy with provider adapters
relay/channel/ — Provider-specific adapters (openai/, claude/, gemini/, aws/, etc.)
middleware/ — Auth, rate limiting, CORS, logging, distribution
setting/ — Configuration management (ratio, model, operation, system, performance)
common/ — Shared utilities (JSON, crypto, Redis, env, rate-limit, etc.)
dto/ — Data transfer objects (request/response structs)
constant/ — Constants (API types, channel types, context keys)
types/ — Type definitions (relay formats, file sources, errors)
i18n/ — Backend internationalization (go-i18n, en/zh)
oauth/ — OAuth provider implementations
pkg/ — Internal packages (cachex, ionet)
web/ — React frontend
web/src/i18n/ — Frontend internationalization (i18next, zh/en/fr/ru/ja/vi)
Internationalization (i18n)
Backend (i18n/)
- Library:
nicksnyder/go-i18n/v2 - Languages: en, zh
Frontend (web/src/i18n/)
- Library:
i18next+react-i18next+i18next-browser-languagedetector - Languages: zh (fallback), en, fr, ru, ja, vi
- Translation files:
web/src/i18n/locales/{lang}.json— flat JSON, keys are Chinese source strings - Usage:
useTranslation()hook, callt('中文key')in components - Semi UI locale synced via
SemiLocaleWrapper - CLI tools:
bun run i18n:extract,bun run i18n:sync,bun run i18n:lint
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 138 lines · 1,679 tokens per session scan A 2ceca547290a
project is a cursor rule published in the GitHub repository anymouschina/TapCanvas (579 stars, last pushed 14d ago), licensed MIT. It adds 1,679 tokens to every session, about $0.0084 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
specify-rules
Auto-generated from all feature plans. Last updated: 2026-01-15.
cursor
AIGC detection and rewriting assistant for academic papers. Analyzes text for AI-generated characteristics, provides detailed rewrite suggestions. Supports .docx files, outputs reports and rewritten documents. Bilingual: Chinese & English.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.