Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bestcarly/opc-coding-guideWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/bestcarly/opc-coding-guide/mcp)<a href="https://agentmods.dev/rules/bestcarly/opc-coding-guide/mcp"><img src="https://agentmods.dev/badge/rules/bestcarly/opc-coding-guide/mcp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/bestcarly/opc-coding-guide/mcp"><img src="https://agentmods.dev/badge/rules/bestcarly/opc-coding-guide/mcp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01663 | $0.01663 |
| Opus 5.5 | $0.00665 | $0.00665 |
| Sonnet 5.5 | $0.00333 | $0.00333 |
| Haiku 4.5 | $0.00166 | $0.00166 |
Grade B, and why
mcp scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
cat mcp.json | jq '.mcpServers[].permissions' How it starts
The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP 配置规则(2026 年版)
补充人:墨铃 (Mori)
补充日期:2026-02-28
参考章节:第十二章
MCP 服务器配置原则
- 使用最新版 MCP 服务器(协议版本 2025-11)
- 配置最小权限原则
- 启用审计日志
- 定期更新服务器版本
基础配置结构
{
"$schema": "https://modelcontextprotocol.io/schema/mcp-config.json",
"version": "2025-11",
"mcpServers": {
"[server-name]": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-[name]@latest"],
"cwd": "${workspaceFolder}",
"env": {},
"permissions": {},
"disabled": false
}
}
}
Filesystem MCP 配置
{
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem@latest"],
"cwd": "${workspaceFolder}",
"permissions": {
"read": ["./src", "./docs", "./tests"],
"write": ["./src"],
"deny": ["./.env", "./config/secrets", "./node_modules"]
}
}
}
权限说明:
read:允许读取的目录write:允许写入的目录deny:禁止访问的目录(优先级最高)
Memory Bank MCP 配置
{
"memory-bank": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-memory-bank@latest"],
"cwd": "${workspaceFolder}",
"config": {
"autoUpdate": true,
"backupEnabled": true,
"backupInterval": "24h",
"backupLocation": "./.backups/memory-bank",
"files": {
"product-requirements.md": { "autoUpdate": true },
"architecture.md": { "autoUpdate": true },
"progress.md": { "autoUpdate": true },
"decisions.md": { "autoUpdate": true },
"learnings.md": { "autoUpdate": true }
}
}
}
}
配置说明:
autoUpdate:AI 完成任务后自动更新 Memory BankbackupEnabled:启用自动备份backupInterval:备份间隔(支持h、d、w)
GitHub MCP 配置
{
"github": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github@latest"],
"env": {
"GITHUB_TOKEN": "${GITHUB_TOKEN}"
},
"permissions": {
"repos": ["read"],
"pullRequests": ["read", "write"],
"issues": ["read", "write"],
"actions": ["read"]
}
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 291 lines · 1,663 tokens per session scan B 11ed8a674a06
mcp is a cursor rule published in the GitHub repository bestcarly/opc-coding-guide (7 stars, last pushed 7mo ago), licensed MIT. It adds 1,663 tokens to every session, about $0.0067 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.