A rule for discovering the current contract before changing a RiskModels API client. An API client is code that calls a service through defined endpoints, parameters, and response formats.

Use it before adding or changing RiskModels HTTP wrappers, SDK methods, command-line commands, example scripts, or related MCP tools.

It reduces the risk of writing integration code from outdated assumptions by requiring current endpoint and provisioning details from the live tool surface or repository specifications.

cursorrules — Cursor rule by BlueWaterCorp

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/bluewatercorp/riskmodels_api/cursorrules

Clone the repo

git clone --depth 1 https://github.com/BlueWaterCorp/RiskModels_API

Made for: Cursor.

Per session 1,536 This file is loaded in full into every session.

When invoked 1,536 The same file — it is already loaded in full.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01536	$0.01536
Opus 5	$0.00768	$0.00768
Sonnet 5	$0.00307	$0.00307
Haiku 4.5	$0.00154	$0.00154

Measured yesterday against content hash bdf7f9842a47, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursorrules · 53 lines

How it starts

The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.

RiskModels SDK Expert Rules

Discovery Protocol (before any new API client or integration)

Before building or changing any API client (HTTP wrappers, SDK methods, CLI commands, example scripts, or MCP-aligned tools), discover the current contract and provisioning metadata from the live tool surface—not from memory:

MCP (preferred when the RiskModels MCP server is enabled in Cursor): Call riskmodels_list_endpoints first to load the latest endpoint index (ids, methods, paths, summaries, billing hints). For the endpoints you will implement, follow with riskmodels_get_capability (by capability id) and/or riskmodels_get_openapi_spec for detailed structural information about paths and query parameters.
Repo fallback (always valid): If MCP tools are unavailable in this session, read OPENAPI_SPEC.yaml and mcp/data/openapi.json (generated/synced from the same contract) before writing code.

Do not ship new client code based only on stale chat context or older snippets. For the full step-by-step workflow, follow the project skill RiskModels API discovery (.cursor/skills/riskmodels-api-discovery/SKILL.md).

Cursor channel: Dynamic MCP tool lists and capability updates are easiest to rely on when Cursor’s Nightly update channel is enabled (Settings → Beta → Update channel → Nightly). The agent cannot toggle this for you; enable it locally if you want on-demand capability refresh behavior.

When writing or editing Python code that calls the RiskModels API, prefer the riskmodels package in this repo at sdk/ (import name riskmodels, distribution riskmodels-py). Do not invent REST paths or wire JSON shapes from memory; align with OPENAPI_SPEC.yaml and SEMANTIC_ALIASES.md after running the Discovery Protocol above.

Canonical math and field names (ERM3)

Hedge ratios (HR) are dollars of ETF per $1 of stock (dollar_ratio). Hedge notional ≈ position_usd * hr.
Use semantic column names as returned by the SDK (e.g. l3_market_hr, l3_sector_hr, l3_subsector_hr), not raw V3 wire keys in user-facing tables (l3_mkt_hr is normalized away in DataFrames).
Explained risk (ER) values are variance fractions in [0, 1]. At L3, l3_market_er + l3_sector_er + l3_subsector_er + l3_residual_er ≈ 1.
Sign convention: any HR may be negative (orthogonalization / long ETF leg); most common negatives are often the market factor at L2 or L3 (l2_market_hr, l3_market_hr). Do not treat a negative sector or subsector HR as automatically wrong.
GET /metrics/{ticker} returns numbers under JSON metrics; the SDK flattens to semantic names. Do not read flat l1_market_hr at the top level of the raw JSON unless mirroring legacy examples.
POST /batch/analyze Parquet/CSV long table: wire columns l1, l2, l3 are the three rolling L3 component HR series (market, sector, subsector), not “L1 model / L2 model / L3 model” levels. The SDK renames them to l3_market_hr, l3_sector_hr, l3_subsector_hr.
Portfolio-level hedge ratios in the SDK are holdings-weighted means of per-ticker scalar HRs (same idea as zarr wmean_* in docs/ERM3_ZARR_API_PARITY.md). This is not a full portfolio optimization; it is explicit client-side aggregation.

Read the full file on GitHub · 53 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 53 lines · 1,536 tokens per session scan A bdf7f9842a47

Subscribe to this mod's changes

cursorrules is a cursor rule published in the GitHub repository BlueWaterCorp/RiskModels_API (0 stars, last pushed yesterday), licensed Apache-2.0. It adds 1,536 tokens to every session, about $0.0077 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Memory and context

cursorrules

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

RiskModels SDK Expert Rules

Discovery Protocol (before any new API client or integration)

Canonical math and field names (ERM3)

What this file has done since we first saw it

Other cursor rules, from other repositories

angular-20

dev-standard

typescript

coolify-ai-docs

python_lib

specs