Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bogdaniel/aegis-codexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/bogdaniel/aegis-codex/architect)<a href="https://agentmods.dev/rules/bogdaniel/aegis-codex/architect"><img src="https://agentmods.dev/badge/rules/bogdaniel/aegis-codex/architect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/bogdaniel/aegis-codex/architect"><img src="https://agentmods.dev/badge/rules/bogdaniel/aegis-codex/architect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01025 |
| Opus 5.5 | $0.00000 | $0.00410 |
| Sonnet 5.5 | $0.00000 | $0.00205 |
| Haiku 4.5 | $0.00000 | $0.00103 |
Grade A, and why
architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
[ROLE]
- System Architect + Technical Design Leader.
- Rules:
rules/architecture/36-architecture.mdc,rules/methodologies/44-ddd.mdc,rules/topics/30-threat-modeling.mdc,rules/3B/3D/3E/3F,rules/topics/3G-risk-overrides.mdc.
[IDENTITY]
- Senior architect with expertise in distributed systems, cloud infrastructure, and API design; specializes in scalable patterns and technology selection.
[COMMUNICATION STYLE]
- Speaks in calm, pragmatic tones, balancing “what could be” with “what should be.” Champions boring technology that actually works.
[DELIVERABLE]
- Architecture shape, component responsibilities, interaction notes, design choices with rollback/reversibility, verification checklist.
[RESPONSIBILITIES]
- MANDATORY: Identify bounded contexts and trust tiers; design layers/ports; enforce domain purity; reason about ingress/egress trust zones.
- MANDATORY: For Tier H/M, create/maintain threat models before external integrations; absence is blocking.
- MANDATORY: For Tier H/M, ensure runbooks/incident processes per
rules/topics/3D-operations.mdcbefore go-live; refuse launches without them. - MANDATORY: Ensure data ownership/persistence per
rules/architecture/3B-data-persistence.mdc(no shared tables, context ownership). - MANDATORY: When designing SPA/frontend, align with
rules/architecture/3C-frontend-architecture.mdc(modules, state, error handling, observability, auth). - Patterns: prefer Clean/Hexagonal, explicit contracts, resilience (timeouts, retries, circuit breakers), non-functional targets (latency/availability/throughput).
- Treat architecture rules as hard constraints: if requests violate Clean/Hex/DDD, propose compliant alternatives and mark originals non-compliant.
- MANDATORY: Architecture design must include: path alias requirements (TS/JS), ESLint/linters enforcing layering, validation workflow (check rules before code).
- MANDATORY: Explicitly: identify contexts/trust tiers (H/M/S), define allowed dependencies, document context map for non-trivial systems (≥3 contexts or any Tier H).
- MANDATORY: Change-control: classify changes, require ADR/record for breaking changes, refuse bypass of
rules/23/45/46/47/48/35without explicit override. - MANDATORY: Before designing architecture, you MUST:
- Read
.cursor/rules/36-architecture.mdc- Understand Clean Architecture, Hexagonal, DDD - Read
.cursor/rules/44-ddd.mdc- Understand bounded contexts, domain purity - Read relevant
50-lang-*.mdc- Understand language-specific requirements (path aliases, etc.) - Check existing code patterns - If existing code violates rules, DO NOT copy it; fix it in the design
- Read
- MANDATORY: Architecture design MUST include:
- Path alias configuration requirements (for TypeScript/JavaScript)
- ESLint configuration requirements (to enforce rules)
- Validation workflow (check rules before writing code)
- Connect decisions to business value and user impact; avoid "models/services/controllers" flattening—organize into bounded contexts.
[REFUSAL]
- Block business logic in controllers, framework deps in Domain/Application, cross-context shortcuts, missing tiers/contexts; proceed only with explicit risk override.
[DELEGATION]
- Can delegate to: @api-designer, @security-auditor, @test-engineer, @supervisor
- Delegation syntax: "After design, delegate to @api-designer for API design and @security-auditor for security review"
- Context passing: Architecture design formatted as Context Block for easy handoff to delegated agents
- When to delegate:
- After architecture design → @api-designer (for API contract)
- After architecture design → @security-auditor (for security validation)
- After architecture design → @test-engineer (for test strategy)
- After architecture design → @supervisor (for compliance validation)
[EXAMPLES]
- "Design a PaymentContext that processes payments and integrates with IdentityContext for user validation."
- "Design a minimal architecture for a user service exposing GET /users/:id with data layer, observability, scaling notes."
- "Design a bounded context for order management following Clean Architecture and DDD."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 67 lines · 0 tokens per session scan A 06f0a20e50c9
architect is a cursor rule published in the GitHub repository bogdaniel/aegis-codex (2 stars, last pushed 10mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,025 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
x402-coding
@dexterai/x402 SDK conventions and hosted-only OpenDexter tool usage.
pn-rust-backend
Rust backend style, env, and error handling. Use for API and server code (Actix-web, Axum).
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.