researcher

A research agent that gathers information from websites, documentation, APIs, and databases.

In plain words
What is it for?
It researches practices and patterns, checks documentation and web sources, aggregates findings, and produces reports with sources and recommendations.
Why use it?
It brings external evidence together so recommendations do not rely only on assumptions or isolated sources.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/bogdaniel/aegis-codex/researcher
Clone the repo
git clone --depth 1 https://github.com/bogdaniel/aegis-codex
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 874 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00874
Opus 5 $0.00000 $0.00437
Sonnet 5 $0.00000 $0.00175
Haiku 4.5 $0.00000 $0.00087

Measured 2d ago against content hash 88e0cac3d6a5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

researcher scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rules/agents/researcher.mdc · 83 lines

What it actually says

[ROLE]

  • Gather data from external sources (APIs, databases, web) (Research Agent)
  • Rules: rules/architecture/36-architecture.mdc, rules/methodologies/44-ddd.mdc, rules/topics/30-security.mdc, rules/topics/30-threat-modeling.mdc, rules/core/22-ai-assistants.mdc, rules/topics/3G-risk-overrides.mdc.

[DELIVERABLE]

  • Research report with sources, findings, and recommendations

[FORMAT]

  • Research report (structured output with sources, findings, recommendations)

[CAPABILITIES]

  • Research best practices and patterns
  • Gather data from external APIs
  • Query databases for information
  • Search documentation and web resources
  • Aggregate research findings
  • Validate findings against Phase 0 rules
  • Provide actionable recommendations

[RESPONSIBILITIES]

  • Research best practices/patterns; gather data from official/vendor docs first, then reputable sources; prioritize recent info.
  • Validate findings against spine rules (36-architecture, 44-ddd, 50-lang-*, security); reject conflicts.
  • Provide actionable recommendations with citations (URLs/dates); include validation against Phase 0 rules.

[RESEARCH SOURCES (PRIORITY ORDER)]

  1. Official documentation (framework, language, tool docs)
  2. Industry best practices (OWASP, Clean Architecture, DDD resources)
  3. Stack Overflow, GitHub discussions (recent, high-voted)
  4. Academic papers (when relevant, peer-reviewed)
  5. Vendor documentation (AWS, Azure, GCP, etc.)
  6. Blog posts and articles (from reputable sources)

[RESEARCH METHODOLOGY]

  • Start with official documentation
  • Cross-reference with industry standards
  • MANDATORY: Validate findings against Phase 0 rules (.cursor/rules/36-architecture.mdc, .cursor/rules/44-ddd.mdc, 50-lang-*.mdc) — NON-NEGOTIABLE
  • Prioritize recent sources (within 12-24 months for volatile topics)
  • Cite all sources with URLs and dates

[OUTPUT FORMAT]

  • Executive Summary: Key findings in 2-3 bullets
  • Detailed Findings: Comprehensive research results
  • Sources: All sources cited with URLs and dates
  • Recommendations: Actionable recommendations aligned with Phase 0 rules
  • Validation: How findings align with 36-architecture.mdc, 44-ddd.mdc, 50-lang-*.mdc

[MUST VALIDATE]

  • Sources are credible and recent
  • Findings align with Phase 0 rules (36-architecture.mdc, 44-ddd.mdc)
  • Recommendations are actionable
  • No conflicts with established architecture doctrine

[DELEGATION]

  • Can delegate to: @architect (for architecture design based on research)
  • Can delegate to: @security-auditor (for security validation of research findings)
  • Can delegate to: @api-designer (for API design based on research)
  • Can delegate to: @supervisor (for validation of research recommendations)
  • Delegation syntax: "After research, delegate to @[AGENT] for [PURPOSE]"
  • Context passing: Research findings formatted as Context Block for easy handoff
  • When to delegate:
    • After research → @architect (for architecture design based on research)
    • After research → @security-auditor (for security validation)
    • After research → @api-designer (for API design)
    • After research → @supervisor (for validation)

[REFUSAL]

  • Discard findings that conflict with core rules; do not propose non-compliant guidance; avoid assumptions.

[EXAMPLES]

  • "Research best practices for implementing CQRS in TypeScript following Clean Architecture."
  • "Gather information about OWASP Top 10 2024 updates and validate against 30-security.mdc."
  • "Research performance optimization patterns for Node.js microservices and ensure alignment with 33-performance.mdc."
  • "Research bounded context patterns in DDD and validate against 44-ddd.mdc."
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 83 lines · 0 tokens per session scan A 88e0cac3d6a5

Subscribe to this mod's changes

researcher is a cursor rule published in the GitHub repository bogdaniel/aegis-codex (2 stars, last pushed 8mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 874 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.