Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/bsmi021/mcp-server-webscannpx agentmods add rules/bsmi021/mcp-server-webscan/main-ruleWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/bsmi021/mcp-server-webscan/main-rule)<a href="https://agentmods.dev/rules/bsmi021/mcp-server-webscan/main-rule"><img src="https://agentmods.dev/badge/rules/bsmi021/mcp-server-webscan/main-rule/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/bsmi021/mcp-server-webscan/main-rule"><img src="https://agentmods.dev/badge/rules/bsmi021/mcp-server-webscan/main-rule.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03154 | $0.03154 |
| Opus 5.5 | $0.01262 | $0.01262 |
| Sonnet 5.5 | $0.00631 | $0.00631 |
| Haiku 4.5 | $0.00315 | $0.00315 |
Grade A, and why
main-rule scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 469 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Server Development Guidelines
project name: mcp-server-webscan
memory_bank ProjectID: de83ede7-85de-4746-86c7-c2dafefc3fb7
Description:
A Model Context Protocol (MCP) server for web content scanning and analysis. This server provides tools for fetching, analyzing, and extracting information from web pages.
IMPERATIVE
- All projects must contain a PRD, Features spec, and RFCs
- All projects must have a memory - bank
Project Structure
- Follow the standard MCP server directory structure:
src/
├── config/
│ └── ConfigurationManager.ts
├── services/
│ ├── YourService.ts
│ └── index.ts
├── tools/
│ ├── yourTool.ts
│ ├── yourToolParams.ts
│ └── index.ts
├── types/
│ ├── yourServiceTypes.ts
│ └── index.ts
├── utils/
│ ├── logger.ts
│ ├── errors.ts
│ └── index.ts
├── initialize.ts
└── server.ts
TypeScript Standards
- Use ES Modules format with `.js` extensions in imports:
// Correct:
import { YourService } from '../services/YourService.js';
// Incorrect:
import { YourService } from '../services/YourService';
- Enforce strict TypeScript typing(see tsconfig.json)
- Prefer interfaces over types for object definitions:
```typescript
// Preferred: interface UserData { id: string; name: string; }
// Avoid for object shapes: type UserData = { id: string; name: string; };
*****IMPORTANT DON'T FORGET**** - Use functional programming patterns over class-based patterns where possible
- Avoid enums; use string literal unions or constant maps:
```typescript
// Preferred:
type Status = 'pending' | 'processing' | 'complete' | 'error';
// Or:
const STATUS = {
PENDING: 'pending',
PROCESSING: 'processing',
COMPLETE: 'complete',
ERROR: 'error'
} as const;
type Status = typeof STATUS[keyof typeof STATUS];
// Avoid:
enum Status {
PENDING = 'pending',
PROCESSING = 'processing',
COMPLETE = 'complete',
ERROR = 'error'
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 469 lines · 3,154 tokens per session scan A f2053a32083b
main-rule is a cursor rule published in the GitHub repository bsmi021/mcp-server-webscan (13 stars, last pushed 1y ago), licensed MIT. It adds 3,154 tokens to every session, about $0.0126 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
php-types-validation
Guidelines for type definitions and validation in PHP MCP SDK.
php-client-implementation
Guidelines for implementing MCP clients in PHP.
php-server-implementation
Guidelines for implementing MCP servers in PHP.
php-mcp-sdk-main
This is the PHP implementation of the Model Context Protocol (MCP) SDK, following the patterns established by the TypeScript SDK.
website-analysis
description: This rule provides a step by step guide to analyze a website and its code, in order to write a better Scrapy scraper. globs: /.py.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.