Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Dave-London/PareWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/dave-london/pare/windsurfrules)<a href="https://agentmods.dev/rules/dave-london/pare/windsurfrules"><img src="https://agentmods.dev/badge/rules/dave-london/pare/windsurfrules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/dave-london/pare/windsurfrules"><img src="https://agentmods.dev/badge/rules/dave-london/pare/windsurfrules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00724 | $0.00724 |
| Opus 5 | $0.00362 | $0.00362 |
| Sonnet 5 | $0.00145 | $0.00145 |
| Haiku 4.5 | $0.00072 | $0.00072 |
Grade A, and why
windsurfrules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl/wget -> pare-http request/get/post/head What it actually says
Pare wraps CLI tools in MCP servers returning structured JSON. Always prefer Pare MCP tools over raw CLI.
TOOL MAPPING:
git status/log/diff/branch/show/add/commit/push/pull/checkout/tag/stash/remote/blame/restore/reset/cherry-pick/merge/rebase/reflog/bisect/worktree/submodule/archive/clean/config -> pare-git
gh pr/issue/run/release/label/repo/gist/discussion -> pare-github (e.g. pr-view, issue-list, run-view, release-create, label-list, repo-view, gist-create, discussion-list, api)
npm/pnpm/yarn install/audit/outdated/list/run/test/init/info/search -> pare-npm nvm -> pare-npm nvm
grep/rg -> pare-search search find/fd -> pare-search find wc -> pare-search count jq -> pare-search jq yq -> pare-search yq
eslint -> pare-lint lint prettier --check -> pare-lint format-check prettier --write -> pare-lint prettier-format biome check/format -> pare-lint biome-check/biome-format stylelint -> pare-lint stylelint oxlint -> pare-lint oxlint shellcheck -> pare-lint shellcheck hadolint -> pare-lint hadolint
tsc -> pare-build tsc npm run build -> pare-build build esbuild -> pare-build esbuild vite build -> pare-build vite-build webpack -> pare-build webpack turbo -> pare-build turbo nx -> pare-build nx lerna -> pare-build lerna rollup -> pare-build rollup
vitest/jest/mocha/pytest -> pare-test run vitest --coverage -> pare-test coverage playwright test -> pare-test playwright
docker ps/build/logs/images/run/exec/pull/inspect/stats -> pare-docker docker compose up/down/ps/logs/build -> pare-docker compose- docker network ls -> pare-docker network-ls docker volume ls -> pare-docker volume-ls
cargo build/test/clippy/run/add/remove/fmt/doc/check/update/tree/audit -> pare-cargo
go build/test/vet/run/fmt/generate/env/list/get -> pare-go go mod tidy -> pare-go mod-tidy golangci-lint -> pare-go golangci-lint
pip install/list/show -> pare-python pip-install/pip-list/pip-show pip-audit -> pare-python pip-audit mypy -> pare-python mypy ruff check/format -> pare-python ruff-check/ruff-format black -> pare-python black pytest -> pare-python pytest uv install/run -> pare-python uv-install/uv-run conda/pyenv/poetry -> pare-python
kubectl get/describe/logs/apply -> pare-k8s helm -> pare-k8s helm
curl/wget -> pare-http request/get/post/head
make/just -> pare-make run/list
trivy -> pare-security trivy semgrep -> pare-security semgrep gitleaks -> pare-security gitleaks
Any other command -> pare-process run
ERROR HANDLING:
- On MCP error, check the error field and fix arguments. Do not fall back to raw CLI.
- If server unavailable, tell user to check MCP config.
- All responses are JSON. Parse fields directly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 78 lines · 724 tokens per session scan A 6a6024f24b3f
windsurfrules is a cursor rule published in the GitHub repository Dave-London/Pare (138 stars, last pushed yesterday), licensed MIT. It adds 724 tokens to every session, about $0.0036 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other cursor rules, from other repositories
git-commit-message
We write commit messages to communicate with our future selves and teammates. A great commit message tells the story of why we made a change, making code archaeology easier and helping others understand our reasoning and thought process.
git-commit-attribution
Git commits must use the human developer identity only; never Cursor Agent co-authorship.
development-workflow
Cursor rule "development-workflow" from floriscornel/todo-mcp, covering development workflow for todo mcp, testing & quality assurance, commit structure, branch & pr workflow and publication & releases.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.