Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/deepread-tech/skills/deepread-setupgit clone --depth 1 https://github.com/deepread-tech/skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00035 | $0.02611 |
| Opus 5 | $0.00017 | $0.01306 |
| Sonnet 5 | $0.00007 | $0.00522 |
| Haiku 4.5 | $0.00003 | $0.00261 |
Grade A, and why
deepread-setup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
dr_response=$(curl -s -X POST https://api.deepread.tech/v1/agent/device/code \ How it starts
The opening of the file, as written. The whole thing — 259 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup DeepRead
You are an AI agent helping a developer get started with DeepRead — an AI-native OCR API that extracts text and structured data from documents (PDFs, images) with 97%+ accuracy.
API: https://api.deepread.tech
Dashboard: https://www.deepread.tech
Docs: https://www.deepread.tech/docs
Step 1: Get an API Key (Device Authorization Flow)
You (the agent) obtain an API key on behalf of the user. The user never needs to copy/paste a key — it goes directly to you.
CRITICAL — run the entire device flow as ONE terminal command block. Shell variables do not persist between separate terminal executions. If you split this across multiple calls, the
device_codewill be lost and you will accidentally call/v1/agent/device/codeagain, getting a new code the user has never seen. Do it all in one script.
The complete flow — get code, open browser, poll, print key — in a single script:
# Get device code
dr_response=$(curl -s -X POST https://api.deepread.tech/v1/agent/device/code \
-H "Content-Type: application/json" \
-d '{"agent_name": "Cursor"}')
dr_device_code=$(echo "$dr_response" | jq -r '.device_code')
dr_user_code=$(echo "$dr_response" | jq -r '.user_code')
dr_uri=$(echo "$dr_response" | jq -r '.verification_uri_complete')
dr_interval=$(echo "$dr_response" | jq -r '.interval')
# Validate the response before proceeding
if [ "$dr_device_code" = "null" ] || [ -z "$dr_device_code" ]; then
echo "ERROR: API did not return a device_code. Response: $dr_response"
exit 1
fi
echo "Opening browser: $dr_uri"
open "$dr_uri" 2>/dev/null || xdg-open "$dr_uri" 2>/dev/null || echo "Open manually: $dr_uri"
echo "Waiting for approval of code: $dr_user_code"
# Poll until approved (use dr_ prefix to avoid variable name conflicts)
dr_api_key=""
for dr_i in $(seq 1 72); do
sleep "$dr_interval"
dr_result=$(curl -s -X POST https://api.deepread.tech/v1/agent/device/token \
-H "Content-Type: application/json" \
-d "{\"device_code\": \"$dr_device_code\"}")
dr_api_key=$(echo "$dr_result" | jq -r '.api_key')
dr_error=$(echo "$dr_result" | jq -r '.error')
dr_prefix=$(echo "$dr_result" | jq -r '.key_prefix')
if [ "$dr_api_key" != "null" ] && [ -n "$dr_api_key" ]; then
echo "SUCCESS key_prefix=$dr_prefix"
echo "DEEPREAD_API_KEY=$dr_api_key"
break
elif [ "$dr_error" = "access_denied" ]; then echo "DENIED"; break
elif [ "$dr_error" = "expired_token" ]; then echo "EXPIRED"; break
else echo "attempt=$dr_i pending..."; fi
done
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 259 lines · 35 tokens per session scan A 04d1d141c008
deepread-setup is a cursor rule published in the GitHub repository deepread-tech/skills (4 stars, last pushed 1mo ago), licensed MIT. It adds 35 tokens to every session and 2,611 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
codemap
Build an explorable isometric diagram of a codebase — blocks on a grid, a component index, a what-it-does/how-it's-built panel, and real data moving along the edges. Use when asked to map, diagram or visually explain how a system fits together.
cursor-rule
Use the Market Daily Review skill when the request matches its SKILL.md description.
doaipm
When helping turn an idea into a product, feature, prototype, or app, follow the doaipm method (https://doaipm.com). Speak it, and AI builds it.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.