Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/double-coding-lab/flow2spec/f2s-karpathy-guidelinesgit clone --depth 1 https://github.com/double-coding-lab/Flow2SpecWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00819 | $0.00819 |
| Opus 5 | $0.00409 | $0.00409 |
| Sonnet 5 | $0.00164 | $0.00164 |
| Haiku 4.5 | $0.00082 | $0.00082 |
Grade A, and why
f2s-karpathy-guidelines scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Karpathy 式编码行为准则
与项目内 Flow2Spec /
f2s-*规则并行；若某条与 f2s 强制步骤冲突，以 f2s 与项目约定为准。
用于减少常见「模型写代码」失误的行为约定。
取舍： 这些准则偏向稳妥而非一味求快；对明显琐碎的修改（如单行笔误）可自行把握，不必条条刻板执行。
1. 先想清楚再写代码
不要默认、不要藏困惑、把权衡摆到台面上。
动手实现前：
- 假设要说清楚；不确定就问，不要猜。
- 有多种理解时并列说明，不要悄悄选一种就跑。
- 若有更简单做法，主动提出；该反对时要反对。
- 说不清就停：点名哪里困惑，再向用户要信息。
2. 简单优先
用最少代码解决问题，不做臆测性扩展。
- 不要超出需求加功能。
- 不要为只用一次的代码抽抽象。
- 不要加未被要求的「灵活性」「可配置」。
- 不要为几乎不可能的场景堆错误处理。
- 若写了 200 行其实 50 行就够，重写。
自问：「资深工程师会不会觉得过度设计？」若是，就简化。
3. 手术式修改
只动该动的；只收拾自己弄乱的。
改已有代码时：
- 不要顺手「优化」相邻代码、注释或格式。
- 不要重构没坏的东西。
- 风格对齐现有代码，即使你个人偏好不同。
- 若发现与任务无关的死代码，可以提一嘴，不要擅自删。
若你的改动产生了孤儿引用/变量：
- 删掉因你这次改动而不再使用的 import、变量、函数。
- 不要在用户未要求时删除原本就存在的死代码。
检验标准：每一行改动都能追溯到用户的明确诉求。
4. 目标驱动执行
先定义成功标准，再循环直到可验证地达成。
把任务变成可验证目标，例如：
- 「加校验」→「先写非法入参测试，再改到通过」
- 「修 bug」→「先写能复现的测试，再改到通过」
- 「重构 X」→「前后测试套件均通过」
多步骤任务可写简短计划：
1. [步骤] → 验证：[检查方式]
2. [步骤] → 验证：[检查方式]
3. [步骤] → 验证：[检查方式]
成功标准越具体，越能独立迭代；含糊的「跑通就行」会逼出反复追问。
准则在起作用的信号： diff 里无关改动变少、因过度设计返工变少、澄清问题出现在实现之前而不是做错之后。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 78 lines · 819 tokens per session scan A f9956c1534fa
f2s-karpathy-guidelines is a cursor rule published in the GitHub repository double-coding-lab/Flow2Spec (47 stars, last pushed 4d ago), licensed MIT. It adds 819 tokens to every session, about $0.0041 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.