Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/evilfreelancer/zaezd/bdd-specsgit clone --depth 1 https://github.com/EvilFreelancer/zaezdWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01493 | $0.01493 |
| Opus 5 | $0.00746 | $0.00746 |
| Sonnet 5 | $0.00299 | $0.00299 |
| Haiku 4.5 | $0.00149 | $0.00149 |
Grade A, and why
bdd-specs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Executable Gherkin specifications
features/ holds the product contract. Every use case is written here in Gherkin
before the unit tests and before the implementation, and every scenario is
executable: npm run bdd runs them all.
Layout
features/
├── <use-case>.feature # Gherkin, business language
├── steps/<use-case>.steps.ts # thin translation layer, Given/When/Then
└── support/world.ts # per-scenario state, hooks, fixture loading
One .feature per use case, named after the user-visible outcome
(trip-from-topic.feature, stay-dates.feature, checkout-links.feature), not after a
module. Step definitions may be shared across features; put reusable steps in the file
whose feature owns them and import nothing between step files.
How a scenario is written
- Business language only. No HTTP verbs, no tool names, no function names, no CSS
selectors inside a
.feature. A step describes what a traveller or an agent observes. Bad:When I call search_multitransport with origin Москва. Good:When the trip is assembled from Москва. - Given sets up recorded world state, When performs exactly one action,
Then asserts one observable outcome. Chain with
Andrather than stuffing two actions into oneWhen. - Scenario Outline for rule tables. The date algorithm, the feasibility checks and the three package rules are naturally tabular and must be specified that way, so the spec itself becomes the readable statement of the algorithm.
- Honesty scenarios are first-class. Missing venue coordinates, a checkout link that is not a cart, an unparsed event price, a source that timed out: each is a specified behavior with its own scenario, not an edge case to be discovered later.
- Keep Gherkin keywords in English; the narrative inside a step may name Russian cities and events verbatim, because that is the real data.
Rules for step definitions
- Steps are thin: translate the sentence into a call into
src/, then assert. No business logic, no date arithmetic, no price arithmetic inside a step. - Scenario state lives on the World (
features/support/world.ts), never in module-level variables. Cucumber builds one World per scenario, which is what keeps scenarios isolated. - Assertions use
node:assert/strict. - Ambiguous or duplicate step definitions are a hard error (
strict: trueincucumber.mjs). Reuse an existing step instead of writing a near-copy. - Run
npm run bddafter adding a step to a feature; Cucumber prints a ready snippet for every undefined step (snippetInterface: 'async-await').
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 126 lines · 1,493 tokens per session scan A e649f3dc67ca
bdd-specs is a cursor rule published in the GitHub repository EvilFreelancer/zaezd (1 stars, last pushed 14d ago), licensed MIT. It adds 1,493 tokens to every session, about $0.0075 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
cursorrules
When the user asks about real estate listing, use real-estate-listing-mcp tools: estimatevaluation, generatelisting, findcomparablesales, calculatemortgage, analyzeneighborhood.
qa-agent
QA workflow for reviewing stories, designing tests, and reporting verified defects.
cursorrules
When the user asks about performance, use performance-ai-mcp tools: analyzewaterfalldata, suggestoptimizations, calculatecorewebvitals, imageoptimizationhints.
cursorrules
When the user asks about nist rmf, use nist-rmf-ai-mcp tools: assessriskprofile, mapaiimpact, generateriskcontrols, crosswalktoeuaiact, createriskreport.
cursorrules
When the user asks about robotics control, use robotics-control-mcp tools: listdevices, sendcommand, readsensor, setservo, rungcode.
cursorrules
When the user asks about social media, use social-media-ai-mcp tools: schedulepost, generatehashtags, analyzeengagement, plancontentcalendar, getaudienceinsights.