Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/EvilFreelancer/zaezdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/evilfreelancer/zaezd/web-ui)<a href="https://agentmods.dev/rules/evilfreelancer/zaezd/web-ui"><img src="https://agentmods.dev/badge/rules/evilfreelancer/zaezd/web-ui/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/evilfreelancer/zaezd/web-ui"><img src="https://agentmods.dev/badge/rules/evilfreelancer/zaezd/web-ui.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01450 |
| Opus 5.5 | $0.00000 | $0.00580 |
| Sonnet 5.5 | $0.00000 | $0.00290 |
| Haiku 4.5 | $0.00000 | $0.00145 |
Grade A, and why
web-ui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web UI: the trip board
UX is worth 20 points, more than any other criterion, and this is the only screen. The same
skeleton and the same client renderer also ship as the ui://zaezd/trip-board resource, so
one renderer serves both channels. Only the data path differs: the web page reads the
TripResult the server embedded, the MCP App receives it through
ui/notifications/tool-result. Recompute differs too - a form on our own origin in the web,
tools/call through the host in the App. Nothing else may fork.
No arithmetic in the browser. The TripResult arrives computed; the renderer lays out
numbers it was given. A noscript block carries a text summary of the trip.
Full specification in specs/05-interfeys.md.
The first thirty seconds
The public link opens on an already computed trip, never on an empty form. The input row sits on top, pre-filled. Chat, if it exists at all, is a side panel and never the main way to work.
Layout and card
Header answers "where and why", cards answer "how and how much", the map answers "where exactly", the timeline answers "do I make it".
A package card carries exactly six things: the selection rule name, the total participation price as one number, the outbound leg with transport type, number and buffer to the opening, the hotel with its name, whole-stay price and walking time to the venue, the return leg, and a budget bar broken into transport, stay and event with any overflow visible. Under the bar, one line of arithmetic that adds up:
поезд 2 090 ₽ + отель 12 800 ₽ + обратно 2 090 ₽ = 16 980 ₽, остаток 13 020 ₽
A variant flagged "arrives after the opening" renders grey and cannot be selected as the primary package.
Honesty in the interface
- Prices are rendered exactly as they appear in the payload, without rounding.
- A field the source did not return is shown as missing, never inferred.
- A venue that was not geocoded precisely gets no marker at all; the map centres on the city and a caption says the catalogue did not provide an address.
- Button labels come from the actual checkout
kind(@mcp-layer.mdc), so "Открыть поиск, корзины не будет" is a label that really ships. - Catalogue coverage is stated plainly: live offline events exist in five or six cities, and empty cities are not hidden.
- Resolved geography is named back from
meta.resolved_geo, including a homonym note whenalso_named[]is present. Reviews are quoted verbatim with their date or not at all.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 118 lines · 0 tokens per session scan A 008bca97f4e6
web-ui is a cursor rule published in the GitHub repository EvilFreelancer/zaezd (1 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,450 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
savee
Use the Savee MCP tools when the task involves design inspiration, visual references, moodboards, or the user's own saved work.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
config-validation-and-normalization
Config validation and normalization responsibilities (defineConfig normalizes, the orm section schema validates and resolves paths, the loader reports per-section diagnostics).