Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/freshworks-developers/fw-dev-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/freshworks-developers/fw-dev-tools/app-building-blocking-gates)<a href="https://agentmods.dev/rules/freshworks-developers/fw-dev-tools/app-building-blocking-gates"><img src="https://agentmods.dev/badge/rules/freshworks-developers/fw-dev-tools/app-building-blocking-gates/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/freshworks-developers/fw-dev-tools/app-building-blocking-gates"><img src="https://agentmods.dev/badge/rules/freshworks-developers/fw-dev-tools/app-building-blocking-gates.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01972 | $0.01972 |
| Opus 5.5 | $0.00789 | $0.00789 |
| Sonnet 5.5 | $0.00394 | $0.00394 |
| Haiku 4.5 | $0.00197 | $0.00197 |
Grade A, and why
app-building-blocking-gates scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App Building Blocking Gates - STRICT ENFORCEMENT
CRITICAL: These gates are BLOCKING. App building and validation MUST NOT be considered complete until ALL gates pass.
If ANY gate fails → STOP → FIX → RE-VERIFY → Only then proceed.
Gate 0: PRE-GENERATION - Template Selection (BLOCKING)
BEFORE writing any code, you MUST:
- Determine app type: Frontend / Serverless / Hybrid — See app-templates.mdc (React Meta is default for UI)
- If manifest will declare ANY
location(ticket_sidebar, full_page_app, asset_sidebar, etc.):- React Meta (
metaConfig.framework: "react"): createapp/index.html,app/index.jsx,app/components/, icon per manifest,package.jsonwith DEW deps - Vanilla opt-in: create FULL frontend structure (app/, index.html, scripts/app.js, styles/style.css, styles/images/icon.svg)
- ❌ NEVER declare a location without creating ALL referenced files
- React Meta (
- If manifest will declare
url: "index.html":- ✅ app/index.html MUST exist before you finish
- ❌ NEVER write manifest with url pointing to a file you won't create
- If manifest will declare
icon: "styles/images/icon.svg":- ✅ app/styles/images/icon.svg MUST exist before you finish
- ❌ NEVER reference icon without creating it
VIOLATION = App will fail fdk validate. DO NOT generate incomplete apps.
Gate 1: Manifest–File Consistency (BLOCKING)
For EVERY location in manifest.json:
| Manifest declares | Required file/folder | BLOCKING |
|---|---|---|
"url": "index.html" |
app/index.html MUST exist |
✅ YES |
"url": "ticket_sidebar.html" |
app/ticket_sidebar.html MUST exist |
✅ YES |
"icon": "styles/images/icon.svg" |
app/styles/images/icon.svg MUST exist |
✅ YES |
Any location with url |
app/ folder MUST exist |
✅ YES |
Rule: Every url and icon in manifest MUST have a corresponding file on disk. No exceptions.
Verification (MANDATORY before fdk validate):
# For each location in manifest, verify file exists
# If url: "index.html" → test -f app/index.html
# If icon: "styles/images/icon.svg" → test -f app/styles/images/icon.svg
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 213 lines · 1,972 tokens per session scan A 7f58acc64c64
app-building-blocking-gates is a cursor rule published in the GitHub repository freshworks-developers/fw-dev-tools (5 stars, last pushed 29d ago), licensed MIT. It adds 1,972 tokens to every session, about $0.0079 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
battle-tested-engineer
Battle-tested engineering judgment for code, refactors, tests, and frontend UI. Ultra-terse caveman style during code work.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
prefer-assertions-over-defensive-checks
Prefer assertions over defensive checks when data is guaranteed to be valid.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.