The project’s main instruction file for coding agents working with GEMVC, a server-independent PHP framework for REST APIs. It defines the project’s four-layer structure, naming rules, routing style, and required reading order.

Use it at the start of work on GEMVC services, especially when changing API endpoints, controllers, models, tables, views, routing, or framework integrations.

It gives agents the project’s local rules before they suggest architecture or code. This avoids importing patterns from unrelated frameworks and skipping required layers.

cursorrules — Cursor rule by gemvc

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/gemvc/gemvc/cursorrules

Clone the repo

git clone --depth 1 https://github.com/gemvc/gemvc

Made for: Cursor.

Per session 1,588 This file is loaded in full into every session.

When invoked 1,588 The same file — it is already loaded in full.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.01588	$0.01588
Opus 5	$0.00794	$0.00794
Sonnet 5	$0.00318	$0.00318
Haiku 4.5	$0.00159	$0.00159

Measured yesterday against content hash 62ea4f465ab0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cursorrules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Prefer `gemvc/helper` (TypeChecker, CryptHelper, …) and `gemvc/http-client` (outbound HTTP) — never invent Laravel validators or curl wrappers

.cursorrules · 115 lines

How it starts

The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GEMVC Framework - AI Assistant Context

Root AI front door (this file). Depth: docs/AGENTS.md · Claude: docs/CLAUDE.md · Antigravity: docs/GEMINI.md · map: llms.txt
Read first: docs/ai/INDEX.md → docs/ai/CANONICAL.md → docs/ai/CORE_REFERENCE.md
Packages: docs/guides/ecosystem.md — GEMVC is a multi-package ecosystem (vendor/gemvc/*). Core: gemvc/helper, gemvc/http-client (see docs/guides/helper.md, docs/guides/http-client.md).

GEMVC is NOT Laravel or Symfony. IT IS GEMVC (NOT MVC) 4 Layer Architect Server-agnostic PHP REST API (Apache / OpenSwoole / Nginx / FrankenPHP). Version 5.16.0.

4-Layer Pattern (strongly recommended)

API (app/api/) → Controller → Model (app/model/) → Table / ViewTable (app/table/)

Runtime allows bypassing a layer; do not for normal HTTP services. Flexibility is inside layers, not skipping them.

Naming: User.php, UserController.php, UserModel.php, UserTable.php.
Views: UserAccessTable extends ViewTable (defineView(), flat column aliases).
URL (Apache/Nginx/FrankenPHP): /api/{Service}/{method}. OpenSwoole: SERVICE_IN_URL_SECTION / METHOD_IN_URL_SECTION (no automatic api hop). No routes files. FrankenPHP path deny = Caddyfile (not .htaccess) — docs/guides/frankenphp.md.

_ properties ignored in CRUD (aggregations)
protected properties: still DB columns (still in SQL SELECT * hydration); hidden from typical list/API payloads / createList defaults — prefer explicit column lists
Property names = DB columns (or view SELECT aliases on ViewTable)

Hard Do / Don't

Extend ApiService (public) or ProtectedApiService (authenticated — all servers). Deprecated: SwooleApiService / ProtectedSwooleApiService
definePostSchema / defineGetSchema before using post/get data
callController() in API + createModel() in Controller (all servers)
requireInternalService() for family-only routes (GEMVC_INTERNAL_SECRET HMAC)
Sibling mesh: ServiceCall::to(...)->withInternalTrust() (GEMVC_SERVICES_JSON) — http-client.md
Prefer Protected* over manually forgetting $this->requireAuth() on CRUD services
requireAuth(['role']) still valid on public bases when you need a custom constructor flow
requireRateLimit() uses global REQUEST_RATE_LIMIT_DRIVER; overrides: requireRateLimitApcu|Redis|Both() (no auto-fallback)
Global rate limit: REQUEST_RATE_LIMIT_PER_SEC + DRIVER in .env — Bootstrap enforceFromEnv
Money: public string + $_type_map decimal + decimalValuePost(); concurrent: beginTransaction + forUpdate + BCMath on $this (not hydrated rows / not raw PDO)
Prefer gemvc/helper (TypeChecker, CryptHelper, …) and gemvc/http-client (outbound HTTP) — never invent Laravel validators or curl wrappers
Prefer createList + API findable/filterable/sortable for lists (not hand-rolled filter SQL)
SQL views: ViewTable + defineView() / viewDependsOn(); migrate with gemvc db:migrate or --all
Treat Schema::primary / autoIncrement as not migrate DDL today (PK from property id / setPrimaryKey)

Read the full file on GitHub · 115 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 115 lines · 1,588 tokens per session scan A 62ea4f465ab0

Subscribe to this mod's changes

cursorrules is a cursor rule published in the GitHub repository gemvc/gemvc (22 stars, last pushed 7d ago), licensed MIT. It adds 1,588 tokens to every session, about $0.0079 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Languages Writing and docs apache framework microservice nginx openswoole php

cursorrules

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Makes network callslowCapability

How it starts

GEMVC Framework - AI Assistant Context

4-Layer Pattern (strongly recommended)

Hard Do / Don't

What this file has done since we first saw it

Other cursor rules, from other repositories

git

css

javascript

local

docs

core