agentmods.dev

mcp-debug: Cursor rule for Windsurf

.windsurfrules

windsurfrules is a cursor rule for Windsurf from giantswarm/mcp-debug. It costs 5,515 tokens per session, scanned A, original, Apache-2.0.

Below you will find a variety of important rules spanning.

Cursor rule for Windsurf

Written for Windsurf: a Windsurf rule.

This is giantswarm/mcp-debug's own configuration. It tells Windsurf how to work on mcp-debug itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything mcp-debug configures →

not rated 37repo yesterday A scan 5,515 tokens Apache-2.0
View source ↗ giantswarm/mcp-debug
Reuse

Borrowing it

Nothing to install: this file belongs to giantswarm/mcp-debug. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/giantswarm/mcp-debug/main/.windsurfrules
Clone the repo
git clone --depth 1 https://github.com/giantswarm/mcp-debug

Made for: Windsurf.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for windsurfrules

README.md
[![agentmods](https://agentmods.dev/badge/rules/giantswarm/mcp-debug/windsurfrules.svg)](https://agentmods.dev/rules/giantswarm/mcp-debug/windsurfrules)
Your own site
<a href="https://agentmods.dev/rules/giantswarm/mcp-debug/windsurfrules"><img src="https://agentmods.dev/badge/rules/giantswarm/mcp-debug/windsurfrules.svg" alt="Measured on agentmods" height="20"></a>
Per session 5,515 This file is loaded in full into every session.
When invoked 5,515 The same file — it is already loaded in full.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.05515 $0.05515
Opus 5 $0.02757 $0.02757
Sonnet 5 $0.01103 $0.01103
Haiku 4.5 $0.00551 $0.00551

Measured today against content hash 2bf255ead2ab, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

windsurfrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.windsurfrules · 475 lines

How it starts

The opening of the file, as written. The whole thing — 475 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Below you will find a variety of important rules spanning:

  • the dev_workflow
  • the .windsurfrules document self-improvement workflow
  • the template to follow when modifying or adding new sections/rules to this document.

DEV_WORKFLOW

description: Guide for using meta-development script (scripts/dev.js) to manage task-driven development workflows globs: */ filesToApplyRule: */ alwaysApply: true

  • Global CLI Commands

    • Task Master now provides a global CLI through the task-master command
    • All functionality from scripts/dev.js is available through this interface
    • Install globally with npm install -g claude-task-master or use locally via npx
    • Use task-master <command> instead of node scripts/dev.js <command>
    • Examples:
      • task-master list instead of node scripts/dev.js list
      • task-master next instead of node scripts/dev.js next
      • task-master expand --id=3 instead of node scripts/dev.js expand --id=3
    • All commands accept the same options as their script equivalents
    • The CLI provides additional commands like task-master init for project setup

  • Development Workflow Process

    • Start new projects by running task-master init or node scripts/dev.js parse-prd --input=<prd-file.txt> to generate initial tasks.json
    • Begin coding sessions with task-master list to see current tasks, status, and IDs
    • Analyze task complexity with task-master analyze-complexity --research before breaking down tasks
    • Select tasks based on dependencies (all marked 'done'), priority level, and ID order
    • Clarify tasks by checking task files in tasks/ directory or asking for user input
    • View specific task details using task-master show <id> to understand implementation requirements
    • Break down complex tasks using task-master expand --id=<id> with appropriate flags
    • Clear existing subtasks if needed using task-master clear-subtasks --id=<id> before regenerating
    • Implement code following task details, dependencies, and project standards
    • Verify tasks according to test strategies before marking as complete
    • Mark completed tasks with task-master set-status --id=<id> --status=done
    • Update dependent tasks when implementation differs from original plan
    • Generate task files with task-master generate after updating tasks.json
    • Maintain valid dependency structure with task-master fix-dependencies when needed
    • Respect dependency chains and task priorities when selecting work
    • Report progress regularly using the list command

  • Task Complexity Analysis

    • Run node scripts/dev.js analyze-complexity --research for comprehensive analysis
    • Review complexity report in scripts/task-complexity-report.json
    • Or use node scripts/dev.js complexity-report for a formatted, readable version of the report
    • Focus on tasks with highest complexity scores (8-10) for detailed breakdown
    • Use analysis results to determine appropriate subtask allocation
    • Note that reports are automatically used by the expand command

  • Task Breakdown Process

    • For tasks with complexity analysis, use node scripts/dev.js expand --id=<id>
    • Otherwise use node scripts/dev.js expand --id=<id> --subtasks=<number>
    • Add --research flag to leverage Perplexity AI for research-backed expansion
    • Use --prompt="<context>" to provide additional context when needed
    • Review and adjust generated subtasks as necessary
    • Use --all flag to expand multiple pending tasks at once
    • If subtasks need regeneration, clear them first with clear-subtasks command

  • Implementation Drift Handling

    • When implementation differs significantly from planned approach
    • When future tasks need modification due to current implementation choices
    • When new dependencies or requirements emerge
    • Call node scripts/dev.js update --from=<futureTaskId> --prompt="<explanation>" to update tasks.json

  • Task Status Management

    • Use 'pending' for tasks ready to be worked on
    • Use 'done' for completed and verified tasks
    • Use 'deferred' for postponed tasks
    • Add custom status values as needed for project-specific workflows

Read the full file on GitHub · 475 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 475 lines · 5,515 tokens per session scan A 2bf255ead2ab

Subscribe to this mod's changes

windsurfrules is a cursor rule published in the GitHub repository giantswarm/mcp-debug (37 stars, last pushed yesterday), licensed Apache-2.0. It adds 5,515 tokens to every session, about $0.0276 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.

model-context-protocol
Related

Other cursor rules, from other repositories

swift-development

Swift development: SwiftUI, Combine, async/await, iOS patterns, and Apple platform conventions.

madebyaris/rakitui-ai · 0 tokens

lighter-safety

Safety contract for the Lighter MCP server. Apply whenever a lighter tool is invoked.

iamgoatedaf/lighter-mcp · 18 tokens

nix-security

Nix Security and Sandboxing.

ghuntley/groundhog · 489 tokens

memory-bank

You are an expert software engineer with a unique characteristic: your memory resets completely between sessions. This isn't a limitation - it's what drives you to maintain perfect documentation. At the beginning of each dialogue, you rely ENTIRELY on your Memory Bank to understand the project and continue work…

alexeyleshchenko/fast-mcp-telegram · 1,623 tokens

terminal-commands

Guidelines for generating terminal commands that ensure outputs are readable by Cursor agents.

brettdavies/cursor-template · 1,291 tokens

ponytail

Ponytail, lazy senior dev mode. Always pick the simplest solution that works.

DietrichGebert/ponytail · 576 tokens