windsurf-rules

windsurf-rules is a cursor rule for Windsurf from guiguito/AppStoresMCP. It costs 0 tokens per session (2,084 once invoked), scanned A, original, MIT.

A project rulebook for building an MCP server in TypeScript and Node.js that collects data from Google Play and Apple App Store listings. MCP is a standard way for tools to provide data to AI agents.

In plain words
What is it for?
Use it when adding or changing MCP tools, defining their inputs, configuring the server, or maintaining its TypeScript code.
Why use it?
It gives contributors one agreed pattern for strict type checking, input validation, and server setup instead of letting each tool follow different conventions.

Cursor rule for Windsurf

Written for Windsurf: installed under .windsurf/.

Good fit Use it when adding or changing MCP tools, defining their inputs, configuring the server, or maintaining its TypeScript code.

Compare 6 cursor rules from other repositories ↓
Install with agentmods
npx agentmods add rules/guiguito/appstoresmcp/windsurf-rules
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/guiguito/AppStoresMCP

Made for: Windsurf.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for windsurf-rules

README.md
[![agentmods](https://agentmods.dev/badge/rules/guiguito/appstoresmcp/windsurf-rules/github.svg)](https://agentmods.dev/rules/guiguito/appstoresmcp/windsurf-rules)
Your own site
<a href="https://agentmods.dev/rules/guiguito/appstoresmcp/windsurf-rules"><img src="https://agentmods.dev/badge/rules/guiguito/appstoresmcp/windsurf-rules/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for windsurf-rules

Your own site · 80×15
<a href="https://agentmods.dev/rules/guiguito/appstoresmcp/windsurf-rules"><img src="https://agentmods.dev/badge/rules/guiguito/appstoresmcp/windsurf-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 2,084 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.02084
Opus 5.5 $0.00000 $0.00834
Sonnet 5.5 $0.00000 $0.00417
Haiku 4.5 $0.00000 $0.00208

Measured 6d ago against content hash 0cf6143fdfc9, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

windsurf-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.windsurf/rules/windsurf-rules.md · 261 lines

How it starts

The opening of the file, as written. The whole thing — 261 lines — stays where its author put it; the contents beside it link to each section on GitHub.

App Store MCP Server - Windsurf Rules

Project Overview

  • This is a TypeScript/Node.js MCP (Model Context Protocol) server for app store scraping
  • Provides 20 MCP tools for Google Play Store and Apple App Store data access
  • Uses Express for HTTP server with dual transport support (HTTP and SSE)
  • Experimental status project - focus on stability and maintainability over new features

TypeScript Configuration & Style

Strict Type Safety

  • Always use strict TypeScript with all strict mode options enabled
  • Never use any type - use unknown with proper type guards or define specific types
  • Enable and respect all strict compiler options: noImplicitAny, noImplicitReturns, noImplicitThis, noUnusedLocals, noUnusedParameters, noUncheckedIndexedAccess
  • Use readonly for immutable properties and arrays when applicable
  • Always declare explicit return types for functions and methods

Type Definitions

  • Create interfaces for all data structures, especially tool input parameters
  • Use JSONSchema7 type from 'json-schema' package for MCP tool schemas
  • Follow the pattern: interface for params + JSONSchema7 for input validation
  • Group related types in src/types/ directory

Code Style

  • Use JSDoc comments for all public classes, methods, and exported functions
  • Include @param, @returns, @throws tags in JSDoc where applicable
  • Mark private methods with @private JSDoc tag
  • Use descriptive variable names with full words (not abbreviations)
  • Prefer const over let, never use var

MCP Tool Implementation Pattern

Tool Class Structure

When creating new MCP tools, follow this exact pattern:

/**
 * [Tool Name] MCP Tool
 * [Brief description of what the tool does]
 */
export class [ToolName]Tool implements MCPTool {
  public readonly name = 'tool-name-kebab-case';
  public readonly description = 'Clear description';
  
  public readonly inputSchema: JSONSchema7 = {
    type: 'object',
    properties: { /* schema */ },
    required: ['requiredParam'],
    additionalProperties: false
  };

  async execute(params: [ParamsInterface]): Promise<any> {
    try {
      this.validateParams(params);
      // Execute logic
      return filterAppData(result, params.fullDetail || false);
    } catch (error) {
      return this.handleError(error, context);
    }
  }

  private validateParams(params: any): void {
    // Explicit validation with clear error messages
  }

  private handleError(error: any, context: string): any {
    // Structured error response
  }
}

Read the full file on GitHub · 261 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 261 lines · 0 tokens per session scan A 0cf6143fdfc9

Subscribe to this mod's changes

windsurf-rules is a cursor rule published in the GitHub repository guiguito/AppStoresMCP (5 stars, last pushed 6d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,084 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-02.

Related

windsurf-rules compared with cursor rules from other repositories

windsurf-rules next to 6 cursor rules from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
windsurf-rulesguiguito/AppStoresMCPCursor rule56d agoMITA0Windsurf
ponytailDietrichGebert/ponytailCursor rule187k10d agoMITA604Cursor
angular-20angular/angularCursor rule101kyesterdayMITA0Cursor
dev-standardapache/supersetCursor rule75kyesterdayApache-2.0A1,147Cursor
control-plane-descriptorsprisma/ormCursor rule48kyesterdayApache-2.0A0Cursor
family-instance-domain-actionsprisma/ormCursor rule48kyesterdayApache-2.0A0Cursor
prefer-assertions-over-defensive-checksprisma/ormCursor rule48kyesterdayApache-2.0A0Cursor