What is 000-core-rulesync?

A shared rule set for AI assistants working on the Mirror Project, covering communication, Python and FastAPI code, testing, security, and output formats.

Use it to guide development of Python 3.11+ and FastAPI applications, secure input handling, test coverage, documentation, and structured task plans.

It gives assistants consistent project-specific expectations so their answers and code fit the project’s standards.

000-core-rulesync — Cursor rule by hamzaamjad

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/hamzaamjad/cursor-rules/000-core-rulesync

Clone the repo

git clone --depth 1 https://github.com/hamzaamjad/cursor-rules

Made for: Cursor.

Per session 769 This file is loaded in full into every session.

When invoked 769 The same file — it is already loaded in full.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00769	$0.00769
Opus 5	$0.00385	$0.00385
Sonnet 5	$0.00154	$0.00154
Haiku 4.5	$0.00077	$0.00077

Measured yesterday against content hash ea41b08ed75f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

000-core-rulesync scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- May run bash/python snippets directly (no sudo without explicit permission)

.cursor/rules/000-core-rulesync.mdc · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AI Assistant Rules for The Mirror Project

Core Philosophy

You are assisting with The Mirror Project - a local-first, privacy-respecting AI workspace that unifies LLMs, personal health & context streams, and autonomous agents. Always prioritize:

Information density and engineering precision
Privacy and local-first architecture
Practical, working solutions over theoretical discussions

Communication Style

Be information-dense and engineering-precise; avoid fluff
Default to "you can do this" coaching tone
Ask clarifying questions ONLY when ambiguity blocks action
Prefer primary sources and official documentation; always cite links

Code Standards

Language: Python 3.11+ with type hints
Framework: FastAPI with Pydantic v2 for APIs
Style: Well-commented, runnable code with minimal external dependencies
Testing: Maintain 80%+ coverage with descriptive test names
Security: Never commit secrets, validate all inputs, use secure defaults

Output Formats

Code: Properly formatted with comments, ready to run
Tasks: Numbered checklists or YAML/JSON specs ready for agents
Documentation: Markdown with clear heading hierarchy and links
Diagrams: Mermaid for architecture, tables for comparisons

Technology Stack

Core

Python 3.11, FastAPI, Pydantic v2, Poetry/venv
PostgreSQL + TimescaleDB, Redis, Docker
GitHub Actions for CI/CD

ML/LLM

HuggingFace (transformers, accelerate)
Diffusion-based LLaDA-8B
Vector stores (Chroma), RAG implementations

Infrastructure

Kubernetes-lite (k3d), Prometheus + Grafana
Pulumi (TypeScript) for IaC
Git-secrets pre-commit hooks

Project-Specific Context

Building local-first health data integration (WHOOP, Oura, Tomorrow.io)
Implementing FastAPI/OpenAI-style endpoints
Creating Grafana dashboards for visualization
Ensuring GitHub Actions CI/CD with act-local parity

Development Workflow

Rapid prototyping with edge-case thinking
Test coverage for all new features
Clear documentation in README/AGENTS.md
Containerized, production-ready deployments

Read the full file on GitHub · 89 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 89 lines · 769 tokens per session scan B ea41b08ed75f

Subscribe to this mod's changes

000-core-rulesync is a cursor rule published in the GitHub repository hamzaamjad/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It adds 769 tokens to every session, about $0.0038 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Security Testing

000-core-rulesync