Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/ifmelate/document-reader-mcp/cursorrulesgit clone --depth 1 https://github.com/ifmelate/document-reader-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00986 | $0.00986 |
| Opus 5 | $0.00493 | $0.00493 |
| Sonnet 5 | $0.00197 | $0.00197 |
| Haiku 4.5 | $0.00099 | $0.00099 |
Grade A, and why
cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cursor project rules for document-reader-mcp
Purpose
- Establish consistent development rules for this repository when using Cursor.
- Optimize for security, maintainability, and developer experience.
Assistant behavior
- Default to concise answers; expand only when asked.
- Before large refactors or breaking changes, propose a short plan and ask for confirmation.
- Prefer minimal, targeted edits. Preserve existing indentation style and width. Do not reformat unrelated code.
- Always add missing imports/exports and keep code type-safe. Avoid unsafe casts or any-typed surfaces.
- Use guard clauses over deep nesting. Avoid unnecessary try/catch; never swallow errors.
- For new code, choose clarity over cleverness; write high-verbosity, readable code with descriptive names.
Research and external knowledge
- For web research or best-practices questions, prefer the Perplexity Sonar MCP server.
- Always set a system role appropriate to the task (e.g., “senior DevOps engineer”, “MCP expert”, “applied research engineer”).
- Cite authoritative sources with links. Highlight critical items and security concerns.
Security and privacy
- Never commit secrets or credentials. Use secret managers (GitHub Encrypted Secrets for CI; SOPS/age or cloud secret stores for config).
- Strip/redact sensitive data in logs and error messages. Do not include secrets in telemetry.
- Default to least-privilege access in code, CI, and cloud roles.
Git and reviews
- Use Conventional Commits for messages (feat:, fix:, docs:, chore:, refactor:, test:, ci:, build:, perf:).
- Require signed commits and signed tags for releases where supported.
- All changes go through PRs with passing checks (build, lint, tests, security scans) before merge.
Testing
- For non-trivial changes, include or update unit tests. Add integration/E2E tests when behavior spans boundaries (I/O, network, persistent stores).
- Aim for fast, deterministic tests. Favor hermetic tests with clear fixtures.
Formatting and linting
- Respect the project’s existing linters/formatters. Do not mix indentation styles or change unrelated formatting.
- If missing, prefer: EditorConfig for basics; language-standard tools (e.g., ESLint+Prettier for TS, Ruff/Black for Python). Enforce via pre-commit and CI.
Architecture and code style
- Name functions as verb phrases and variables as clear nouns. Avoid cryptic abbreviations.
- Prefer pure functions for logic; isolate I/O at boundaries. Inject dependencies for testability.
- Avoid deep nesting; split complex logic into smaller functions.
MCP server guidelines
- Structure
- Separate layers: transport/API, validation, authz/authn, domain logic, tool adapters, and persistence.
- Keep adapters pluggable and stateless; pass context explicitly.
- Configuration
- Use environment variables for config; no secrets in code. Document required vars.
- Authentication/authorization
- Support API keys and/or OAuth with short-lived tokens. Scope service accounts narrowly.
- Quotas and rate limiting
- Enforce per-user/key budgets; handle 429 responses with backoff.
- Validation
- Validate requests/responses against schemas; reject out-of-spec traffic.
- Streaming
- Support streaming for long operations; implement backpressure.
- Reliability
- Use idempotency keys for mutating operations. Retry with exponential backoff and jitter for transient failures.
- Observability
- Use structured logs with correlation IDs. Instrument with OpenTelemetry where applicable.
- Versioning and compatibility
- Version public APIs; provide deprecation windows for breaking changes.
Perplexity Sonar integration rules
- Use models appropriate to task complexity (e.g., Sonar Pro for deep, citation-heavy research).
- Default temperature to 0–0.3 for deterministic, factual outputs.
- Require citations with answers; surface them clearly. Warn when citations are insufficient.
- Apply timeouts and retries with exponential backoff. Handle 429s and 5xx robustly.
- Cache deterministic queries where allowed; include freshness timestamps.
- Respect API ToS and data usage limits. Never expose API keys in client code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 91 lines · 986 tokens per session scan A 207b0058b2a3
cursorrules is a cursor rule published in the GitHub repository ifmelate/document-reader-mcp (3 stars, last pushed 10mo ago), licensed MIT. It adds 986 tokens to every session, about $0.0049 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
react-floating-ui
React 19 + Floating UI 0.27 conventions and pitfalls for floating/anchored components (tooltips, popovers, context menus, dialogs, selects).
app-router-patterns
Next.js 14+ App Router patterns — Server Components, Client Components, Route Handlers, Server Actions, and metadata API.
new_features
Guidelines for integrating new features into the Task Master CLI.
utilities
// ✅ DO: Create focused, reusable utilities /.
dev_workflow
Guide for using Taskmaster to manage task-driven development workflows.
git_workflow
Git workflow integrated with Task Master for feature development and collaboration.