Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/imrohit4077/niyamnpx agentmods add rules/imrohit4077/niyam/niyam-conventionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions)<a href="https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions"><img src="https://agentmods.dev/badge/rules/imrohit4077/niyam/niyam-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/imrohit4077/niyam/niyam-conventions"><img src="https://agentmods.dev/badge/rules/imrohit4077/niyam/niyam-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04174 | $0.04174 |
| Opus 5 | $0.02087 | $0.02087 |
| Sonnet 5 | $0.00835 | $0.00835 |
| Haiku 4.5 | $0.00417 | $0.00417 |
Grade A, and why
niyam-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 442 lines — stays where its author put it; the contents beside it link to each section on GitHub.
What is Niyam?
Niyam is a full-stack AI-powered Applicant Tracking System (ATS) — a modern alternative to Greenhouse/Lever/SmartRecruiters.
- Backend: Python 3.11+ · FastAPI · SQLAlchemy 2.0 · PostgreSQL · Alembic migrations
- Frontend: React 19 · TypeScript · Vite · React Router 7 · TipTap editor ·
@dnd-kit - Queue/Async: Celery + Redis (gevent pool)
- PDF generation: WeasyPrint (preferred) with fpdf2 fallback
- Auth: JWT (access + refresh tokens) via
python-jose+ Passlib/bcrypt
Repository Layout
niyam/
├── main.py # FastAPI app factory, middleware, /health
├── manage.py # CLI: runserver, db:*, worker, scheduler, shell, routes
├── requirements.txt
├── pyproject.toml
├── alembic.ini
├── .env.example
│
├── config/
│ ├── routes.py # ← SINGLE place where ALL HTTP routes are registered
│ ├── settings.py # Pydantic Settings (reads .env)
│ ├── database.py # SQLAlchemy engine + session
│ ├── database.yml # Per-env DB config (APP_ENV selects section)
│ ├── celery_app.py # Celery instance
│ └── schedule.py # Celery Beat schedule
│
├── app/
│ ├── controllers/ # HTTP layer: request parsing, auth checks, render_json
│ ├── services/ # Business logic; return {"ok": True/False, ...}
│ ├── models/ # SQLAlchemy ORM models (Mapped / mapped_column)
│ ├── jobs/ # Celery async tasks
│ ├── middleware/ # auth_middleware, audit_log_middleware, logging_middleware
│ ├── schemas/ # Pydantic request/response schemas
│ └── helpers/ # Utilities (object_storage, etc.)
│
├── db/
│ └── migrations/versions/ # Alembic migration files
│
├── web/ # React SPA source
│ ├── src/
│ │ ├── pages/ # Route-level page components
│ │ ├── components/ # Reusable UI components
│ │ ├── hooks/ # Custom React hooks
│ │ ├── api/ # API client functions (fetch wrappers)
│ │ └── types/ # TypeScript types/interfaces
│ └── vite.config.ts # Builds to ../static/; proxies /api → localhost:8000
│
├── static/ # Production SPA bundle (output of npm run build)
├── tests/
└── scripts/
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 442 lines · 4,174 tokens per session scan A 115d6d670e29
niyam-conventions is a cursor rule published in the GitHub repository imrohit4077/niyam (5 stars, last pushed 3mo ago), licensed MIT. It adds 4,174 tokens to every session, about $0.0209 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
agent-development
Python agents are typically in folders named agent-py/ or agent/ and use the sdk-python/ package.
infrastructure
Terraform infrastructure-as-code standards for multi-cloud (AWS, GCP, Azure, OCI) provisioning.
settings-page
Settings page layout, tabs, Preferences section, AI Setup section, auto-save pattern, custom UI components.
rolemule-core
Core RoleMule conventions — app name, error system, JSON serialization, background tasks.
analytics-consent-onboarding
PostHog analytics, GDPR cookie consent, and onboarding tour usage.
ui-components
USE WHEN: Building UI components, structuring layouts, and applying styles using Tailwind CSS.