Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/itamarzand88/awesome-agent-conventions/reactgit clone --depth 1 https://github.com/ItamarZand88/awesome-agent-conventionsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00491 | $0.00491 |
| Opus 5 | $0.00246 | $0.00246 |
| Sonnet 5 | $0.00098 | $0.00098 |
| Haiku 4.5 | $0.00049 | $0.00049 |
Grade A, and why
react scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
description: "React best practices and patterns for modern web applications" globs: /.tsx, **/.jsx, components//* alwaysApply: false
React Best Practices
Component Structure
- Use functional components over class components
- Keep components small and focused
- Extract reusable logic into custom hooks
- Use composition over inheritance
- Implement proper prop types with TypeScript
- Split large components into smaller, focused ones
Hooks
- Follow the Rules of Hooks
- Use custom hooks for reusable logic
- Keep hooks focused and simple
- Use appropriate dependency arrays in useEffect
- Implement cleanup in useEffect when needed
- Avoid nested hooks
State Management
- Use useState for local component state
- Implement useReducer for complex state logic
- Use Context API for shared state
- Keep state as close to where it's used as possible
- Avoid prop drilling through proper state management
- Use state management libraries only when necessary
Performance
- Implement proper memoization (useMemo, useCallback)
- Use React.memo for expensive components
- Avoid unnecessary re-renders
- Implement proper lazy loading
- Use proper key props in lists
- Profile and optimize render performance
Forms
- Use controlled components for form inputs
- Implement proper form validation
- Handle form submission states properly
- Show appropriate loading and error states
- Use form libraries for complex forms
- Implement proper accessibility for forms
Error Handling
- Implement Error Boundaries
- Handle async errors properly
- Show user-friendly error messages
- Implement proper fallback UI
- Log errors appropriately
- Handle edge cases gracefully
Testing
- Write unit tests for components
- Implement integration tests for complex flows
- Use React Testing Library
- Test user interactions
- Test error scenarios
- Implement proper mock data
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 80 lines · 491 tokens per session scan A e81069e823c3
react is a cursor rule published in the GitHub repository ItamarZand88/awesome-agent-conventions (29 stars, last pushed 1mo ago), licensed MIT. It adds 491 tokens to every session, about $0.0025 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
digital-death-plan
Plan what happens to your digital life when you die — accounts, photos, passwords, money, and social profiles — so someone you trust can actually find, access, memorialize, or close them without a legal nightmare. Use when someone says 'what happens to my accounts when I die', 'digital legacy', 'help my family access…
grief-admin
Get through the brutal logistics after a death — who to notify, what accounts and services to close, in what order, and what genuinely can't wait vs what can wait months — with explicit permission to do it slowly and in pieces. Use when someone says 'my [person] died and I don't know where to start', 'what do I need…
life-premortem
Write the failure story of your year, relationship, move, or big life bet in advance — imagine it's a year later and it went wrong, tell that story vividly, then mine it for the real risks and the cheap things that would have prevented them. Use when someone says 'I'm about to make a big life change', 'what could go…
mechanic-quote-decoder
Read a garage quote or invoice like someone who can't be padded — which line items connect to your actual symptom, which are while-we're-in-there additions, the questions that make soft lines disappear, when a second opinion pays for itself, and the scripts for declining work without souring the relationship. Use when…
used-car-decoder
Decode a used-car listing before you drive an hour to see it — what the seller's phrasing is hiding, the history-check items that matter, a test-drive and inspection checklist ordered by cost-of-miss, the questions that make evasive sellers visible, and the walk-away signs ranked 🔴🟡🟢. Use when someone says 'is this…
deepfake-drill
Run a tabletop drill of a voice-clone or deepfake fraud attempt — the 'CEO needs this wire today' call — against your actual approval process, before a real attacker does, then debrief the tells and fix the process gap. Use when someone asks to train the team on deepfake fraud, test wire-transfer controls, run a…