Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/jguimera/securitycopilotmcpserver/securitycopilotdevgit clone --depth 1 https://github.com/jguimera/SecurityCopilotMCPServerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00454 | $0.00454 |
| Opus 5 | $0.00227 | $0.00227 |
| Sonnet 5 | $0.00091 | $0.00091 |
| Haiku 4.5 | $0.00045 | $0.00045 |
Grade A, and why
securitycopilotdev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security Copilot and Sentinel Integration Guidelines
This project is focused on developting and testing components for Microsoft Security Copilot.
When working with Microsoft Security Copilot functionality:
-
The terms "plugin," "skill," and "skillset" all refer to Microsoft Security Copilot components.
-
In the Security Copilot architecture, "skillset" and "plugin" are equivalent terms.
-
For skill testing:
- Identify Sentinel KQL skills looking at the SkillSet Format and Target fields.
- To test Sentinel KQL skills use the appropriate Sentinel KQL query MCP tool. Show the results of the KQL execution after running the tool.
- If required input parameters are missing, please request them to the user. Only parameters inside Ipunts sections are needed, the ones in Settings are already set inside the platform. For the input parameters values always use String type.
- If asked to test a skill inside Security Copilot run a prompt in for the selected skill using the run prompt skill. Show the results of the prompt to allow user validation. Considering reformating the output to enhance user experience.
- IF asked to run a full test and deploy a particular skill this is the process you need to follow:
- Extract the KQL query from the Yaml File
- Run the KQL query in Sentinel with the appropriate Sentinel KQL query MCP tool. Display a summary of the results.
- Validate that the results match with the description of the Skill and the intent of the KQL query.
- If the previous validation is successful, Upload or Update the Skill in Security Copilot following the intruction below.
- Run a Prompt to test the Skill inside Security Copilot.
- Create a summary of the resting , the validation and the results. I need to understand if the SKill does what it is suposed to do , if the deployment was sucessfull and if the prompt results align with the initial test.
-
To deploy, update, or upload a skill/skillset/plugin:
- Use the appropriate plugin Upload tool
- Include the complete YAML file content as input for the deployment process
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 27 lines · 454 tokens per session scan A 21fa5e81cc5e
securitycopilotdev is a cursor rule published in the GitHub repository jguimera/SecurityCopilotMCPServer (23 stars, last pushed 10mo ago), licensed MIT. It adds 454 tokens to every session, about $0.0023 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
typescript
Changes to these high-fan-out internals can affect every message, delta, element, or rerun. Keep work in them minimal, and benchmark changes with representative stress-test apps.
coolify-ai-docs
Master reference to all Coolify AI documentation in .ai/ directory.
python_lib
Tips and guidelines specific to the development of the Streamlit Python library, not applicable to scripts and e2e tests.
specs
This directory contains product and tech specs for Streamlit features.