Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/kadam-official/mcp-server/release-gategit clone --depth 1 https://github.com/kadam-official/mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/kadam-official/mcp-server/release-gate)<a href="https://agentmods.dev/rules/kadam-official/mcp-server/release-gate"><img src="https://agentmods.dev/badge/rules/kadam-official/mcp-server/release-gate.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00424 | $0.00424 |
| Opus 5 | $0.00212 | $0.00212 |
| Sonnet 5 | $0.00085 | $0.00085 |
| Haiku 4.5 | $0.00042 | $0.00042 |
Grade A, and why
release-gate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Release & Deploy Gate (human-approved)
Merging to main, tagging releases, deploying, and publishing are shared-state,
hard-to-reverse actions. They require an explicit, per-action human "go" — even
when a plan's to-do list names them and even when the agent was told to
"implement the plan / don't stop until all to-dos are done". That instruction
does not override this gate.
The agent MAY do autonomously
- Create branches, commit, push the feature branch.
- Open a GitLab MR (and update its description).
- Run/await CI; run the full local quality gate.
- Report status (e.g. "MR open, pipeline green") and stop.
The agent MUST STOP and get explicit per-action approval before
- Merging an MR into
main(never self-merge; green CI ≠ approval to merge). - Tagging / pushing a release tag (
vX.Y.Z). - Approving the npm-publish gate (this is always a human action).
- Deploying / redeploying any environment — e.g.
rnd.sdev.pw:/root/mcp-kadam,docker compose up, editing a hostdocker-compose.yml. - Force-pushing anything (and never force-push
main/master). - Reverting
mainor deleting release tags (these are also human-gated changes).
Default end state of an autonomous task
"Branch pushed + MR open + CI green", then await the human's instruction for each of the gated steps above. Present the MR link and ask how to proceed; do not chain merge → tag → deploy → publish on your own.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 34 lines · 424 tokens per session scan A 60d45fdb831c
release-gate is a cursor rule published in the GitHub repository kadam-official/mcp-server (0 stars, last pushed 1mo ago), licensed MIT. It adds 424 tokens to every session, about $0.0021 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
zip-contents-protection.crux
⟦CRUX:zip-contents-protection.md P.⊛{¬auto-Δ scripts/create-crux-zip.py w/o user req!}.
git-authoring
Conventional Commit, pull-request, release-note, and PR-review conventions for this repository.
langfuse-mcp-general-rules
Cursor rule "langfuse-mcp-general-rules" from avivsinai/langfuse-mcp, covering building and publishing to pypi, version numbering and tagging and build and publish workflow.
savee
Use the Savee MCP tools when the task involves design inspiration, visual references, moodboards, or the user's own saved work.
release-validation-auto
This rule validates release prerequisites including branch naming conventions and package.json structure. It runs when users request release creation, version bumping, or package publishing. The rule ensures releases only occur from appropriate branches (release/, hotfix/, fix/) and validates package.json exists with…
release-version-bump-auto
Apply when the user is creating or preparing a release, version bump, tag, publish, or deploy. Validates semantic version bumps against change analysis (breaking/feat/fix), blocks inappropriate bumps, and guides major/minor/patch or custom version choice. Use for release workflows, package versioning, and…