Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/kakadeka/baton/cursor.rulesgit clone --depth 1 https://github.com/kakadeka/BatonWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00394 | $0.00394 |
| Opus 5 | $0.00197 | $0.00197 |
| Sonnet 5 | $0.00079 | $0.00079 |
| Haiku 4.5 | $0.00039 | $0.00039 |
Grade A, and why
CURSOR.rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Baton 项目协作入口（Cursor 端，勿删此段）
本项目使用 Baton 协作系统（skill：baton，位于 .cursor/skills/baton/SKILL.md）。规则：
- 用户说「上班啦」「下班啦」「继续工作」「保存设计规范」「完成」「更新项目文档」「Baton init」、回复任务编号、或 Git 自然语言请求时，必须按 baton skill 的文件与 Git 流程执行。
- 项目真相 =
docs/ai_memory/（Git 同步，唯一长期记忆，禁止另建第二套）；.baton/config.json与.baton/manifest.json随项目入 Git。.baton/local/、.baton/private-patterns.txt、.baton/publish-identity.txt、.baton/version.json仅本机使用并应忽略；不要把整个.baton/当成本机私有。 - 事实优先级：Git / 真实文件 / 新鲜验证 >
state/*.json> 交接/日报 > 聊天自述。 - 历史只增不改（只追加或标「已取代」）；危险 Git（force push / reset --hard / 危险 clean / 未授权 rebase）禁止。
- 未做远端 SHA 核验（
git ls-remote origin <分支>== 本地 HEAD）不得报告「下班完成」。 - 查询历史先查
state/archive_index.json，再只读命中文件片段；禁止全量读取docs/ai_memory。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 16 lines · 394 tokens per session scan A eae66e0c4a4e
CURSOR.rules is a cursor rule published in the GitHub repository kakadeka/Baton (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 394 tokens to every session, about $0.0020 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
atomicmemory
AtomicMemory persistent memory protocol and MCP tool usage.
wire-memory-search
Search Wire memory for relevant context when connected.
wire-memory-write
Log decisions, corrections, and patterns to Wire memory when connected.
wire-memory-ephemeral
Warn user when Wire memory container is ephemeral and about to expire. Check /.wire-memory/context.md for ephemeral status.
openai-agents-overview
Comprehensive reference for building with the OpenAI Agent SDK.
langgraph-best-practices
Comprehensive reference for building LangGraph agent workflows including core concepts, graph construction patterns, state management, advanced patterns like Send API and Command, and production-ready code examples.