Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/kaminari-ad/mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/kaminari-ad/mcp/mcp-clean-code)<a href="https://agentmods.dev/rules/kaminari-ad/mcp/mcp-clean-code"><img src="https://agentmods.dev/badge/rules/kaminari-ad/mcp/mcp-clean-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/kaminari-ad/mcp/mcp-clean-code"><img src="https://agentmods.dev/badge/rules/kaminari-ad/mcp/mcp-clean-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01379 |
| Opus 5.5 | $0.00000 | $0.00552 |
| Sonnet 5.5 | $0.00000 | $0.00276 |
| Haiku 4.5 | $0.00000 | $0.00138 |
Grade A, and why
mcp-clean-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Clean Code Rules — mcp/ (TypeScript)
This is OSS infrastructure that other people's data flows through. We hold it to a higher bar than internal services. Every rule below is enforced by ESLint, a custom CI gate, or both.
File Size
- Maximum 200 effective lines per file (excluding imports and blank lines). Enforced by
mcp/scripts/check-file-sizes.tsviamake check. - If a file is too long, split by responsibility. If a tool needs 200+ lines, it is probably doing more than one thing — extract a domain service.
- Composition roots (
presentation/<transport>/<transport>-bootstrap.ts,application/tool-registry.ts) grow with the tool count and are grandfathered incheck-file-sizes.ts. To add a new file to the grandfather list, do it in a separate PR with a justification comment.
One file = one exported thing
- One
Tool, one class, one interface, one port — per file. File name in kebab-case, exported symbol in camelCase (functions, consts) or PascalCase (types, classes). - No "barrel grab-bag" files (
types.ts,helpers.ts,utils.ts). Either it belongs inshared/because it is truly generic, or it belongs next to its single consumer. index.tsre-exports may be used to keep import paths short, but the underlying file is still one-thing-per-file.
Type strictness — no any, no bare as, no silent escapes
anyis banned. Useunknownand narrow with type guards.as Typecasts are banned (ESLintconsistent-type-assertions: never). If TypeScript needs help, write a type guard or usesatisfies.// @ts-ignoreis banned.// @ts-expect-erroris allowed only with a 10+ character explanation:// @ts-expect-error MSW types do not include the override.- Every function — public AND private — has an explicit return type. ESLint
explicit-function-return-type: error. - Every public function/method has a JSDoc comment. ESLint
jsdoc/require-jsdoc: warn(escalated to error in CI). - No non-null assertions (
x!). If TS can't prove non-null, it isn't.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 77 lines · 0 tokens per session scan A c148c784d5af
mcp-clean-code is a cursor rule published in the GitHub repository kaminari-ad/mcp (0 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,379 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-05.
Other cursor rules, from other repositories
javascript-typescript-code-quality-cursorrules-pro
Cursor rules for JavaScript and TypeScript development with code quality integration.
general-code-quality-and-style
Project-wide rules for readable, maintainable TypeScript code, functional programming, file organization, naming, modular design, reviews, and web performance.
api-design-typescript
API design for TypeScript HTTP services — Express 5, Fastify, NestJS handler patterns, Zod request validation, typed errors with Problem Details, OpenAPI, rate limiting, and CORS. Extends core/rules/api-design.mdc. Applied to route, controller, and handler code.
typescript
TypeScript best practices — strict configuration, advanced type patterns, type safety, generics, branded types, type guards, performance, testing, and common anti-patterns. Applied when working with TypeScript files.
typescript-testing
TypeScript testing guidelines — Vitest/Jest setup, unit testing patterns, mocking strategy, integration testing with Testcontainers, and coverage standards. Applied when working with TypeScript test files.
typescript-security
TypeScript security guidelines — input validation with Zod, JWT handling, SQL injection prevention, secrets hygiene, and dependency scanning. Applied when working with TypeScript files.