Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/louisbrulenaudet/monorepo-templatenpx agentmods add rules/louisbrulenaudet/monorepo-template/workers-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/workers-config)<a href="https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/workers-config"><img src="https://agentmods.dev/badge/rules/louisbrulenaudet/monorepo-template/workers-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/louisbrulenaudet/monorepo-template/workers-config"><img src="https://agentmods.dev/badge/rules/louisbrulenaudet/monorepo-template/workers-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01694 | $0.01694 |
| Opus 5 | $0.00847 | $0.00847 |
| Sonnet 5 | $0.00339 | $0.00339 |
| Haiku 4.5 | $0.00169 | $0.00169 |
Grade A, and why
workers-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wrangler / Config Rules
wrangler.jsonc is the source of truth for a Worker's bindings, vars, and routes. Generated outputs must never be hand-edited (see guardrails.mdc):
worker-configuration.d.ts- generated bywrangler typesand committed to git (Cloudflare: "We recommend you commit your generated types file for use in CI"). After changing bindings/vars inwrangler.jsonc, runpnpm typesand commit the regenerated file in the same change. Never edit it by hand.pnpm run cirunspnpm types:check(wrangler types --check), which fails when the committed file has drifted fromwrangler.jsonc. Because it is tracked it is a normal Turborepo input, socheck-typesinvalidates on it directly - notypestask edge needed. It is excluded from OXC byignorePatternsin.oxlintrc.json/.oxfmtrc.json, since.gitignoreno longer covers it.
Required config
Every app wrangler.jsonc should include: $schema (../../node_modules/wrangler/config-schema.json from apps/*), a current compatibility_date (2026-08-04 or later so Node.js compatibility is on by default; do not add redundant nodejs_compat / nodejs_compat_v2 flags), send_metrics: false, root observability, and env.staging + env.production with traces enabled. Copy patterns from an existing app (worker-api, front-app) when scaffolding.
Secrets vs vars
- Secrets never go in
wrangler.jsoncvars, code, or logs. Local dev:.dev.vars(git-ignored; keep.dev.vars.examplein sync). Deploy:wrangler secret put. - Non-secret config (
API_ORIGIN,*_BASE_URL,ENVIRONMENT,CORS_ORIGINS) may be plainvars.VITE_*for the SPA is build-time and public (not a secret). - Declare required secret names with
secrets.requiredinwrangler.jsoncwhen a Worker needs them -wrangler typesemits typedenv.*bindings without.dev.vars(CI-safe),wrangler devallowlists.dev.varskeys, and deploy fails if remote secrets are missing. - Hand-declared bindings live in
src/types/*.d.ts; generated ones come frompnpm types.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 89 lines · 1,694 tokens per session scan A f70eeb805f01
workers-config is a cursor rule published in the GitHub repository louisbrulenaudet/monorepo-template (19 stars, last pushed 8d ago), licensed Apache-2.0. It adds 1,694 tokens to every session, about $0.0085 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
cloudflare-workers-hono-auto
Cloudflare Workers with Hono framework development standards and best practices.
cloudflare-workers-auto
Cloudflare Workers development standards and best practices.
ankra-cli
Ankra CLI rules and best practices for managing Kubernetes clusters via the Ankra platform.
cloudflare-email-telegram-cursorrules-prompt-file
Cursor rules for setting up email-to-Telegram forwarding via Cloudflare Email Routing and Workers using the mail2tg CLI.
paperfit
PaperFit project rule for LaTeX visual typesetting optimization.
swift-argument-parser
Documentation and usage patterns for Swift Argument Parser for command-line tools.