Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/mvtandas/wordpress-claude-stack/cursorrulesgit clone --depth 1 https://github.com/mvtandas/wordpress-claude-stackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00706 | $0.00706 |
| Opus 5 | $0.00353 | $0.00353 |
| Sonnet 5 | $0.00141 | $0.00141 |
| Haiku 4.5 | $0.00071 | $0.00071 |
Grade A, and why
cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are an expert WordPress developer with deep knowledge of PHP, Gutenberg, WooCommerce, ACF, and the WordPress ecosystem.
Core Principles
- Follow WordPress Coding Standards (WPCS) strictly
- Always use
declare(strict_types=1)in PHP files - Escape ALL output, sanitize ALL input, prepare ALL queries
- Use WordPress APIs — never reinvent what WordPress provides
- Prefix everything with project namespace to avoid conflicts
PHP Rules
- Type hints on all parameters and return types
- Use
WP_Queryorget_posts()— neverquery_posts() - Use
$wpdb->prepare()for ALL database queries - Use
wp_verify_nonce()on ALL form submissions - Use
current_user_can()for ALL permission checks - Use
esc_html(),esc_attr(),esc_url(),wp_kses_post()for output - Use
sanitize_text_field(),absint(),wp_unslash()for input
Theme Development
- Use
add_theme_support()for WordPress features - Enqueue scripts/styles with
wp_enqueue_script()/wp_enqueue_style() - Use template hierarchy:
single-{post_type}.php,archive-{post_type}.php - Use
get_template_part()for reusable components - Keep logic in
functions.php/inc/, templates should only render
Plugin Development
- Main plugin class pattern with singleton or DI
- Activation/deactivation hooks with
register_activation_hook() uninstall.phpfor cleanup on uninstall- Use WordPress Settings API for admin pages
- Use
register_rest_route()for REST endpoints
Gutenberg Blocks
- Use
block.jsonfor metadata - Use
@wordpress/scriptsfor build tooling - Use
useBlockProps()andInnerBlocksin React/JSX - Register with
register_block_type()in PHP - Dynamic blocks: use
render_callbackorrender.php
WooCommerce
- Override templates via
theme/woocommerce/directory - Use WooCommerce hooks, never modify core
- Use
wc_get_product(),WC()->cart,WC()->session - Use HPOS-compatible code (no direct postmeta for orders)
Advanced Custom Fields
- Register field groups in PHP for version control
- Use
get_field(),the_field(),have_rows() - Use ACF blocks for Gutenberg integration
- Always provide fallback values
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 74 lines · 706 tokens per session scan A b97459725b9a
cursorrules is a cursor rule published in the GitHub repository mvtandas/wordpress-claude-stack (3 stars, last pushed 4mo ago), licensed MIT. It adds 706 tokens to every session, about $0.0035 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
git-branch-agent
This rule enforces standards and best practices for branch management operations including checkout, creation, and deletion. This rule should be followed when: 1. creating new branches, 2. switching between branches, 3. deleting branches, or 4. when the git aliases 'gco', 'gcb', or similar branch-related commands are…
00-kit-authoring
Kit-authoring rules for the @commerce-atoms/agents repo. Distinguishes root (npm package) from kit/ (shipped product). Always-on.
30-architecture-boundaries
Module boundaries, shared folder policies, route/view split. See rules/core/architecture.md.
00-agents-md
Universal AGENTS.md is the canonical source. Read it first.
10-imports
Import policy — React Router only, never Remix or react-router-dom. See rules/core/imports.md.
20-routing
Routing manifest rules — single source app/routes.ts. See rules/core/routing.md.