bun

bun is a cursor rule for coding agents from nedcodes-ok/cursorrules-collection. It costs 522 tokens per session, scanned A, original, MIT.

Rules for Bun, a JavaScript and TypeScript runtime with built-in HTTP serving, file access, bundling, package management, and testing tools. They specify Bun's preferred APIs for common tasks.

In plain words
What is it for?
Use it to create HTTP and WebSocket servers, read and write files, bundle applications, transpile TypeScript, manage packages, and run tests with Bun.
Why use it?
They help avoid mixing incompatible or unnecessary Node.js patterns with Bun's runtime. The guidance also makes server responses, file operations, bundles, and package behavior more explicit.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/nedcodes-ok/cursorrules-collection/bun
Clone the repo
git clone --depth 1 https://github.com/nedcodes-ok/cursorrules-collection

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bun

README.md
[![agentmods](https://agentmods.dev/badge/rules/nedcodes-ok/cursorrules-collection/bun.svg)](https://agentmods.dev/rules/nedcodes-ok/cursorrules-collection/bun)
Your own site
<a href="https://agentmods.dev/rules/nedcodes-ok/cursorrules-collection/bun"><img src="https://agentmods.dev/badge/rules/nedcodes-ok/cursorrules-collection/bun.svg" alt="Measured on agentmods" height="20"></a>
Per session 522 This file is loaded in full into every session.
When invoked 522 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00522 $0.00522
Opus 5 $0.00261 $0.00261
Sonnet 5 $0.00104 $0.00104
Haiku 4.5 $0.00052 $0.00052

Measured yesterday against content hash 0c53de814d8f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bun scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

- Use Bun.spawn() / Bun.spawnSync() instead of child_process
rules-mdc/tools/bun.mdc · 46 lines

How it starts

The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bun Cursor Rules

You are an expert Bun runtime developer. Follow these rules:

HTTP & Networking

  • Use Bun.serve() for HTTP servers — never import from node:http unless forced by a dependency
  • Return new Response() directly from fetch handler. Set status and headers explicitly
  • Use request.json(), request.text(), request.formData() — don't manually parse bodies
  • For WebSockets, use the websocket handler in Bun.serve(), not a separate library

File I/O

  • Use Bun.file(path) for reading files — it's lazy and fast. Call .text(), .json(), .arrayBuffer() on it
  • Use Bun.write(path, data) for writing — accepts strings, Blobs, ArrayBuffers, Response objects
  • Prefer Bun.file() over fs.readFileSync/fs.writeFileSync in all cases
  • Use Bun.stdin, Bun.stdout for streaming I/O

Bundler & Transpiler

  • Use Bun.build() for bundling — set entrypoints, outdir, target, and format explicitly
  • Set target: "bun" for server bundles, "browser" for client bundles
  • Use external to exclude server-only dependencies from browser bundles
  • Bun transpiles TypeScript natively — no tsconfig paths resolution needed at runtime

Package Management

  • Use bun install, bun add, bun remove — lockfile is bun.lockb (binary)
  • Prefer bunfig.toml for configuration over CLI flags
  • Use workspace protocol ("workspace:*") for monorepo internal packages
  • Trust bun's node_modules resolution — it's npm-compatible

Testing

  • Use bun:test — import { test, expect, describe, beforeAll, afterAll } from "bun:test"
  • Use expect().toBe(), .toEqual(), .toThrow(), .resolves, .rejects — Jest-compatible matchers
  • Mock with mock() from "bun:test" — spyOn works on objects
  • Run with bun test — no config file needed, it finds *.test.ts automatically

Performance

  • Use Bun.sleep(ms) over setTimeout for async delays
  • Use Bun.ArrayBufferSink for high-throughput binary writes
  • Bun.hash() and Bun.CryptoHasher for hashing — faster than node:crypto for common cases
  • Use Bun.spawn() / Bun.spawnSync() instead of child_process

Read the full file on GitHub · 46 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 46 lines · 522 tokens per session scan A 0c53de814d8f

Subscribe to this mod's changes

bun is a cursor rule published in the GitHub repository nedcodes-ok/cursorrules-collection (37 stars, last pushed 6mo ago), licensed MIT. It adds 522 tokens to every session, about $0.0026 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.