t3-stack

Coding rules for the T3 Stack, a common combination of Next.js, tRPC, Prisma, and NextAuth for web applications. They cover project structure, input checks, database access, and login-aware procedures.

In plain words
What is it for?
Use them when building or reviewing a T3 application, especially its API procedures, database queries, environment settings, migrations, and user-protected actions.
Why use it?
They keep related server, database, and authentication code consistent and help prevent unsafe or inefficient data access.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/nedcodes-ok/cursorrules-collection/t3-stack
Clone the repo
git clone --depth 1 https://github.com/nedcodes-ok/cursorrules-collection
Per session 620 This file is loaded in full into every session.
When invoked 620 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00620 $0.00620
Opus 5 $0.00310 $0.00310
Sonnet 5 $0.00124 $0.00124
Haiku 4.5 $0.00062 $0.00062

Measured yesterday against content hash ed6d7756ea70, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

t3-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rules-mdc/frameworks/t3-stack.mdc · 55 lines

How it starts

The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.

T3 Stack Cursor Rules

You are an expert in the T3 Stack (Next.js + tRPC + Prisma + NextAuth). Follow these rules:

Project Structure

  • Follow create-t3-app conventions: src/server/api/ for tRPC, src/server/db/ for Prisma
  • tRPC routers in src/server/api/routers/ — one file per domain (user.ts, post.ts)
  • Merge routers in src/server/api/root.ts
  • Environment variables validated with Zod in src/env.js — never use process.env directly

tRPC

  • Define procedures on the router: publicProcedure, protectedProcedure
  • Use protectedProcedure for any mutation or user-specific query — it guarantees ctx.session
  • Input validation with Zod on every procedure: .input(z.object({ id: z.string() }))
  • Return plain objects from procedures — Prisma models are fine, class instances are not
  • Use createCallerFactory for server-side tRPC calls (in server components)

Prisma Integration

  • Access Prisma through ctx.db in tRPC procedures — never import db directly in procedures
  • Use select/include to limit returned fields — no findMany() without field selection on large tables
  • Handle Prisma errors: catch PrismaClientKnownRequestError for unique constraint violations (P2002)
  • Run migrations with npx prisma migrate dev, not db push in production

NextAuth

  • Session accessed via ctx.session in tRPC procedures
  • Use getServerAuthSession() in server components, useSession() in client components only
  • Extend session types in next-auth.d.ts to include user.id
  • Put sensitive auth logic in server-side callbacks, never in client code

Data Flow

  • Server components: call tRPC via the server-side caller (RSC)
  • Client components: use api.post.getAll.useQuery() via the tRPC React hooks
  • Prefetch in server components with helpers.post.getAll.prefetch(), pass to HydrateClient
  • Never fetch the same data in both a server component and its client child

Anti-Patterns — Do NOT

  • ❌ Importing the Prisma client directly in client components
  • ❌ Using fetch() for internal API calls when tRPC procedures exist
  • ❌ Putting business logic in API route handlers — put it in tRPC procedures
  • ❌ Using getServerSideProps — use server components + tRPC caller
  • ❌ Skipping input validation on procedures — even internal ones
  • ❌ Storing secrets in NEXT_PUBLIC_ env vars

Read the full file on GitHub · 55 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 55 lines · 620 tokens per session scan A ed6d7756ea70

Subscribe to this mod's changes

t3-stack is a cursor rule published in the GitHub repository nedcodes-ok/cursorrules-collection (37 stars, last pushed 6mo ago), licensed MIT. It adds 620 tokens to every session, about $0.0031 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.