Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/nedcodes-ok/cursorrules-collection/t3-stackgit clone --depth 1 https://github.com/nedcodes-ok/cursorrules-collectionWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00620 | $0.00620 |
| Opus 5 | $0.00310 | $0.00310 |
| Sonnet 5 | $0.00124 | $0.00124 |
| Haiku 4.5 | $0.00062 | $0.00062 |
Grade A, and why
t3-stack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.
T3 Stack Cursor Rules
You are an expert in the T3 Stack (Next.js + tRPC + Prisma + NextAuth). Follow these rules:
Project Structure
- Follow create-t3-app conventions: src/server/api/ for tRPC, src/server/db/ for Prisma
- tRPC routers in src/server/api/routers/ — one file per domain (user.ts, post.ts)
- Merge routers in src/server/api/root.ts
- Environment variables validated with Zod in src/env.js — never use process.env directly
tRPC
- Define procedures on the router: publicProcedure, protectedProcedure
- Use protectedProcedure for any mutation or user-specific query — it guarantees ctx.session
- Input validation with Zod on every procedure: .input(z.object({ id: z.string() }))
- Return plain objects from procedures — Prisma models are fine, class instances are not
- Use createCallerFactory for server-side tRPC calls (in server components)
Prisma Integration
- Access Prisma through ctx.db in tRPC procedures — never import db directly in procedures
- Use select/include to limit returned fields — no findMany() without field selection on large tables
- Handle Prisma errors: catch PrismaClientKnownRequestError for unique constraint violations (P2002)
- Run migrations with npx prisma migrate dev, not db push in production
NextAuth
- Session accessed via ctx.session in tRPC procedures
- Use getServerAuthSession() in server components, useSession() in client components only
- Extend session types in next-auth.d.ts to include user.id
- Put sensitive auth logic in server-side callbacks, never in client code
Data Flow
- Server components: call tRPC via the server-side caller (RSC)
- Client components: use api.post.getAll.useQuery() via the tRPC React hooks
- Prefetch in server components with helpers.post.getAll.prefetch(), pass to HydrateClient
- Never fetch the same data in both a server component and its client child
Anti-Patterns — Do NOT
- ❌ Importing the Prisma client directly in client components
- ❌ Using fetch() for internal API calls when tRPC procedures exist
- ❌ Putting business logic in API route handlers — put it in tRPC procedures
- ❌ Using getServerSideProps — use server components + tRPC caller
- ❌ Skipping input validation on procedures — even internal ones
- ❌ Storing secrets in NEXT_PUBLIC_ env vars
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 55 lines · 620 tokens per session scan A ed6d7756ea70
t3-stack is a cursor rule published in the GitHub repository nedcodes-ok/cursorrules-collection (37 stars, last pushed 6mo ago), licensed MIT. It adds 620 tokens to every session, about $0.0031 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.