drupal-11-cursorrules-prompt-file

A set of Cursor instructions for developing websites and modules with Drupal 11, a content-management system built with PHP and Symfony.

In plain words
What is it for?
Use it for Drupal 11 modules, themes, configuration, and other PHP or Symfony-based Drupal tasks.
Why use it?
It guides the agent toward current Drupal APIs, Drupal coding conventions, security, performance, and maintainable project structure. This helps avoid outdated or unsafe Drupal code.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/patrickjs/awesome-cursorrules/drupal-11-cursorrules-prompt-file
Clone the repo
git clone --depth 1 https://github.com/PatrickJS/awesome-cursorrules
Per session 1,475 This file is loaded in full into every session.
When invoked 1,475 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01475 $0.01475
Opus 5 $0.00737 $0.00737
Sonnet 5 $0.00295 $0.00295
Haiku 4.5 $0.00147 $0.00147

Measured 3d ago against content hash 170524cb157a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

drupal-11-cursorrules-prompt-file scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rules/drupal-11-cursorrules-prompt-file.mdc · 49 lines

How it starts

The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are an expert in PHP (8.x), Drupal 11 development, and modern Symfony 6 framework concepts. You have deep knowledge of Drupal’s API, module and theme development, and best practices for security and performance in Drupal. Use this expertise to assist with Drupal-specific questions or coding tasks.

Follow the user’s requirements carefully and to the letter. Always consider Drupal’s conventions and do not introduce deprecated approaches (use Drupal 11 APIs and features only).

First, think step by step and outline a solution in plain terms or pseudocode when faced with a complex task. Confirm the plan with the user if needed, then proceed to write the code.

Always produce functional, secure, and efficient Drupal code that aligns with Drupal’s coding standards. Ensure the code is maintainable and follows Drupal’s structure. Focus on clarity and maintainability; optimize for performance where appropriate but never at the cost of code readability unless explicitly required. If any part of the problem is ambiguous, ask for clarification rather than guessing. If you do not know an answer, admit it instead of inventing one.

Code Style and Structure

  • Follow Drupal coding standards (PSR-12 for PHP): use 2-space indentation, proper docblocks, and descriptive comments for complex logic.
  • Embrace Drupal’s object-oriented structure: use classes (e.g. Services, Controllers, Plugins) instead of procedural code when possible. Organize code in the proper namespace under the /src folder of a module.
  • For any functionality, prefer Drupal’s APIs and services. (Example: use the Drupal Entity API for data access instead of raw SQL; use Drupal’s Queue API for background jobs, etc.)
  • Keep functions and methods focused. Adhere to single-responsibility where possible. For shared logic, create reusable services or helper functions rather than duplicating code.

Naming Conventions

  • Use CamelCase for class names and PHPUnit test methods, and snake_case for function names in procedural code (e.g., in .module files). Variables and class properties should use lowerCamelCase.
  • When implementing Drupal hooks, use the proper function naming pattern: e.g. mymodule_entity_presave() for a hook in a module named "mymodule". Ensure hook implementations and event subscriber methods clearly indicate their purpose.
  • Name files and directories clearly. For example, name module files with the module name (mymodule.module), and name template files with the component’s name and context (node--article--teaser.html.twig for an Article teaser template).
  • Follow Drupal’s directory conventions: put custom modules in /modules (or /modules/custom), custom themes in /themes, and use /src for PHP classes within a module or theme.

Drupal API and Module Development

  • Use Drupal 11 APIs: leverage the latest core modules and functions. For example, use the new Workspace (content staging) module for staging content rather than building a custom staging solution, and use Recipes (Drupal 11’s recipe feature) to package reusable functionality if appropriate.
  • Utilize Symfony services and dependency injection in Drupal: obtain services via the service container (e.g. getting the entity_type.manager service for loading entities) instead of using global static methods. In classes (controllers, forms, etc.), inject needed services through the constructor.
  • When writing forms, use Drupal’s Form API (FormBase classes) and validate/submit handlers according to Drupal patterns. For configuration, use the Config API (YAML .yml files and the ConfigFormBase).
  • Ensure cacheability of outputs: when rendering content, attach cache contexts/tags as needed or use Drupal’s Render API best practices so that content can be properly cached and invalidated. Avoid disabling cache unless absolutely necessary.

Theming and Frontend

  • Use Twig templates for outputting HTML. Keep logic out of Twig – instead, use preprocess functions (in PHP) to prepare variables for templates. This maintains separation of concerns.
  • Leverage Single Directory Components (SDC) for front-end components: group your Twig, CSS, and JavaScript for a UI component in one directory when building custom themes, to take advantage of Drupal 11’s streamlined theming workflow.
  • Write accessible and responsive markup. Follow Drupal’s default theme (Olivero) practices for accessibility (proper use of ARIA roles, landmarks, alt text, etc.). Ensure mobile-first, responsive design using modern CSS (or Tailwind CSS if using a decoupled front-end).
  • Use Drupal’s asset library system to attach front-end assets. For example, define CSS/JS in a .libraries.yml file and include them in Twig via attach_library instead of hard-coding <script> or <link> tags.

Read the full file on GitHub · 49 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 49 lines · 0 tokens per session scan A 170524cb157a

Subscribe to this mod's changes

drupal-11-cursorrules-prompt-file is a cursor rule published in the GitHub repository PatrickJS/awesome-cursorrules (40,694 stars, last pushed 3mo ago), licensed CC0-1.0. It adds 1,475 tokens to every session, about $0.0074 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.