netlify-official-cursorrules-prompt-file

netlify-official-cursorrules-prompt-file is a cursor rule for coding agents from PatrickJS/awesome-cursorrules. It costs 9,048 tokens per session, scanned C, original, CC0-1.0.

A set of Cursor instructions for developing and deploying applications on Netlify, a hosting service that can run websites and server-side functions.

In plain words
What is it for?
Use it when building serverless, edge, background, or scheduled functions and when working with Netlify Blobs or image processing.
Why use it?
It clarifies how to use Netlify's different function types, local development command, storage, and image services while avoiding unsafe or unwanted configuration.

Cursor rule

About the project

PatrickJS/awesome-cursorrules is a collection of Markdown rule files that give Cursor AI editor project-specific instructions about code, frameworks, workflows, and standards. Developers use it to find reusable guidance for shaping Cursor’s behavior in different kinds of software projects.

PatrickJS/awesome-cursorrules · 40,725 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/patrickjs/awesome-cursorrules/netlify-official-cursorrules-prompt-file
Clone the repo
git clone --depth 1 https://github.com/PatrickJS/awesome-cursorrules

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for netlify-official-cursorrules-prompt-file

README.md
[![agentmods](https://agentmods.dev/badge/rules/patrickjs/awesome-cursorrules/netlify-official-cursorrules-prompt-file.svg)](https://agentmods.dev/rules/patrickjs/awesome-cursorrules/netlify-official-cursorrules-prompt-file)
Your own site
<a href="https://agentmods.dev/rules/patrickjs/awesome-cursorrules/netlify-official-cursorrules-prompt-file"><img src="https://agentmods.dev/badge/rules/patrickjs/awesome-cursorrules/netlify-official-cursorrules-prompt-file.svg" alt="Measured on agentmods" height="20"></a>
Per session 9,048 This file is loaded in full into every session.
When invoked 9,048 The same file — it is already loaded in full.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.09048 $0.09048
Opus 5 $0.04524 $0.04524
Sonnet 5 $0.01810 $0.01810
Haiku 4.5 $0.00905 $0.00905

Measured 2d ago against content hash e490ae9b508b, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade C, and why

netlify-official-cursorrules-prompt-file scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Hidden instructionshighPrompt injection

Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.

<!-- get an image hosted on this site and change its size and format -->
rules/netlify-official-cursorrules-prompt-file.mdc · 844 lines

How it starts

The opening of the file, as written. The whole thing — 844 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ANY RULES IN THE ProviderContextOverrides SECTION CAN OVERRULE SPECIFIC RULES IN ProviderContext

  • the .netlify folder is not for user code. It should be added to the .gitignore list
  • avoid adding version numbers to imported code. (for example use @netlify/functions and never @netlify/functions@VERSION)
  • NEVER add CORS headers (such as Access-Control-Allow-Origin) unless user EXPLICITLY asks for them.
  • prefer using netlify dev to start dev server unless another dev command is requested by the user

Guidelines

  • There are 4 types of compute systems you can write code for:
    • Serverless functions - usually used for transactional server/api requests.
    • Edge functions - usually used for code that must modify requests before hitting the server or modifying responses before returning to users.
    • Background functions - longer running functions for asynchronous work.
    • Scheduled functions - schedule logic to run on a CRON-based interval.
  • Netlify Blobs is a general object storage that can be used to accomplish state storage, data storage, etc.
  • Netlify Image CDN enables on-demand image transformations without affecting build times or optimizing images upon upload. It optimizes images dynamically based on client capabilities and caches transformations for performance improvements. Use this when optimizing images dynamically. Don't use this when you need to modify an image during the development/build process.
  • Environment variables are available for storing secrets, API keys, and other values that you want to control external to the code or are too sensitive to put in the code.

Netlify compute

  • NEVER put any type of serverless or edge function in the public or publish directory
  • DO NOT change the default functions or edge functions directory unless explicitly asked to.
  • ALWAYS verify the correct directory to place functions or edge functions into

Context object for serverless functions and edge functions

Below are the available fields/functions from the context argument to serverless and edge functions.

{
  account: {
    id: string, // Unique ID of the Netlify team account associated with the site and function.
  },
  cookies: {
    get: (name: string) => string | undefined, // Reads a cookie from the incoming request.
    set: (options: { name: string; value: string; path?: string; domain?: string; secure?: boolean; httpOnly?: boolean; expires?: Date }) => void, // Sets a cookie on the outgoing response following the CookieStore.set web standard.
    delete: (nameOrOptions: string | { name: string; path?: string; domain?: string }) => void, // Deletes a cookie on the outgoing response, following the CookieStore.delete web standard.
  },
  deploy: {
    context: string, // The deploy context (e.g., production, deploy-preview).
    id: string, // Unique ID of the deploy the function belongs to.
    published: boolean, // Indicates whether the function belongs to the currently published deploy.
  },
  geo: {
    city: string, // City name of the client location.
    country: {
      code: string, // ISO 3166 country code.
      name: string, // Full country name.
    },
    latitude: number, // Latitude coordinate of the client location.
    longitude: number, // Longitude coordinate of the client location.
    subdivision: {
      code: string, // ISO 3166 subdivision code (e.g., state or province).
      name: string, // Subdivision name.
    },
    timezone: string, // Timezone of the location.
    postalCode: string, // Postal code of the location in its regional format.
    ip: string, // Client IP address.
  },
  params: Record<string, string>, // Object containing route parameters from the function path configuration.
  requestId: string, // Unique Netlify request ID.
  server: {
    region: string, // The region code where the deployment is running (e.g., us-east-1).
  },
  site: {
    id: string, // Unique ID for the Netlify site.
    name: string, // The site's Netlify subdomain name.
    url: string, // The main address of the site, which could be a Netlify subdomain or a custom domain.
  },
}

Read the full file on GitHub · 844 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 844 lines · 9,048 tokens per session scan C e490ae9b508b

Subscribe to this mod's changes

netlify-official-cursorrules-prompt-file is a cursor rule published in the GitHub repository PatrickJS/awesome-cursorrules (40,725 stars, last pushed 3mo ago), licensed CC0-1.0. It adds 9,048 tokens to every session, about $0.0452 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.