core-standards

A set of project rules for AI-assisted development in PHP and Laravel repositories.

In plain words
What is it for?
Use it to guide repository-aware coding work, including following the versions in composer.json, reusing project patterns, avoiding invented changes, and checking visible context before proposing edits.
Why use it?
Coding agents can make assumptions, change unrelated code, or ignore the project's existing conventions. These rules tell the agent how to inspect context, preserve code, and decide when questions are necessary.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/pekral/cursor-rules/core-standards
Clone the repo
git clone --depth 1 https://github.com/pekral/cursor-rules
Per session 4,516 This file is loaded in full into every session.
When invoked 4,516 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.04516 $0.04516
Opus 5 $0.02258 $0.02258
Sonnet 5 $0.00903 $0.00903
Haiku 4.5 $0.00452 $0.00452

Measured 2d ago against content hash fc6105246dd3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

core-standards scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- **The codebase's default state is no comments — delete the ones that never earned their place.** The bar above governs the comments you *write*; it governs the ones already sitting in the file exactly as much. Whenever
rules/php/core-standards.mdc · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Context

  • The project tech stack is defined in composer.json.
  • Use the PHP version and major package versions defined in composer.json as the source of truth.
  • Prefer existing project conventions over introducing new patterns.

AI Behavior

  • Do not apologize.
  • Do not invent changes, files, implementations, or results.
  • Preserve existing code and do not remove unrelated logic.
  • Verify visible context before proposing changes.
  • Do not speculate when the answer can be derived from the repository context.
  • Do not ask the user to verify something that is already visible in the provided code or files.
  • Do not suggest file changes when no actual modification is needed.
  • Fix obvious grammatical issues in user-facing text you modify.
  • Default to autonomous execution: proceed without asking when the answer can be inferred from the issue, the codebase, the project configuration, or prior conversation context.
  • Only ask the user when the next step is genuinely ambiguous and the ambiguity cannot be resolved from the available context. State the specific ambiguity that blocks the work.
  • Never ask the user to confirm a fact the agent can verify itself (tests passing, fixers clean, branch up-to-date, file exists, etc.) — verify it directly instead.
  • Never gate on user approval for work the assignment already authorizes (creating commits, opening PRs, applying review fixes mandated by the calling skill).
  • When user input is genuinely required, batch all questions into a single round; do not serialize one question at a time.

Naming

  • Use clear, descriptive names that reveal purpose.
  • Prefer descriptive method and variable names over comments.
  • Classes: PascalCase.
  • Methods and variables: camelCase.
  • Routes: kebab-case URLs and dot notation route names.
  • Config keys: snake_case.
  • Controllers: plural noun + Controller.
  • Jobs: action-oriented names.
  • Events: past-tense or domain-event names.
  • Enums: descriptive case names.

Structure

  • Keep one clear responsibility per class and per method.
  • Avoid god classes and mixed responsibilities.
  • Prefer composition over inheritance unless inheritance is clearly justified.
  • Expose clear interfaces and keep implementation details internal.
  • Extract deeply nested conditionals into well-named methods where it improves readability.
  • Prefer small, simple classes or functions unless state is genuinely needed.
  • Prefer typed DTOs over raw arrays across important boundaries.
  • When a method, function, closure, constructor, __invoke(), or other callable requires more than 4 parameters, introduce a dedicated typed DTO (preferably final readonly with promoted constructor properties) and pass it as a single argument instead of a long parameter list. Promoted constructor properties count as parameters; a variadic (...$args) counts as one. The only exempt cases are entry-point signatures fixed by an external framework / vendor contract that the project cannot change — controller actions whose argument list is resolved by the service container, magic methods bound by the framework, event listeners whose signature is dictated by the dispatched event, and methods overriding a parent / interface owned by vendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the parent class / interface and a one-line reason.
  • When a public method returns a structured set of values — an associative array representing a record, a multi-key payload, or an array shape with named string keys — return a typed DTO (preferably final readonly with promoted constructor properties) instead of the raw array. A DTO names and types each field, turning an opaque array return type into a self-documenting contract the caller can rely on. This does not apply to: a single scalar / bool / string / int / enum / void return; a homogeneous list or collection of one type (list<int> of IDs, array<int, OrderData>, Collection<int, UserModel>); or a return whose array shape is fixed by an external framework / vendor contract the project cannot change — toArray(), jsonSerialize(), Arrayable::toArray(), Eloquent casts() / $attributes, FormRequest rules(), a config callback the framework invokes, or a method overriding a parent / interface owned by vendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the contract and a one-line reason.
  • Use readonly for immutable data where practical.
  • Use PHP attributes when they provide a cleaner and more idiomatic solution than manual wiring.

Read the full file on GitHub · 142 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 142 lines · 4,516 tokens per session scan A fc6105246dd3

Subscribe to this mod's changes

core-standards is a cursor rule published in the GitHub repository pekral/cursor-rules (6 stars, last pushed 7d ago), licensed MIT. It adds 4,516 tokens to every session, about $0.0226 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.