Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/pekral/cursor-rules/core-standardsgit clone --depth 1 https://github.com/pekral/cursor-rulesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04516 | $0.04516 |
| Opus 5 | $0.02258 | $0.02258 |
| Sonnet 5 | $0.00903 | $0.00903 |
| Haiku 4.5 | $0.00452 | $0.00452 |
Grade A, and why
core-standards scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **The codebase's default state is no comments — delete the ones that never earned their place.** The bar above governs the comments you *write*; it governs the ones already sitting in the file exactly as much. Whenever How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Context
- The project tech stack is defined in
composer.json. - Use the PHP version and major package versions defined in
composer.jsonas the source of truth. - Prefer existing project conventions over introducing new patterns.
AI Behavior
- Do not apologize.
- Do not invent changes, files, implementations, or results.
- Preserve existing code and do not remove unrelated logic.
- Verify visible context before proposing changes.
- Do not speculate when the answer can be derived from the repository context.
- Do not ask the user to verify something that is already visible in the provided code or files.
- Do not suggest file changes when no actual modification is needed.
- Fix obvious grammatical issues in user-facing text you modify.
- Default to autonomous execution: proceed without asking when the answer can be inferred from the issue, the codebase, the project configuration, or prior conversation context.
- Only ask the user when the next step is genuinely ambiguous and the ambiguity cannot be resolved from the available context. State the specific ambiguity that blocks the work.
- Never ask the user to confirm a fact the agent can verify itself (tests passing, fixers clean, branch up-to-date, file exists, etc.) — verify it directly instead.
- Never gate on user approval for work the assignment already authorizes (creating commits, opening PRs, applying review fixes mandated by the calling skill).
- When user input is genuinely required, batch all questions into a single round; do not serialize one question at a time.
Naming
- Use clear, descriptive names that reveal purpose.
- Prefer descriptive method and variable names over comments.
- Classes: PascalCase.
- Methods and variables: camelCase.
- Routes: kebab-case URLs and dot notation route names.
- Config keys: snake_case.
- Controllers: plural noun +
Controller. - Jobs: action-oriented names.
- Events: past-tense or domain-event names.
- Enums: descriptive case names.
Structure
- Keep one clear responsibility per class and per method.
- Avoid god classes and mixed responsibilities.
- Prefer composition over inheritance unless inheritance is clearly justified.
- Expose clear interfaces and keep implementation details internal.
- Extract deeply nested conditionals into well-named methods where it improves readability.
- Prefer small, simple classes or functions unless state is genuinely needed.
- Prefer typed DTOs over raw arrays across important boundaries.
- When a method, function, closure, constructor,
__invoke(), or other callable requires more than 4 parameters, introduce a dedicated typed DTO (preferablyfinal readonlywith promoted constructor properties) and pass it as a single argument instead of a long parameter list. Promoted constructor properties count as parameters; a variadic (...$args) counts as one. The only exempt cases are entry-point signatures fixed by an external framework / vendor contract that the project cannot change — controller actions whose argument list is resolved by the service container, magic methods bound by the framework, event listeners whose signature is dictated by the dispatched event, and methods overriding a parent / interface owned byvendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the parent class / interface and a one-line reason. - When a public method returns a structured set of values — an associative array representing a record, a multi-key payload, or an array shape with named string keys — return a typed DTO (preferably
final readonlywith promoted constructor properties) instead of the raw array. A DTO names and types each field, turning an opaquearrayreturn type into a self-documenting contract the caller can rely on. This does not apply to: a single scalar /bool/string/int/enum/voidreturn; a homogeneous list or collection of one type (list<int>of IDs,array<int, OrderData>,Collection<int, UserModel>); or a return whose array shape is fixed by an external framework / vendor contract the project cannot change —toArray(),jsonSerialize(),Arrayable::toArray(), Eloquentcasts()/$attributes, FormRequestrules(), a config callback the framework invokes, or a method overriding a parent / interface owned byvendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the contract and a one-line reason. - Use
readonlyfor immutable data where practical. - Use PHP attributes when they provide a cleaner and more idiomatic solution than manual wiring.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 142 lines · 4,516 tokens per session scan A fc6105246dd3
core-standards is a cursor rule published in the GitHub repository pekral/cursor-rules (6 stars, last pushed 7d ago), licensed MIT. It adds 4,516 tokens to every session, about $0.0226 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
owl-admin
🎈 Owl Admin : 基于 laravel 和 amis 开发的后台框架, 友好的组件使用体验, 可轻松实现复杂页面, 内置代码生成器, 让开发者快速搭建后台管理系统.
16-wechat-sdk
微信 SDK 接入规范(EasyWeChat / WechatManager).
15-config-center
动态配置中心读取规范(ConfigCenter / configcenter).
lean
Answer densely. Cut filler, keep all technical signal.
00-project
基于 Laravel + Blade + Vue3 + Element Plus 的轻量级后台管理系统.
99-guard
Cursor rule "99-guard" from neoshopcn/neo-admin, covering 🔒 protected directories(禁止修改), ⚠️ conditional(仅在明确要求时允许) and 🚫 dangerous operations(禁止主动执行).