Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/pekral/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/pekral/cursor-rules/core-standards)<a href="https://agentmods.dev/rules/pekral/cursor-rules/core-standards"><img src="https://agentmods.dev/badge/rules/pekral/cursor-rules/core-standards/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/pekral/cursor-rules/core-standards"><img src="https://agentmods.dev/badge/rules/pekral/cursor-rules/core-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04516 | $0.04516 |
| Opus 5.5 | $0.01806 | $0.01806 |
| Sonnet 5.5 | $0.00903 | $0.00903 |
| Haiku 4.5 | $0.00452 | $0.00452 |
Grade A, and why
core-standards scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **The codebase's default state is no comments — delete the ones that never earned their place.** The bar above governs the comments you *write*; it governs the ones already sitting in the file exactly as much. Whenever How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Context
- The project tech stack is defined in
composer.json. - Use the PHP version and major package versions defined in
composer.jsonas the source of truth. - Prefer existing project conventions over introducing new patterns.
AI Behavior
- Do not apologize.
- Do not invent changes, files, implementations, or results.
- Preserve existing code and do not remove unrelated logic.
- Verify visible context before proposing changes.
- Do not speculate when the answer can be derived from the repository context.
- Do not ask the user to verify something that is already visible in the provided code or files.
- Do not suggest file changes when no actual modification is needed.
- Fix obvious grammatical issues in user-facing text you modify.
- Default to autonomous execution: proceed without asking when the answer can be inferred from the issue, the codebase, the project configuration, or prior conversation context.
- Only ask the user when the next step is genuinely ambiguous and the ambiguity cannot be resolved from the available context. State the specific ambiguity that blocks the work.
- Never ask the user to confirm a fact the agent can verify itself (tests passing, fixers clean, branch up-to-date, file exists, etc.) — verify it directly instead.
- Never gate on user approval for work the assignment already authorizes (creating commits, opening PRs, applying review fixes mandated by the calling skill).
- When user input is genuinely required, batch all questions into a single round; do not serialize one question at a time.
Naming
- Use clear, descriptive names that reveal purpose.
- Prefer descriptive method and variable names over comments.
- Classes: PascalCase.
- Methods and variables: camelCase.
- Routes: kebab-case URLs and dot notation route names.
- Config keys: snake_case.
- Controllers: plural noun +
Controller. - Jobs: action-oriented names.
- Events: past-tense or domain-event names.
- Enums: descriptive case names.
Structure
- Keep one clear responsibility per class and per method.
- Avoid god classes and mixed responsibilities.
- Prefer composition over inheritance unless inheritance is clearly justified.
- Expose clear interfaces and keep implementation details internal.
- Extract deeply nested conditionals into well-named methods where it improves readability.
- Prefer small, simple classes or functions unless state is genuinely needed.
- Prefer typed DTOs over raw arrays across important boundaries.
- When a method, function, closure, constructor,
__invoke(), or other callable requires more than 4 parameters, introduce a dedicated typed DTO (preferablyfinal readonlywith promoted constructor properties) and pass it as a single argument instead of a long parameter list. Promoted constructor properties count as parameters; a variadic (...$args) counts as one. The only exempt cases are entry-point signatures fixed by an external framework / vendor contract that the project cannot change — controller actions whose argument list is resolved by the service container, magic methods bound by the framework, event listeners whose signature is dictated by the dispatched event, and methods overriding a parent / interface owned byvendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the parent class / interface and a one-line reason. - When a public method returns a structured set of values — an associative array representing a record, a multi-key payload, or an array shape with named string keys — return a typed DTO (preferably
final readonlywith promoted constructor properties) instead of the raw array. A DTO names and types each field, turning an opaquearrayreturn type into a self-documenting contract the caller can rely on. This does not apply to: a single scalar /bool/string/int/enum/voidreturn; a homogeneous list or collection of one type (list<int>of IDs,array<int, OrderData>,Collection<int, UserModel>); or a return whose array shape is fixed by an external framework / vendor contract the project cannot change —toArray(),jsonSerialize(),Arrayable::toArray(), Eloquentcasts()/$attributes, FormRequestrules(), a config callback the framework invokes, or a method overriding a parent / interface owned byvendor/. The exemption must be cited explicitly wherever the rule is enforced (CR finding, refactoring proposal) with the contract and a one-line reason. - Use
readonlyfor immutable data where practical. - Use PHP attributes when they provide a cleaner and more idiomatic solution than manual wiring.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 142 lines · 4,516 tokens per session scan A fc6105246dd3
core-standards is a cursor rule published in the GitHub repository pekral/cursor-rules (11 stars, last pushed 13d ago), licensed MIT. It adds 4,516 tokens to every session, about $0.0181 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
owl-admin
A set of project rules for Owl Admin, a Laravel-based framework for building web administration panels. It guides how the project should use its page renderer, controllers, services, menus, permissions, APIs, and code generator.
php
Rules applied when working in PHP files (incl. Laravel, Symfony, WordPress).
laravel-boost
Cursor rule "laravel-boost" from karuhun-developer/ecommerce, covering laravel boost guidelines, foundational context, conventions, verification scripts and application structure & architecture.
laravel-boost
Cursor rule "laravel-boost" from laravel/locket, covering laravel boost guidelines, foundational context, conventions, verification scripts and application structure & architecture.
php-drupal-best-practices
PHP & Drupal Development Standards and Best Practices.
10-backend
Backend development rules for Laravel Admin applications, including route locations, controller structure, permissions, API responses, and list filtering. Laravel is a PHP framework for building web applications.