Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/perniemann/pncore/pn-nextjsgit clone --depth 1 https://github.com/perniemann/pnCoreWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/perniemann/pncore/pn-nextjs)<a href="https://agentmods.dev/rules/perniemann/pncore/pn-nextjs"><img src="https://agentmods.dev/badge/rules/perniemann/pncore/pn-nextjs.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01049 |
| Opus 5 | $0.00000 | $0.00524 |
| Sonnet 5 | $0.00000 | $0.00210 |
| Haiku 4.5 | $0.00000 | $0.00105 |
Grade A, and why
pn-nextjs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 66 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Next.js best practices
Server vs Client Components
- Server components by default. Every component in the
app/directory is a Server Component unless it has"use client"at the top. "use client"only when needed: interactivity (useState,useEffect), browser APIs (window,document), event listeners, or third-party client-side libraries.- Keep
"use client"as deep in the tree as possible — push it to leaf components. A parent Server Component can pass Server data as props to a Client Component child. - Never import a Server Component into a Client Component. Pass Server-rendered content as
childrenor other props instead.
Data Loading
- No request waterfalls: Parallel-fetch independent data with
Promise.all()in server components. Don't await one then the other if they're independent. - Colocate data fetching: Fetch data in the Server Component that needs it — don't fetch in a parent and prop-drill, because Server Components don't cause re-renders.
cache()for deduplication: In Server Components,cache()deduplicates identical requests within a single render pass.- Streaming with Suspense: Wrap slow-loading sections in
<Suspense fallback={<Skeleton />}>to stream content progressively rather than blocking the whole page.
Loading, Error, and Not-Found States
- Colocate
loading.tsxwith every async route segment — it creates an automatic Suspense boundary and shows a skeleton during navigation. - Colocate
error.tsxwith routes that may throw — it must be a Client Component ("use client"); use it to show a recovery UI. not-found.tsxfor 404 states; callnotFound()from server components when a resource doesn't exist.- Never leave an async route without a
loading.tsx— users see a blank screen on navigation otherwise.
Server Actions and Mutations
- After a Server Action mutation, call
revalidatePath('/path')orrevalidateTag('tag')so cached data is updated and the UI reflects the change. - Use
useActionState(React 19 / Next 15) to track loading and error state for Server Actions. - Validate inputs server-side in every Server Action — never trust client data.
- Return structured errors from Server Actions instead of throwing, so the UI can display them inline.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 66 lines · 0 tokens per session scan A a343ec1d5061
pn-nextjs is a cursor rule published in the GitHub repository perniemann/pnCore (0 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,049 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
lean-ctx-session-metrics
Shows lean-ctx (MCP) token metrics for this session at the end of each reply.
pytest-integration-tests
Below is an example test. Notice the following.
python-app
Cursor rule "python-app" from iloveitaly/llm-ide-rules, covering python app, factories and database & orm.
netllm
Route netllm install, editor connect, swarm, troubleshoot, PR/release, and macOS CI requests to project skills and docs.
justfiles
Justfiles.
mcp-tools-readme
Keep README in sync when MCP tools change.