Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/qapla/qapla-api-skill/qapla-apigit clone --depth 1 https://github.com/Qapla/qapla-api-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00112 | $0.00667 |
| Opus 5 | $0.00056 | $0.00333 |
| Sonnet 5 | $0.00022 | $0.00133 |
| Haiku 4.5 | $0.00011 | $0.00067 |
Grade A, and why
qapla-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Qapla' Public API (v1.3)
This rule covers integrating with the public REST API of Qapla', a SaaS platform for e-commerce logistics (multi-carrier shipping, tracking, label printing, transactional notifications).
To work on a Qapla' task:
- Read
references/overview.mdfirst — the canonical orientation: core facts (base URL, auth, response envelope, rate limit, sandbox, versions), the domain model, and the "which endpoint do I need?" decision rule. - Then
references/conventions.mdandreferences/authentication.md— they apply to every call. - Pick the endpoint from
references/endpoints.md(full catalog) or the per-endpoint deep-dives:references/pushshipment.md,pushorder.md,createlabel.md,getquotes.md,getpudos.md,trackingbytimeframe.md(the pull alternative to webhooks),apivirtual.md(virtual courier). For outbound event callbacks (Pillar 2), seereferences/webhooks.md. To interpret tracking statuses, seereferences/statuses.md(branch on the canonical id, never the label). For the version policy and the separate v2 generation, seereferences/versioning.md; to upgrade a legacy integration, seereferences/migration.md. - Use the sample payloads in
references/examples/and the dependency-free reference client inscripts/qapla_client.pywhen writing code. - For the v2 API (Bearer/JWT auth, RESTful resources, async jobs), start at
references/v2/overview.mdand the deep-divesreferences/v2/{authentication,parcels,sandbox,couriers,stock-release,endpoints}.md. Most integrations still target v1.3; use v2 when you need a resource it exposes (e.g. parcels).
Guardrails: documents the public API only — do not invent endpoints, parameters, or fields. The live docs at https://api.qapla.dev/1.3/ are the source of truth; if anything here drifts, trust them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 50 lines · 112 tokens per session scan A 06964da3c6b9
qapla-api is a cursor rule published in the GitHub repository Qapla/qapla-api-skill (3 stars, last pushed 1mo ago), licensed MIT. It adds 112 tokens to every session and 667 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
shopify-theme-builder
Build production-grade Online Store 2.0 Shopify themes (interview-first, 100% theme-editor controllable, token-driven, theme-check clean, bilingual/RTL). Apply when building, generating, scaffolding, or designing a Shopify theme, sections, JSON templates, or Liquid.
formengine
Generate FormEngine-shaped React forms from a screenshot, PDF, HTML, or text description. Use whenever the user asks to build, generate, scaffold, or convert a React form — especially mentioning FormEngine, JSON schema form, signup/login/contact/onboarding/checkout/survey forms, or alternatives to Formik / React Hook…
cursor
You are working on the checkout service. Preserve transaction integrity and auditability.
release-notes
Generate changelog entries and GitHub releases from git history. Categorizes commits into features, fixes, breaking changes, and docs. Supports conventional commits, PR-based grouping, and semantic versioning. Creates formatted CHANGELOG.md entries and GitHub releases.
paddle-integration
Conventions for Paddle integration code.
faststore-faststore-storefront-ref-project-structure-routes-and-config
FastStore project structure, routes, CLI build pipeline, store configuration (discovery.config.js), and naming conventions. Use when understanding how a FastStore project is organized, how the @faststore/cli works, what files to create or modify, how routing works, or how to configure store settings like SEO, API…