Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/raydestar/sir-thaddeus/sir-thaddeus-rulesgit clone --depth 1 https://github.com/raydeStar/sir-thaddeusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/raydestar/sir-thaddeus/sir-thaddeus-rules)<a href="https://agentmods.dev/rules/raydestar/sir-thaddeus/sir-thaddeus-rules"><img src="https://agentmods.dev/badge/rules/raydestar/sir-thaddeus/sir-thaddeus-rules.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01927 | $0.01927 |
| Opus 5 | $0.00963 | $0.00963 |
| Sonnet 5 | $0.00385 | $0.00385 |
| Haiku 4.5 | $0.00193 | $0.00193 |
Grade D, and why
sir-thaddeus-rules scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
> **How Cursor should behave:** When a change request violates (or risks violating) these guardrails, **do not refuse**. Instead, **pause and push back** with a short check-in: Unrestricted tool accessmediumExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
* Prefer structured tools over “execute arbitrary command.” How it starts
The opening of the file, as written. The whole thing — 302 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cursor Rules — Sir Thaddeus (Local‑First Copilot Guardrails)
Purpose: Keep the project from drifting into “something else” as velocity increases.
How Cursor should behave: When a change request violates (or risks violating) these guardrails, do not refuse. Instead, pause and push back with a short check-in:
Pushback template: “Are you sure? You asked me to push back when we drift. This change touches: [Invariant(s)]. If we proceed, we should do it by: [safe alternative].”
0) North Star
Sir Thaddeus is a local‑first, explicit‑permission copilot runtime.
- Runs on the user’s machine (Windows).
- Desktop UI is optional (tray/headless is first‑class).
- LLM is local (LM Studio / OpenAI‑compatible server).
- Tools execute through a strict boundary (MCP stdio tool server).
- Audit log is always on.
If a feature makes it feel like a cloud agent, a spyware assistant, or an auto‑executing bot — it’s drift.
1) Design Invariants (Non‑Negotiables)
I1 — Agent has no authority
The agent may request, route, and summarize, but it does not decide policy.
- No “confidence-based” auto-approval.
- No hidden escalations.
- No silent capability expansion.
Cursor pushback when: agent logic becomes a policy engine (permissions, trust scores, “smart” auto behavior).
I2 — Tools are behind a trust boundary (MCP)
All side effects occur through MCP tools in a separate process.
- No “direct calls” to system APIs from the agent loop for convenience.
- No bypassing MCP just because it’s local.
Cursor pushback when: code adds new side effects outside MCP.
I3 — Explicit permission for side effects
Any action that changes the system, files, network state, or reveals sensitive data must be explicitly permitted.
- Default stance: deny until approved.
- Denial must be explicit and logged.
Cursor pushback when: someone suggests “just do it” or “auto-run” behaviors.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 302 lines · 1,927 tokens per session scan D 78388aab8e38
sir-thaddeus-rules is a cursor rule published in the GitHub repository raydeStar/sir-thaddeus (13 stars, last pushed 5d ago), licensed Apache-2.0. It adds 1,927 tokens to every session, about $0.0096 per session on Opus 5. A static security scan graded it D with 2 findings (tells the agent never to refuse, unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
honcho_rules
Honcho persistent memory — capture every conversation, recall past context, and build a growing model of the user. Activates on every conversation.
netllm
Route netllm install, editor connect, swarm, troubleshoot, PR/release, and macOS CI requests to project skills and docs.
cursorrules
When the user asks about social media, use social-media-ai-mcp tools: schedulepost, generatehashtags, analyzeengagement, plancontentcalendar, getaudienceinsights.
swift-development
Swift development: SwiftUI, Combine, async/await, iOS patterns, and Apple platform conventions.
cursorrules
This is an MCP (Model Context Protocol) server that provides Notion integration tools and AI agent workflows. Built with TypeScript, using the MCP SDK for server implementation.
lighter-safety
Safety contract for the Lighter MCP server. Apply whenever a lighter tool is invoked.