Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/realistsec/mpa-first-guidelines/mpa-strict-rulesgit clone --depth 1 https://github.com/RealistSec/mpa-first-guidelinesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03483 | $0.03483 |
| Opus 5 | $0.01741 | $0.01741 |
| Sonnet 5 | $0.00697 | $0.00697 |
| Haiku 4.5 | $0.00348 | $0.00348 |
Grade A, and why
mpa-strict-rules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
return $stmt->fetch(PDO::FETCH_ASSOC); How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Coding Agent Guidelines: The MPA-First Mandate
Introduction: Why We Build This Way
For over a decade, web development has trended towards complex, JavaScript-heavy Single-Page Applications (SPAs). The promise was a slick, "app-like" user experience. The reality, in most cases, has been bloated, fragile, and over-engineered websites that are slow to load, difficult to maintain, and hostile to users and search engines.
This document outlines a return to a more resilient, performant, and durable web. We are intentionally choosing a Multi-Page Application (MPA) architecture. The guiding principle is to use the platform. We build upon the native strengths of HTML, CSS, and the browser itself, which have evolved significantly. Modern features like CSS View Transitions and Speculation Rules now provide the fluid user experience that once required megabytes of JavaScript, but without the performance penalty.
We are choosing simplicity, speed, and maintainability over unnecessary complexity. We build for users and outcomes, not for developer experience (DX) or architectural novelty. JavaScript is a powerful tool for progressive enhancement, not the default foundation for every page.
PRIME DIRECTIVE: MPA-Only Architecture
- You MUST create server-rendered, multi-page websites (MPAs). Each distinct page or view must be its own unique file (e.g.,
.html,.php) served at a distinct URL. - Navigation MUST use standard anchor links (
<a href="...">) that trigger a full page navigation. The browser will handle the request, and the server will respond with a new HTML document. - The goal is to produce sites that are fundamentally functional with zero client-side JavaScript. JS should only be used to enhance, not to enable, core functionality.
🚫 BANNED TECHNOLOGIES & PATTERNS
- DO NOT use or reference any Single-Page Application (SPA) frameworks, libraries, or patterns.
- This includes, but is not limited to: React, Angular, Vue, Svelte, Next.js, Nuxt.js.
- DO NOT use JSX, TSX, TypeScript-based routing, or any form of client-side routing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 397 lines · 3,483 tokens per session scan A ce04e6b23707
mpa-strict-rules is a cursor rule published in the GitHub repository RealistSec/mpa-first-guidelines (10 stars, last pushed 9mo ago), licensed MIT. It adds 3,483 tokens to every session, about $0.0174 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-material-20
This rule provides comprehensive best practices and coding standards for Angular development with Angular Material, focusing on Material 3 (a.k.a. M3) design, theme configuration and various API usages.
webdriver-management
Selenium WebDriver lifecycle management — driver factory, explicit waits, browser options, and teardown.
component-development
Modern React + TypeScript component patterns — hooks, typed props, performance optimization, forms, and testing.
api-testing
Cypress network interception and API testing patterns (cy.intercept, service mocking, request/response validation).
app-router-patterns
Next.js 14+ App Router patterns — Server Components, Client Components, Route Handlers, Server Actions, and metadata API.
page-object-patterns
Page Object Model patterns for Selenium — BasePage, component objects, and fluent interfaces.