Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/RealistSec/mpa-first-guidelinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/realistsec/mpa-first-guidelines/mpa-strict-rules)<a href="https://agentmods.dev/rules/realistsec/mpa-first-guidelines/mpa-strict-rules"><img src="https://agentmods.dev/badge/rules/realistsec/mpa-first-guidelines/mpa-strict-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/realistsec/mpa-first-guidelines/mpa-strict-rules"><img src="https://agentmods.dev/badge/rules/realistsec/mpa-first-guidelines/mpa-strict-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03483 | $0.03483 |
| Opus 5.5 | $0.01393 | $0.01393 |
| Sonnet 5.5 | $0.00697 | $0.00697 |
| Haiku 4.5 | $0.00348 | $0.00348 |
Grade A, and why
mpa-strict-rules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
return $stmt->fetch(PDO::FETCH_ASSOC); How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Coding Agent Guidelines: The MPA-First Mandate
Introduction: Why We Build This Way
For over a decade, web development has trended towards complex, JavaScript-heavy Single-Page Applications (SPAs). The promise was a slick, "app-like" user experience. The reality, in most cases, has been bloated, fragile, and over-engineered websites that are slow to load, difficult to maintain, and hostile to users and search engines.
This document outlines a return to a more resilient, performant, and durable web. We are intentionally choosing a Multi-Page Application (MPA) architecture. The guiding principle is to use the platform. We build upon the native strengths of HTML, CSS, and the browser itself, which have evolved significantly. Modern features like CSS View Transitions and Speculation Rules now provide the fluid user experience that once required megabytes of JavaScript, but without the performance penalty.
We are choosing simplicity, speed, and maintainability over unnecessary complexity. We build for users and outcomes, not for developer experience (DX) or architectural novelty. JavaScript is a powerful tool for progressive enhancement, not the default foundation for every page.
PRIME DIRECTIVE: MPA-Only Architecture
- You MUST create server-rendered, multi-page websites (MPAs). Each distinct page or view must be its own unique file (e.g.,
.html,.php) served at a distinct URL. - Navigation MUST use standard anchor links (
<a href="...">) that trigger a full page navigation. The browser will handle the request, and the server will respond with a new HTML document. - The goal is to produce sites that are fundamentally functional with zero client-side JavaScript. JS should only be used to enhance, not to enable, core functionality.
🚫 BANNED TECHNOLOGIES & PATTERNS
- DO NOT use or reference any Single-Page Application (SPA) frameworks, libraries, or patterns.
- This includes, but is not limited to: React, Angular, Vue, Svelte, Next.js, Nuxt.js.
- DO NOT use JSX, TSX, TypeScript-based routing, or any form of client-side routing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 397 lines · 3,483 tokens per session scan A ce04e6b23707
mpa-strict-rules is a cursor rule published in the GitHub repository RealistSec/mpa-first-guidelines (11 stars, last pushed 10mo ago), licensed MIT. It adds 3,483 tokens to every session, about $0.0139 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
angular-material-20
This rule provides comprehensive best practices and coding standards for Angular development with Angular Material, focusing on Material 3 (a.k.a. M3) design, theme configuration and various API usages.
align-grid
Build editorial/magazine/report webpages on a GENUINE Müller-Brockmann modular grid (International Typographic Style) — not a decorative one. Encodes the discipline (columns + modules + baseline, grotesque type, flush-left, restrained black/white/red palette) AND the hard-won front-end engineering to make the grid…
standard-front-end-ui-and-design-systems
This standard establishes guidelines for using Chakra UI v3 through the @packmind/ui design system to ensure consistent UI implementation across the frontend application. The @packmind/ui package prov... .
webdriver-management
Selenium WebDriver lifecycle management — driver factory, explicit waits, browser options, and teardown.
api-testing
Cypress network interception and API testing patterns (cy.intercept, service mocking, request/response validation).
component-development
Modern React + TypeScript component patterns — hooks, typed props, performance optimization, forms, and testing.