auto_verification_rules

A set of coding rules that requires analysis and user confirmation before code changes, followed by verification and quality checks.

In plain words
What is it for?
It guides dependency analysis, business-logic review, design, user approval, coding, full verification, quality assurance, and later iteration.
Why use it?
It reduces unplanned edits and makes the proposed solution, affected areas, risks, and execution plan clear before implementation begins.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/redleaves/context-keeper/auto_verification_rules
Clone the repo
git clone --depth 1 https://github.com/redleaves/context-keeper

Made for: Cursor.

Per session 2,497 This file is loaded in full into every session.
When invoked 2,497 The same file — it is already loaded in full.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02497 $0.02497
Opus 5 $0.01248 $0.01248
Sonnet 5 $0.00499 $0.00499
Haiku 4.5 $0.00250 $0.00250

Measured yesterday against content hash 58595d80ec4a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

auto_verification_rules scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl http://localhost:8088/health
.cursor/rules/auto_verification_rules.mdc · 303 lines

How it starts

The opening of the file, as written. The whole thing — 303 lines — stays where its author put it; the contents beside it link to each section on GitHub.

🧠 高效编程执行规则 - Context-Keeper

🎯 编程执行金字塔原则(执行编码之前一定要用户确认!!!)

                      🔧 执行编码
                     /            \
                ✅ 用户确认      🧪 完整验证
               /                            \
          📋 详细设计                    📊 质量保障
         /                                        \
    🤔 理清思路                            🚀 高效迭代
   /                                              \
🗂️ 业务逻辑链路                        
/                                                
📈 依赖关系分析                          

正确的执行顺序:

📈 依赖关系分析 → 🗂️ 业务逻辑链路 → 🤔 理清思路 → 📋 详细设计 
→ ✅ 用户确认 → 🔧 执行编码 → 🧪 完整验证 → 📊 质量保障 → 🚀 高效迭代

🌟 核心原则 - MANDATORY

  1. 🧠 思考先行 - THINK FIRST, CODE LATER

    • 任何编码前必须完整理清思路
    • 分析业务逻辑链路、依赖关系、层次脉络
    • 一次性设计完整,避免反复修改删除
  2. 🤝 用户确认 - USER AUTHORIZATION REQUIRED

    • 关键时机:详细设计完成后,执行编码前(必须!)
    • 确认内容:技术方案、修改范围、风险评估、执行计划
    • 沟通原则:用户反馈问题时先定位分析,达成一致得到用户授权后再编码
    • 严禁行为:未经用户授权直接修改任何代码或配置
  3. 🎯 质量优先 - QUALITY & EFFICIENCY

    • 完整验证流程确保代码质量
    • 避免编译错误导致的冲动乱改
    • 系统性思考,通篇考虑,精准修改

🔄 高效编程执行流程 - 5阶段法

🧩 阶段1:问题分析与思路梳理 - ANALYSIS PHASE

🔍 当用户提出问题/需求时,必须先完成:

  1. 问题定位分析

    📌 具体问题是什么?
    📌 涉及哪些代码模块?
    📌 影响范围有多大?
    📌 根本原因是什么?
    
  2. 依赖关系梳理

    🔗 上游依赖:哪些模块会影响当前问题?
    🔗 下游影响:修改会影响哪些功能?
    🔗 横向关联:同层级有哪些相关组件?
    🔗 配置依赖:需要哪些配置支持?
    
  3. 业务逻辑链路分析

    ➡️ 数据流向:从输入到输出的完整路径
    ➡️ 调用链路:函数/服务间的调用关系
    ➡️ 状态变化:系统状态如何流转
    ➡️ 错误处理:异常情况的处理路径
    

📋 阶段2:详细设计方案 - DESIGN PHASE

🎨 输出完整的技术设计方案:

  1. 修改范围说明

    📁 涉及文件:明确列出所有需要修改的文件
    🔧 修改类型:新增/修改/删除/重构
    ⏱️ 预估工作量:每个修改点的复杂度评估
    
  2. 技术实现方案

    🏗️ 架构调整:如何调整现有架构
    💡 算法逻辑:核心算法的详细描述
    🔌 接口设计:API/接口的变更说明
    📊 数据结构:数据模型的变化
    
  3. 风险评估

    ⚠️ 潜在风险:可能出现的问题
    🛡️ 风险缓解:如何避免/处理风险
    🔄 回滚方案:出现问题时的回退策略
    

阶段3:用户确认授权 - AUTHORIZATION PHASE

🤝 用户确认检查清单:

□ 问题分析是否准确?
□ 技术方案是否合理?
□ 修改范围是否可接受?
□ 是否有更好的替代方案?
□ 风险评估是否充分?
□ 是否授权开始编码?

Read the full file on GitHub · 303 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 303 lines · 2,497 tokens per session scan A 58595d80ec4a

Subscribe to this mod's changes

auto_verification_rules is a cursor rule published in the GitHub repository redleaves/context-keeper (153 stars, last pushed 7mo ago), licensed MIT. It adds 2,497 tokens to every session, about $0.0125 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.