Borrowing it
Nothing to install: this file belongs to sandraschi/calibremcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sandraschi/calibremcp/master/.windsurfrulesgit clone --depth 1 https://github.com/sandraschi/calibremcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/sandraschi/calibremcp/windsurfrules)<a href="https://agentmods.dev/rules/sandraschi/calibremcp/windsurfrules"><img src="https://agentmods.dev/badge/rules/sandraschi/calibremcp/windsurfrules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/sandraschi/calibremcp/windsurfrules"><img src="https://agentmods.dev/badge/rules/sandraschi/calibremcp/windsurfrules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00346 | $0.00346 |
| Opus 5.5 | $0.00138 | $0.00138 |
| Sonnet 5.5 | $0.00069 | $0.00069 |
| Haiku 4.5 | $0.00035 | $0.00035 |
Grade A, and why
windsurfrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Central Documentation Rules
Rule #1: Read Central Docs First
BEFORE making any changes or starting work, ALWAYS:
-
Read the Central Documentation README:
- Location:
D:\Dev\repos\mcp-central-docs\README.md - This shows all important documentation "branches" (folder trees)
- Navigate from there to find specific information
- Location:
-
Follow Documentation Branches:
- Central docs are organized by topic (Anthropic ecosystem, Google ecosystem, patterns, projects, etc.)
- Each branch has its own README explaining what's inside
- Use the branch structure to find relevant docs
-
Check for Existing Patterns:
- Look in
docs/patterns/for design patterns - Check
templates/for reusable templates - Review
docs/projects/for similar project examples
- Look in
-
Avoid Duplication:
- Search existing docs before creating new ones
- Update existing docs rather than creating duplicates
- Reference central docs instead of copying content
Session Context (Calibre MCP)
You have access to a Calibre e-book library with 21 portmanteau tools for search, management, export, and RAG.
Before starting work:
- Search your library:
calibre_search(operation="search_books", query="<query>") - Check library health:
calibre_manage(operation="library_health")
At end of work, save findings:
- Use
calibre_exportto save results andcalibre_manageto update metadata - Any books discussed or found should be tagged for future reference
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 40 lines · 346 tokens per session scan A 6d8c24ddb628
windsurfrules is a cursor rule published in the GitHub repository sandraschi/calibremcp (52 stars, last pushed today), licensed MIT. It adds 346 tokens to every session, about $0.0014 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other cursor rules, from other repositories
hatch3r-dynamic-stack-verification
Runtime-evidence gates for stacks with no static type layer (plain-JS Vue, dynamic persistence) — smoke-mount changed components, dormant-collection-read ratchet, runtime smoke evidence on module-boundary changes; a green lint+build+mock-suite proves a layer, not the system.
hatch3r-spec-currency
Spec-currency mandate — any diff changing user-observable behavior covered by a docs/specs/ file updates that spec in the same delivery; staleness definition, review-gate drift finding with a named owner, and a release-readiness sweep.
testing-and-quality
The testcomprehensive.py provides systematic testing of all 31 MCP tools.
hatch3r-migrations
Database migration and schema change patterns — expand-contract, online DDL, backfills, compatibility windows, reversibility, multi-region, tooling.
cursor-asdd
ASDD contribution rules for this repository.
hatch3r-security-patterns
Security patterns including input validation, auth enforcement, and AI/agentic security for the project.