Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/sandraschi/worldlabs-mcp/cursorrulesgit clone --depth 1 https://github.com/sandraschi/worldlabs-mcpWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00175 | $0.00175 |
| Opus 5 | $0.00088 | $0.00088 |
| Sonnet 5 | $0.00035 | $0.00035 |
| Haiku 4.5 | $0.00017 | $0.00017 |
Grade A, and why
cursorrules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
World Labs MCP - Cursor Rules
You are working with a World Labs MCP server that generates and manages generative 3D worlds, sparks, painting portals, and a world library.
- Use
generate_world_from_text/generate_world_from_imagefor new worlds - Poll
get_operationfor generation status (generations are async) - Use
list_worlds/get_worldfor library queries - Never hardcode API keys; use env vars (WORLDLABS_*)
Session Context (World Labs MCP)
Before starting work:
- Check the world library:
list_worlds(limit=10) - Poll recent generations:
get_operation(operation_id="<latest>")
At end of work:
- Store generated world metadata in the library
- Note generation failures with their operation IDs
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 20 lines · 175 tokens per session scan A 122c86355531
cursorrules is a cursor rule published in the GitHub repository sandraschi/worldlabs-mcp (22 stars, last pushed 4d ago), licensed MIT. It adds 175 tokens to every session, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
architect
Global Architect rules for sandraschi's dev environment (Unity and other integrations, FastMCP, React). See mcp-central-docs integrations.
architect
Global Architect rules for sandraschi's dev environment (Unity, FastMCP, React).
architect
Global Architect rules for sandraschi's dev environment (Unity, FastMCP, React).
08-client-server
IF 判断当前环境是否为客户端 → FabricLoader.getInstance().getEnvironmentType() == EnvType.CLIENT → World.isClient（Yarn 字段；yarn 1.14.4 World.mapping）。不要用 MCP/Forge 的 isRemote.
07-datagen
IF 生成物品/方块模型 JSON → 手动编写 JSON 在 src/main/resources/assets/{modid}/models/.
cursorrules
Robot control server. Do not move the physical robot without checking health first.