Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Scopeo/draftnrunWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/scopeo/draftnrun/services)<a href="https://agentmods.dev/rules/scopeo/draftnrun/services"><img src="https://agentmods.dev/badge/rules/scopeo/draftnrun/services.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00325 |
| Opus 5 | $0.00000 | $0.00162 |
| Sonnet 5 | $0.00000 | $0.00065 |
| Haiku 4.5 | $0.00000 | $0.00032 |
Grade A, and why
services scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Service Layer Conventions
- Services encapsulate business logic between routers and repositories.
- Services receive a
Sessionfrom the router (viaDepends(get_db)). - Heavy operations: use the Redis run queue (don't block the request).
- External calls (Supabase Edge Functions, Nango, S3): always use
httpx.AsyncClientwith timeouts. - Secrets: encrypted with Fernet before storage, decrypted on read via
ada_backend/utils/encryption.py. - Runtime secret values passed toward the engine should use
SecretStr(pydantic.SecretStr) until an explicit execution boundary requires plaintext. - When passing constructor params to engine factories or placeholder/template resolvers, unwrap secrets explicitly and as late as possible.
- During graph component instantiation, resolve DB-backed factory inputs with the existing builder
Session; do not add nestedget_db_session()calls in factory parameter processors for per-component metadata. - Never log full parameter dicts after
replace_secret_placeholders(); log only parameter names (list(params.keys())). Apply the same rule to structuredextra=logger kwargs. - Prefer UUID-typed identifiers in service-facing schemas and payload models; only stringify UUIDs at API/JSON boundaries.
- Prefer typed schemas/models for service return payloads; avoid untyped
dictreturns when a stable shape exists. - Public callback URLs for provider integrations must be built from explicit settings such as
ADA_URL; do not hardcode production fallbacks. - See
ada_backend/docs/for domain-specific documentation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 21 lines · 0 tokens per session scan A 3bade3d64fbb
services is a cursor rule published in the GitHub repository Scopeo/draftnrun (30 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 325 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other cursor rules, from other repositories
module-state-ownership
Module-state ownership & caches built from hot-reloading settings — How mutable module-scope state is owned here, and what caching anything derived from settings() obliges. Canonical file is .agents/rules/module-state-ownership.md.
performance-optimization
A set of Django performance rules for database queries, caching, background work, and static files. Django is a Python web framework.
job-queue
Job queue patterns — use when editing queue package or adding background tasks.
using-archipy-adapters
Using and writing adapters in ArchiPy apps — extras, ports, mocks, boundary errors.
redis_rate_limiting
Complete guide for implementing Redis-based rate limiting with authentication troubleshooting and FastAPI integration.
nestjs-6-database-performance
USE WHEN working with databases, implementing repositories, optimizing queries, caching, or performance tuning.