A set of coding rules for FastAPI, a Python framework for building web APIs, and Pydantic, the library commonly used to define and validate API data.

Use it when creating or reviewing FastAPI routes, request and response models, dependencies, error handling, tests, and generated API documentation.

It helps avoid inconsistent request handling, unclear responses, weak error reporting, and common mistakes in asynchronous API code.

fastapi — Cursor rule by sordi-ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add rules/sordi-ai/skill-everything/fastapi

Clone the repo

git clone --depth 1 https://github.com/sordi-ai/skill-everything

Made for: Cursor.

Per session 32 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 802 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00032	$0.00802
Opus 5	$0.00016	$0.00401
Sonnet 5	$0.00006	$0.00160
Haiku 4.5	$0.00003	$0.00080

Measured 2d ago against content hash 292a23f02c26, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

fastapi scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/fastapi.mdc · 56 lines

How it starts

The opening of the file, as written. The whole thing — 56 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Sub-Skill: FastAPI

Purpose: Prevent common FastAPI and Pydantic mistakes. Apply these rules whenever writing or reviewing FastAPI route handlers, Pydantic schemas, or async API code.

Rules

Always declare request and response bodies as Pydantic models — never use raw dict or Any for I/O. Reference: ERR-2026-025
Always use Pydantic v2 syntax (model_config, model_dump, model_validate) unless the project explicitly pins Pydantic v1 (pydantic<2 in requirements). Reference: ERR-2026-025
Always declare route handlers as async def unless the handler calls blocking I/O that cannot be awaited; use run_in_executor for blocking calls inside async handlers.
Always specify an explicit response_model on every route decorator so FastAPI filters and validates the response shape.
Always use status_code on the route decorator (@app.post("/items", status_code=201)) rather than constructing a Response object just to set the status.
Never raise bare Exception in route handlers; raise HTTPException with a meaningful status_code and detail string, or define a custom exception with an exception handler.
Always register exception handlers via @app.exception_handler(MyError) for domain errors rather than catching them inside every route.
Use Depends() for shared logic (auth, DB sessions, pagination params) — never duplicate the same logic across multiple route functions.
Prefer APIRouter with a prefix and tags list to group related endpoints; register routers with app.include_router() rather than defining all routes on the app object.
Always configure CORS via CORSMiddleware with an explicit allow_origins list; never use allow_origins=["*"] in production.
Use the lifespan context manager (FastAPI ≥ 0.93) for startup/shutdown logic instead of the deprecated @app.on_event("startup") / @app.on_event("shutdown") decorators.
Always use BackgroundTasks (injected via Depends or as a route parameter) for fire-and-forget work; never asyncio.create_task inside a route without a lifecycle guard.

Read the full file on GitHub · 56 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 56 lines · 32 tokens per session scan A 292a23f02c26

Subscribe to this mod's changes

fastapi is a cursor rule published in the GitHub repository sordi-ai/skill-everything (19 stars, last pushed 3mo ago), licensed MIT. It adds 32 tokens to every session and 802 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIs Languages Python agent-memory agents-md ai-skills anthropic claude-code claude-skills

fastapi

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

Sub-Skill: FastAPI

Rules

What this file has done since we first saw it

Other cursor rules, from other repositories

python-tools

cursorrules

python-core

python-testing

00-stack

20-testing