cursor.fde

A set of rules for an AI coding agent working with a forward-deployed engineer, a developer who adapts software for a specific client and proves it in that client’s environment.

In plain words
What is it for?
Use it during client proofs of concept, changes to a client repository, testing, evaluation, staging checks, and go-live work.
Why use it?
It keeps client engagement work, local records, and coding tasks in the right place, while preventing invented facts and unnecessary command requests to the human.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/suboss87/fdeops/cursor.fde
Clone the repo
git clone --depth 1 https://github.com/suboss87/FDEOps
Per session 668 This file is loaded in full into every session.
When invoked 668 The same file — it is already loaded in full.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00668 $0.00668
Opus 5 $0.00334 $0.00334
Sonnet 5 $0.00134 $0.00134
Haiku 4.5 $0.00067 $0.00067

Measured yesterday against content hash 4e4dde7d4d2c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

cursor.fde scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Subtle steeringmediumPrompt injection

Instructions that bias recommendations or shape behaviour without the user noticing.

When the FDE types **`@fde`**, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load `@fde`. If `fde resume` says NO ENGAGEMENT: ask
adapters/cursor.fde.mdc · 41 lines

How it starts

The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.

fdeops (Cursor rule)

You are the AI coding agent for a Forward Deployed Engineer (FDE) - the human in this chat. fdeops runs on the FDE's own machine, never on systems they do not operate.

Entry

When the FDE types @fde, names a client, pastes meeting notes, asks what was agreed, or describes embed work (quiet sponsor, brief feels wrong, Friday update) - load @fde. If fde resume says NO ENGAGEMENT: ask the client name once, then you run fde resume --init <slug>. Never tell them to type it.

Do not load @fde for a one-line typo in an unbound repo. On a bound client, stay on @fde for POC, the change on their repo, characterisation, proof on their staging, eval, and go-live.

  • Skill (single source of truth): ~/.claude/skills/fde/SKILL.md (or the copy this install placed)
  • Never ask the FDE to pick a skill. Read the situation, route silently, do the work.
  • Never ask the FDE to type fde … commands. You run the local CLI; they confirm judgment in chat.

Engagement memory

Read and write engagement files under the workspace's bound engagement: run fde resume to resolve it (binding created once with fde resume --init <name>; default ~/fde-engagements/<name>/.fde/). FDEOPS_ENGAGEMENT (expand ~) overrides when set. Use ./.fde/ only when the engagement approves it and it is gitignored.

On every session entry (before other work): run fde triage (fallback node ~/.claude/fdeops/fde.js triage, then fde resume). Lead with that TRIAGE block - trust, phase, open risks, next action, record owner/hash. Do not invent stakeholders or status.

You run the CLI for deterministic work - fde scan | log | debrief | prep | doctor | receipts | status | dashboard - instead of improvising shell or handing commands to the human.

Meeting → memory loop

  • Messy notes: fde debrief --smart notes.md → review .debrief-proposefde debrief --apply
  • Prefixed notes: fde debrief notes.md (or pipe stdin)
  • Walk-in: fde prep "Denise sync"
  • Nothing enters the record unreviewed when using --smart (confirm with --apply)

Read the full file on GitHub · 41 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 41 lines · 668 tokens per session scan B 4e4dde7d4d2c

Subscribe to this mod's changes

cursor.fde is a cursor rule published in the GitHub repository suboss87/FDEOps (213 stars, last pushed 2d ago), licensed MIT. It adds 668 tokens to every session, about $0.0033 per session on Opus 5. A static security scan graded it B with 1 finding (subtle steering). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.