Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/tencentcloudcommunity/mcp-server/web-developmentgit clone --depth 1 https://github.com/TencentCloudCommunity/mcp-serverWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00662 |
| Opus 5 | $0.00000 | $0.00331 |
| Sonnet 5 | $0.00000 | $0.00132 |
| Haiku 4.5 | $0.00000 | $0.00066 |
Grade A, and why
web-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Web 前端开发规则
项目结构
- web 项目一般前端源代码存放在 src 目录下，构建后的产物放在 dist 目录下，云函数放在 cloudfunctions 目录下
- 项目尽量使用 vite 等现代前端工程化体系，通过 npm 安装依赖
- 前端项目如何涉及到路由，可以默认用 hash 路由，可以解决路由刷新404的问题，更适合部署到静态网站托管
部署和预览
- 如果是一个前端项目，你可以在构建完毕后使用云开发静态托管，先本地启动预览，然后可以跟用户确认是否需要部署到云开发静态托管，部署的时候，如果用户没有特殊要求，一般不要直接部署到根目录，并返回部署后的地址，需要是一个markdown 的链接格式
- 本地启动预览静态网页可以进到指定的产物目录后，可以用
npx live-server - web 项目部署到静态托管 cdn 上时，由于无法提前预知路径，publicPath 之类的配置应该采用用相对路径而不是绝对路径。这会解决资源加载的问题
CloudBase Web SDK 使用
- 如果用户项目中需要用到数据库，云函数等功能，需要在 web 应用引入 @cloudbase/js-sdk@latest
重要：登录认证必须使用 SDK 内置功能，严禁使用云函数实现登录认证逻辑！
const app = cloudbase.init({
env: 'xxxx-yyy'; // 可以通过 envQuery 工具来查询环境 id
});
const auth = app.auth();
// 检查当前登录状态
let loginState = await auth.getLoginState();
if (loginState && loginState.isLoggedIn) {
// 已登录
const user = await auth.getCurrentUser();
console.log('当前用户:', user);
} else {
// 未登录 - 使用 SDK 内置认证功能
// 方式1：跳转到默认登录页面（推荐）
await auth.toDefaultLoginPage();
// 方式2：匿名登录
// await auth.signInAnonymously();
}
登录认证最佳实践
- 必须使用 SDK 内置认证：CloudBase Web SDK 提供了完整的认证功能，包括默认登录页面、匿名登录、自定义登录等
- 禁止使用云函数实现登录：不要创建云函数来处理登录逻辑，这是错误的方式
- 用户数据管理：登录后可以通过
auth.getCurrentUser()获取用户信息，然后存储到数据库 - 错误处理：所有认证操作都应该包含完整的错误处理逻辑
构建流程
web 构建项目流程：确保首先执行过 npm install 命令，然后参考项目说明进行构建
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 54 lines · 0 tokens per session scan A 2233f12a527b
web-development is a cursor rule published in the GitHub repository TencentCloudCommunity/mcp-server (28 stars, last pushed 1mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 662 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
project
Top-level rules and information for the project.
atelier
Atelier UI/UX and Backend Architecture Quality Gate.
vision-memory-mcp
This project utilizes vision-memory-mcp to cache visual states, record layout transitions, provide element grounding, and avoid repetitive LLM vision calls.
php-transport-implementation
Guidelines for implementing transport layers in PHP MCP SDK.
php-types-validation
Guidelines for type definitions and validation in PHP MCP SDK.
php-server-implementation
Guidelines for implementing MCP servers in PHP.