Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/TheNickSanchez/passkey-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/thenicksanchez/passkey-mcp/agent-routing)<a href="https://agentmods.dev/rules/thenicksanchez/passkey-mcp/agent-routing"><img src="https://agentmods.dev/badge/rules/thenicksanchez/passkey-mcp/agent-routing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/thenicksanchez/passkey-mcp/agent-routing"><img src="https://agentmods.dev/badge/rules/thenicksanchez/passkey-mcp/agent-routing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00577 | $0.00577 |
| Opus 5 | $0.00289 | $0.00289 |
| Sonnet 5 | $0.00115 | $0.00115 |
| Haiku 4.5 | $0.00058 | $0.00058 |
Grade A, and why
agent-routing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Agent routing
Same four specialists in .cursor/agents/. Do not add a fifth. Do not
rebuild. Invocation is the constraint.
| Agent | When |
|---|---|
sys-arch |
PLAN.md names a design fork (two valid product/security/deploy choices). PLAN.md only. Skip table refreshes and mechanical docs/CI/tests. |
sys-engineer |
Implement and test. uv only. Mock auth. Read PLAN.md; do not invent architecture. |
sys-release |
Every PR: classify patch/minor/major, promote the previous Unreleased heading, bump version files + uv.lock. |
sys-review |
Read-only merge lint. Block if changelog/version missing or claimed files are untracked. Nits do not restart the loop. |
Parent Auto is the PM (not a fifth specialist)
This chat discusses results with Nick. Do not Task a sys-pm. See
.cursor/rules/parent-pm.mdc.
Task prompt: branch, PLAN section id (e.g. D2-1), stop-before-commit yes/no.
Do not paste locked copy, file-by-file edits, or a second PLAN.md.
Do not implement in this chat when the loop is running, except the nit path.
PR loop
sys-archonly if a design fork exists → 2.sys-engineer→sys-release→ 4.sys-review→ 5. commit /gh pr createonly if Nick asks.
Nits (prose, PLAN current-state, optional tests): engineer patches (parent
may, if Nick asked). Re-run pytest only if passkey/ or tests/ changed.
Do not re-invoke arch/release/review unless Critical (changelog/version,
security boundary, claimed-but-untracked files).
A hook denies git push / gh pr create when CHANGELOG.md is unchanged vs
main. Until 1.0: patch = fix/docs/tests/CI; minor = feature or 0.x
breaking; major = 1.0.0 only. First tag is 0.4.0; before that bump 0.3.x.
PLAN.md current-state describes main, not a dirty branch. Do not invent
CI green, PyPI, or 1.0. Nick is the merge reviewer; sys-review is lint.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 43 lines · 577 tokens per session scan A 94e69a3e6b2e
agent-routing is a cursor rule published in the GitHub repository TheNickSanchez/passkey-mcp (0 stars, last pushed today), licensed MIT. It adds 577 tokens to every session, about $0.0029 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-13.
Other cursor rules, from other repositories
08-github-workflow-standards
GitHub issue/PR/milestone standards for Matryca Plumber (OSS maintainer rigor).
iris
GitHub operations specialist — branches, pull requests, issues, releases, tags. Called by zeus after review. Never pushes or merges without explicit human approval. Integrates with VS Code GitHub Pull Requests extension.
version-and-issues
Version & issue tracking — every change gets a SemVer class, an issue with the matching type: label, a major/minor milestone, and a card on the configured project board (project.config.yaml).
work-item-agent
Work Item — finds and validates Azure DevOps work items for a release by change request or tag.
github-repo-triage
Triage and maintain GitHub repos — issues, PRs, cherry-picks, releases, publishing.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.