Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/vibestackdev/vibe-stackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/vibestackdev/vibe-stack/project-context)<a href="https://agentmods.dev/rules/vibestackdev/vibe-stack/project-context"><img src="https://agentmods.dev/badge/rules/vibestackdev/vibe-stack/project-context/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/vibestackdev/vibe-stack/project-context"><img src="https://agentmods.dev/badge/rules/vibestackdev/vibe-stack/project-context.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00508 | $0.00508 |
| Opus 5.5 | $0.00203 | $0.00203 |
| Sonnet 5.5 | $0.00102 | $0.00102 |
| Haiku 4.5 | $0.00051 | $0.00051 |
Grade A, and why
project-context scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Vibe Stack — Project Context
Tech Stack
- Framework: Next.js 15 (App Router) with React 19
- Language: TypeScript (strict mode)
- Styling: Tailwind CSS + shadcn/ui components
- Database: Supabase (PostgreSQL + RLS)
- Auth: Supabase SSR (cookie-based, @supabase/ssr)
- Validation: Zod
- Payments: Stripe (server-side only)
- Email: Resend
- Icons: lucide-react
Architecture Rules
- Default to Server Components. Only add 'use client' when the component needs interactivity.
- Push 'use client' to the smallest leaf component possible.
- All data fetching happens in Server Components or Server Actions.
- All mutations happen via Server Actions, never client-side fetch().
- All external input MUST be validated with Zod schemas.
- Never use getSession() on the server — always use getUser().
- All database tables MUST have Row Level Security (RLS) enabled.
Folder Structure
src/
├── app/ # Next.js App Router pages & layouts
│ ├── (auth)/ # Auth route group (login, signup)
│ ├── dashboard/ # Protected pages (behind middleware)
│ └── api/ # Route handlers (webhooks, public APIs)
├── components/ # Reusable React components
│ ├── ui/ # shadcn/ui primitives
│ └── [feature]/ # Feature-specific components
├── lib/ # Utilities & third-party configs
│ ├── supabase/ # Supabase client factories
│ ├── stripe/ # Stripe helpers (server-only)
│ └── utils.ts # General utilities (cn helper)
└── types/ # Shared TypeScript types
Naming Conventions
- Files: kebab-case (e.g.,
user-profile.tsx) - Components: PascalCase (e.g.,
UserProfile) - Server Actions: camelCase verbs (e.g.,
createTodo,updateProfile) - Types/Interfaces: PascalCase with
interfacepreferred overtype - Database tables: snake_case (e.g.,
user_profiles)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 51 lines · 508 tokens per session scan A c975a5e110a2
project-context is a cursor rule published in the GitHub repository vibestackdev/vibe-stack (8 stars, last pushed yesterday), licensed MIT. It adds 508 tokens to every session, about $0.0020 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
components
React component, styling, theme, accessibility, and RTL instructions.
vibe-tools
Global Rule. This rule should ALWAYS be loaded.
multi-zone-architecture
Multi-zone architecture allows Shipkit applications to be split into multiple Next.js applications while appearing as a single domain to users. This pattern is ideal for.
database-patterns
Use the createTable function with consistent naming.
documentation-system
The Shipkit documentation system uses dynamic file-based loading from the /docs directory at the project root. It supports both .mdx and .md files with full production-ready security features.
local-storage-patterns
Shipkit uses browser local storage as a fallback when no database is configured. This provides a zero-config development experience while maintaining feature parity with database mode.