Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/vibestackdev/vibe-stack/project-contextgit clone --depth 1 https://github.com/vibestackdev/vibe-stackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00508 | $0.00508 |
| Opus 5 | $0.00254 | $0.00254 |
| Sonnet 5 | $0.00102 | $0.00102 |
| Haiku 4.5 | $0.00051 | $0.00051 |
Grade A, and why
project-context scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Vibe Stack — Project Context
Tech Stack
- Framework: Next.js 15 (App Router) with React 19
- Language: TypeScript (strict mode)
- Styling: Tailwind CSS + shadcn/ui components
- Database: Supabase (PostgreSQL + RLS)
- Auth: Supabase SSR (cookie-based, @supabase/ssr)
- Validation: Zod
- Payments: Stripe (server-side only)
- Email: Resend
- Icons: lucide-react
Architecture Rules
- Default to Server Components. Only add 'use client' when the component needs interactivity.
- Push 'use client' to the smallest leaf component possible.
- All data fetching happens in Server Components or Server Actions.
- All mutations happen via Server Actions, never client-side fetch().
- All external input MUST be validated with Zod schemas.
- Never use getSession() on the server — always use getUser().
- All database tables MUST have Row Level Security (RLS) enabled.
Folder Structure
src/
├── app/ # Next.js App Router pages & layouts
│ ├── (auth)/ # Auth route group (login, signup)
│ ├── dashboard/ # Protected pages (behind middleware)
│ └── api/ # Route handlers (webhooks, public APIs)
├── components/ # Reusable React components
│ ├── ui/ # shadcn/ui primitives
│ └── [feature]/ # Feature-specific components
├── lib/ # Utilities & third-party configs
│ ├── supabase/ # Supabase client factories
│ ├── stripe/ # Stripe helpers (server-only)
│ └── utils.ts # General utilities (cn helper)
└── types/ # Shared TypeScript types
Naming Conventions
- Files: kebab-case (e.g.,
user-profile.tsx) - Components: PascalCase (e.g.,
UserProfile) - Server Actions: camelCase verbs (e.g.,
createTodo,updateProfile) - Types/Interfaces: PascalCase with
interfacepreferred overtype - Database tables: snake_case (e.g.,
user_profiles)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 51 lines · 508 tokens per session scan A c975a5e110a2
project-context is a cursor rule published in the GitHub repository vibestackdev/vibe-stack (7 stars, last pushed 2d ago), licensed MIT. It adds 508 tokens to every session, about $0.0025 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
cursor
SEO audit and implementation for Next.js, Remix, and React SPAs. Auto-attached to page, layout, and route files. Covers meta tags, Open Graph, Twitter cards, JSON-LD, sitemaps, robots.txt, i18n/hreflang, and image SEO.
diagnose
name: Issue Re-Diagnosis and Fix Template description: Template for AI to re-diagnose and fix issues that weren't resolved previously. globs.
always-on
Cursor rule "always-on" from jjcall/vibeship-boilerplate, covering core persona, how you work in this project, how you verify and validate, when you should ask for feedback or approval and how you communicate.
request
name: Issue Re-Diagnosis and Fix Template description: Template for AI to re-diagnose and fix issues that weren't resolved previously. globs.
upgrade-tests
// ✅ CORRECT: Upgrade package pattern await using ctx = testReactResource(appRouter, { server: { // server configuration }, client(opts) { return { links: [ httpLink({ url: opts.httpUrl, // client configuration }), ], }; }, }).
react-query-tests
// ✅ CORRECT: Legacy React Query pattern const ctx = konn() .beforeEach(() => createAppRouter()) .afterEach((ctx) => ctx?.close?.()) .done().