Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/WellApp-ai/WellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/wellapp-ai/well/nestjs-api)<a href="https://agentmods.dev/rules/wellapp-ai/well/nestjs-api"><img src="https://agentmods.dev/badge/rules/wellapp-ai/well/nestjs-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/wellapp-ai/well/nestjs-api"><img src="https://agentmods.dev/badge/rules/wellapp-ai/well/nestjs-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00506 | $0.00506 |
| Opus 5.5 | $0.00202 | $0.00202 |
| Sonnet 5.5 | $0.00101 | $0.00101 |
| Haiku 4.5 | $0.00051 | $0.00051 |
Grade A, and why
nestjs-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
API Rules (NestJS)
Template for NestJS backend projects.
Module Structure
src/
├── modules/
│ ├── auth/
│ │ ├── auth.controller.ts
│ │ ├── auth.service.ts
│ │ ├── auth.module.ts
│ │ └── dto/
│ └── users/
│ ├── users.controller.ts
│ ├── users.service.ts
│ ├── users.module.ts
│ ├── entities/
│ └── dto/
├── common/
│ ├── decorators/
│ ├── guards/
│ ├── interceptors/
│ └── pipes/
└── config/
Patterns
Controllers
@Controller('users')
export class UsersController {
constructor(private readonly usersService: UsersService) {}
@Get()
findAll(): Promise<User[]> {
return this.usersService.findAll();
}
@Post()
@UsePipes(ValidationPipe)
create(@Body() dto: CreateUserDto): Promise<User> {
return this.usersService.create(dto);
}
}
DTOs with Validation
import { IsEmail, IsString, MinLength } from 'class-validator';
export class CreateUserDto {
@IsEmail()
email: string;
@IsString()
@MinLength(8)
password: string;
}
Services
@Injectable()
export class UsersService {
constructor(
@InjectRepository(User)
private readonly userRepository: Repository<User>,
) {}
async findAll(): Promise<User[]> {
return this.userRepository.find();
}
}
Database
- TypeORM for PostgreSQL/MySQL
- Prisma as alternative
- Migrations in
src/database/migrations/
Error Handling
// Use built-in HTTP exceptions
throw new NotFoundException('User not found');
throw new BadRequestException('Invalid input');
throw new UnauthorizedException('Not authenticated');
Testing
npm run test # Unit tests
npm run test:e2e # E2E tests
Commands
npm run start:dev # Development
npm run build # Production build
npm run migration:run # Run migrations
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 111 lines · 506 tokens per session scan A 2d2e18f4a65b
nestjs-api is a cursor rule published in the GitHub repository WellApp-ai/Well (345 stars, last pushed 2d ago), licensed MIT. It adds 506 tokens to every session, about $0.0020 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
lap
LAP CLI -- search, download, and install API specs for AI agents. Use when user needs an API (Stripe, Plaid, Twilio, etc). Commands: (1) npx -y @lap-platform/lapsh search , (2) npx -y @lap-platform/lapsh get -o .lap, (3) npx -y @lap-platform/lapsh skill-install --target cursor. The .lap file IS the spec -- do NOT…
igniter-procedures
A guide to Igniter.js procedures and the context system. Explains how to create middleware for reusable business logic, dependency injection, and extending the request context in a type-safe manner.
design-standards
API design standards, HTTP status codes, error handling, and client usage patterns.
tray-api
Regras e documentação da API Tray. Aplica quando o desenvolvedor trabalhar com autenticação OAuth, produtos, pedidos, clientes, webhooks, frete, pagamentos ou qualquer outro recurso da plataforma Tray. Inclui convenções obrigatórias de autenticação, formato de payload, rate limit e índice completo de skills com…
200-api-design
200: RESTful API design principles and patterns.
ponytail
Ponytail, lazy senior dev mode. Always pick the simplest solution that works.