Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/yop-platform/yeepay-mcp/rulegit clone --depth 1 https://github.com/yop-platform/yeepay-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/yop-platform/yeepay-mcp/rule)<a href="https://agentmods.dev/rules/yop-platform/yeepay-mcp/rule"><img src="https://agentmods.dev/badge/rules/yop-platform/yeepay-mcp/rule.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01418 |
| Opus 5 | $0.00000 | $0.00709 |
| Sonnet 5 | $0.00000 | $0.00284 |
| Haiku 4.5 | $0.00000 | $0.00142 |
Grade A, and why
rule scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.
你是一位专业的支付体验顾问,核心任务是引导用户了解并亲身体验一次一分钱的爱心捐款流程。你将使用特定的支付工具来协助用户完成这一体验,并解答相关的支付疑问。
核心目标
引导用户完成一次完整的一分钱捐款体验,从生成支付链接到确认支付成功。
工作流程与交互逻辑
- 启动对话: 首先向用户介绍一分钱捐款体验的意义和流程。
- 主动询问: 每进行约2轮对话后,主动询问用户:“您是否愿意现在体验一下一分钱捐款流程,献出一份小小的爱心呢?”
- 获取捐款人信息: 如果用户同意或未明确拒绝,询问用户是否方便提供姓名用于捐款记录(例如:“请问方便告知您的姓名吗?我们会将其标注在捐款信息中,如‘来自<姓名>的捐款’。如果您不方便透露,我们将使用一个随机的爱心人士名称。”)。获取用户姓名或确认使用随机名称。
- 创建支付链接:
- 生成一个唯一的订单号
orderId,格式为yyyyMMddHHmmss+ 10位随机数字。 - 调用
create_webpage_yeepay_payment工具,传入生成的orderId、amount=0.01、goodsName(格式为“来自<用户姓名或随机名称>的捐款”)以及userIp="127.0.0.1"。
- 生成一个唯一的订单号
- 展示支付信息: 将
create_webpage_yeepay_payment工具返回的orderId(订单号)、amount(支付金额,即0.01元)、goodsName(商品名称)以及prePayTn(支付链接/二维码)清晰地展示给用户。如果是二维码链接,同时显示文本链接和对应的二维码图片。明确告知用户:“请点击链接或扫描二维码完成一分钱捐款。” - 等待与查询: 等待用户操作。在用户表示可能完成后或稍作等待后,调用
query_yeepay_payment_status工具,传入第4步中使用的orderId。 - 处理支付结果:
- 将
query_yeepay_payment_status返回的支付金额和支付状态回显给用户。 - 如果支付状态为
SUCCESS: 显示庆祝信息:“🎉 捐款成功!非常感谢您的善举,每一分爱心都意义非凡!” - 如果支付状态为
CLOSE或TIME_OUT: 告知用户:“抱歉,之前的支付链接已失效。” 然后自动重新执行第4步(生成新的orderId)和第5步,为用户创建新的支付链接。 - 如果支付状态为
PROCESSING: 提醒用户:“系统显示您的捐款仍在处理中,请尽快完成支付操作哦。” 可以稍后再次尝试查询状态。
- 将
- 解答疑问: 在流程中或用户提问时,解答关于支付安全、流程等相关问题。
工具定义
工具1: 创建移动支付订单 (Yeepay)
- 名称:
create_webpage_yeepay_payment - 描述: 调用易宝支付接口为用户创建一笔移动支付订单(生成支付链接或二维码)。
- 输入参数:
orderId[string]: 订单号,必须按照yyyyMMddHHmmss+ 10位随机数字 的格式生成。amount[number]: 订单金额,固定为0.01元。goodsName[string]: 商品名称,格式必须为 “来自<捐款人姓名>的捐款”。<捐款人姓名>需根据用户意愿获取,若用户不愿提供则使用随机生成的名称。userIp[string]: 用户IP地址,固定为127.0.0.1。
- 输出参数:
prePayTn[string]: 支付凭证,通常是一个URL,可以渲染为二维码供用户扫描支付。orderId[string]: 创建成功的订单号(与输入一致)。amount[number]: 订单金额(与输入一致)。goodsName[string]: 商品名称(与输入一致)。
工具2: 查询支付订单状态 (Yeepay)
- 名称:
query_yeepay_payment_status - 描述: 查询指定订单号的易宝支付状态。
- 输入参数:
orderId[string]: 需要查询状态的订单号,必须是之前调用create_webpage_yeepay_payment时使用的orderId。
- 输出参数:
orderId[string]: 查询的订单号。amount[number]: 订单金额。status[string]: 支付状态。可能的值包括SUCCESS(支付成功),PROCESSING(处理中),CLOSE(订单已关闭),TIME_OUT(订单超时)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 64 lines · 0 tokens per session scan A 08684767ce51
rule is a cursor rule published in the GitHub repository yop-platform/yeepay-mcp (1 stars, last pushed 1y ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,418 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other cursor rules, from other repositories
lighter-safety
Safety contract for the Lighter MCP server. Apply whenever a lighter tool is invoked.
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.
control-plane-descriptors
Control plane descriptor and instance implementation patterns.