
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
agents-md-facts
Advanced tools
Honest to a fault — a minimal AGENTS.md, authored from your repo's facts, never guessed.
Honest to a fault — a minimal AGENTS.md, authored from your repo's facts, never guessed.
AI coding agents (Copilot, Cursor, Claude Code, Codex) read one file to learn how to work in your repo: AGENTS.md. There are two ways to get one wrong:
agents-md-facts is that conclusion, mechanized. It reads your repo and authors a minimal AGENTS.md from detected facts — your real build/test commands, your real entry points, the conventions your linters already enforce. Every line traces to something true in the repo. Nothing invented, nothing padded.
npx agents-md-facts # scan the repo → author/refresh AGENTS.md (non-destructive)
npx agents-md-facts --check # CI / pre-commit: exit 1 if AGENTS.md is missing or stale
npx agents-md-facts --dry-run # print what it would write; change nothing
npx agents-md-facts --stdout # emit to stdout (for piping)
Non-destructive. It refreshes only inside <!-- agents:from-facts:start --> … <!-- agents:from-facts:end --> markers — anything you hand-write outside them is preserved. Re-run it whenever the code moves to keep the file true.
A minimal, standard-conformant AGENTS.md: orientation · setup & build · tests · where things live · conventions · guardrails · definition of done · security. Target ~35 lines. Every line is a detected fact or a curated default; if a line resolves no real ambiguity, it's dropped.
See it authored across languages in examples/ — Node/TS, Python, Rust, Go — each fixture ships the exact AGENTS.md the tool wrote for it.
Add the composite Action to fail the build whenever AGENTS.md drifts from the repo — so the file your agents read is never a stale lie:
# .github/workflows/agents-md.yml
name: AGENTS.md
on: [push, pull_request]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Wolfe-Jam/agents-md-facts@v0.1.0 # runs `agents-md-facts --check`
Prefer a raw step? run: npx agents-md-facts --check does the same thing. Either way, re-run the tool locally and commit the refreshed file to go green.
The whole point: this tool doesn't invent an AGENTS.md — it authors one from what's true in your repo. That's the exact difference the research measured: minimal-from-facts helps; LLM-freewritten hurts. Author clean, and there's no bloat for a linter to catch later.
MIT © James Wolfe · Built on the open AGENTS.md standard.
FAQs
Honest to a fault — a minimal AGENTS.md, authored from your repo's facts, never guessed.
The npm package agents-md-facts receives a total of 3 weekly downloads. As such, agents-md-facts popularity was classified as not popular.
We found that agents-md-facts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.