
What is AGENTS.md? How to write one your coding agents follow
AGENTS.md is a Markdown file that tells AI coding agents how to work on your repo. What it is, which tools read it, and how to write one that works.
Copy-paste MCP configs for Supabase and GitHub in Cursor, Claude Code and Codex, plus a checklist to vet any MCP server before you connect it.
The same two servers, Supabase (read-only) and GitHub, set up for three tools. Tokens stay in environment variables.
{
"mcpServers": {
"supabase": {
"type": "http",
"url": "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true"
},
"github": {
"type": "http",
"url": "https://api.githubcopilot.com/mcp/",
"headers": {
"Authorization": "Bearer ${GITHUB_PAT}"
}
}
}
}
.cursor/mcp.json for Cursor.mcp.json for Claude Code.codex/config.toml for CodexMCP-SAFETY-CHECKLIST.md: vet, pin, scope and review serversYOUR_PROJECT_REF with your Supabase project ref.export GITHUB_PAT=.../mcp in Claude Code, codex mcp list in Codex, MCP Logs in Cursor.Builders connecting their first MCP servers, or tightening the ones they have.

AGENTS.md is a Markdown file that tells AI coding agents how to work on your repo. What it is, which tools read it, and how to write one that works.

How to run coding agents safely with Claude Code permission modes, Codex sandbox and approval settings, deny rules, and habits that keep secrets out of reach.

MCP security best practices for vibe coders: prompt injection risks, what the MCP spec requires, and a checklist to use MCP servers without leaking data.
The Codema publication. Consent is required. You are not subscribed until you confirm from the email, and nothing is stored if email delivery is not connected.