DEV Community: AgentKit Drawer

Stop AI agents creating Supabase tables without RLS

AgentKit Drawer — Mon, 26 Oct 2026 14:29:40 +0000

AI coding agents write a clean create table, add a foreign key, and move on. They skip row-level security because the query works from the SQL editor and the type generator is happy. That table is then reachable through the Data API by any role that has a grant. The Supabase API security guide is blunt: tables exposed without RLS can be accessed by any role with matching grants.

This post is the RLS rule itself: enable it in the same migration, write policies, and never turn it off to “make it work”. For the rest of a Next.js + Supabase Cursor setup (auth helpers, env, Stripe), use Cursor rules for Next.js + Supabase.

Why agents leave RLS off

Tables created in the Supabase Dashboard have RLS enabled by default. Tables created in a migration, the SQL Editor, or an ORM dump do not. Agents almost always use SQL. Postgres also starts a new table with RLS disabled, so “it works” is the default until someone adds enable row level security.

The happy path hides it. The agent uses the service-role key in a seed script. That key bypasses RLS, so every query succeeds.
The error looks like a bug. Once RLS is on and there is no policy, the Data API returns no rows. Agents “fix” that by disabling RLS instead of writing a policy.
Grants are leftover. anon and authenticated often still have select (or worse). RLS off plus a grant is a public table.

Official reminder: enable RLS on every table and view the Data API exposes, then write policies. See Row Level Security.

The rule: same migration, or the table does not ship

Put this in AGENTS.md and in a path-scoped Cursor rule on supabase/**. The agent should refuse to commit a create table that does not also enable RLS and define policies.

---
description: "Migrations and row-level security"
globs: supabase/**
alwaysApply: false
---
- For each newly created table, enable row level security and define its policies in the same migration.
- Policies use (select auth.uid()) for performance; separate policies per command (select/insert/update/delete).
- Add indexes on every column used in a policy or foreign key.
- Never disable RLS to 'make it work'. If a query fails, fix the policy and explain it.
- Regenerated types after schema changes go in the project's existing types file.

The same bullets live as a free file on GitHub: nextjs-supabase-rls.mdc. For Windsurf, drop the front matter into .windsurf/rules/; see Windsurf rules setup.

What the migration should look like

Enable RLS, tighten grants, then add one policy per command. Separate policies keep using (read/filter) and with check (write) obvious, and they stay readable when an agent edits only insert later.

create table public.invoices (
  id uuid primary key default gen_random_uuid(),
  owner_id uuid not null references auth.users (id),
  amount_cents integer not null,
  created_at timestamptz not null default now()
);

create index invoices_owner_id_idx on public.invoices (owner_id);

alter table public.invoices enable row level security;

revoke all on table public.invoices from anon, authenticated;
grant select, insert, update, delete on table public.invoices to authenticated;

create policy "invoices_select_own"
  on public.invoices for select
  to authenticated
  using ((select auth.uid()) = owner_id);

create policy "invoices_insert_own"
  on public.invoices for insert
  to authenticated
  with check ((select auth.uid()) = owner_id);

create policy "invoices_update_own"
  on public.invoices for update
  to authenticated
  using ((select auth.uid()) = owner_id)
  with check ((select auth.uid()) = owner_id);

create policy "invoices_delete_own"
  on public.invoices for delete
  to authenticated
  using ((select auth.uid()) = owner_id);

Wrapping auth.uid() in select is the documented initPlan pattern: Postgres evaluates the function once per statement instead of once per row. Only use it when the result does not depend on the current row. Index the columns the policy compares, here owner_id.

With RLS on and no policy, publishable-key requests see nothing. That empty result is safer than an open table. If the agent’s query “fails”, the policy is missing or wrong. Do not alter table … disable row level security.

What to tell the agent about clients

Browser and user-scoped server code use the publishable (anon) key plus a user JWT. RLS is the access control.
The service-role key bypasses RLS. It belongs on the server only. Never prefix it with NEXT_PUBLIC_. If a job must write across users, keep that path tiny and audited.
Do not use RLS as the only filter. Still add .eq('owner_id', userId) in the query. Policies are security; explicit filters keep the intent visible and the plan cheaper.
Views need the same treatment if they are exposed through the Data API.

Prove it with a database test

A rule without a test is a comment. Supabase can run pgTAP files with supabase test db. Ask the agent for a case that inserts as user A and fails to read as user B.

begin;
select plan(2);

-- user A can read their row; user B cannot.
-- Use supabase test helpers / auth.uid() stubs your project already has.
select ok(
  (select count(*) from public.invoices) >= 0,
  'suite loads; replace with two auth.uid() cases'
);
select ok(
  true,
  'other-user select returns 0 rows under authenticated'
);

select * from finish();
rollback;

Replace the stubs with your project’s auth helpers. The point of the rule is: no new table without an other-user case. If you do not want to teach the agent pgTAP, require a failing-then-passing integration test that uses two sessions instead.

AGENTS.md lines that actually get followed

Keep the always-on file short. The migration glob rule above does the path-scoped work. These four lines belong in the shared AGENTS.md:

## Database
- Every new table enables RLS and defines per-command policies in the same migration.
- Policies use (select auth.uid()). Never disable RLS to make a query work.
- Service-role key stays on the server. Never NEXT_PUBLIC_ it.
- After schema changes, regenerate types into the existing types file.

Put the file at the repo root so Cursor, Codex and Windsurf all see it. Claude Code picks it up with @AGENTS.md in CLAUDE.md. Which file each tool reads: AGENTS.md vs CLAUDE.md vs Cursor rules.

If the same agent is about to grant paid access from a Stripe redirect, that is a different hole. Pair this post with Stripe webhooks for AI agents.

FAQ

Do new Supabase tables have RLS enabled?

Tables created in the Supabase Dashboard have RLS enabled by default. Tables created in the SQL Editor, migrations, or another tool do not. Enable RLS explicitly in the same migration that creates the table.

What happens if RLS is on but there are no policies?

Requests that use a publishable key see no rows. That is safer than leaving RLS off. Add per-command policies for the roles that should have access.

Why wrap auth.uid() in a select?

Using (select auth.uid()) lets Postgres cache the value once per statement (an initPlan) instead of calling the function on every row. Only do this when the result does not depend on the current row.

Does the service role bypass RLS?

Yes. The service-role key bypasses row-level security. Keep it on the server only. Never prefix it with NEXT_PUBLIC_ or ship it to the browser.

Should I disable RLS to debug a failing query?

No. If a query fails, fix the policy and explain it. Disabling RLS to make it work is how production tables end up readable by anyone with the anon key.

The free Starter AGENTS.md is a one-click download, no email needed. The full setup (migration rule, a Claude Code hook that blocks a table without RLS, a migration-reviewer subagent) is the Supabase + Next.js Agent Kit.

3 AI coding agent footguns, and the one command that catches each

AgentKit Drawer — Fri, 23 Oct 2026 15:21:08 +0000

AI coding agents are fast, and sometimes they take shortcuts you won't notice until it hurts. Here are three I made short videos about this week. Each one comes with a command you can run today.

1. Slopsquatting: your agent installs a package that doesn't exist

LLMs sometimes suggest package names that were never published. Anyone can register those names on npm or PyPI and put malicious code inside. The attack is called slopsquatting.

The numbers come from "We Have a Package for You!" (Spracklen et al., USENIX Security 2025). The authors generated 576,000 code samples with 16 LLMs. 19.7% of the suggested packages didn't exist. When they re-ran prompts that had produced a fake name, 43% of those fake names came back in all 10 reruns. Names that predictable are easy to squat.

"Just try installing it" is the wrong move. npm install runs a package's preinstall, install and postinstall scripts, so its code runs the moment it lands.

The 5-second check:

npm view PACKAGE-NAME time.created repository.url

If you get 404 Not Found, the name is made up. Stop there.
If it exists, look closer. A brand-new package with no repo and only a handful of weekly downloads is a red flag. Existing doesn't mean safe.
For Python, https://pypi.org/project/PACKAGE-NAME/ returns a 404 for names that were never published.

Then add this rule to AGENTS.md: "Never invent file paths, API fields, package names, URLs, versions or quotes. If unsure, say so and say how to find out."

2. Claude Code reads your .env without asking

According to Claude Code's permissions docs, file reads inside your working directory need no approval. Read-only shell commands like cat, head, tail and grep also run without a prompt. If the agent decides your Stripe bug "might be config", your live keys end up in the conversation. The docs also say a .claudeignore file has no effect.

The fix: deny rules in .claude/settings.json:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)"
    ]
  }
}

Deny beats allow, so no allow rule can carve an exception out of it.
Read deny rules also cover file commands Claude recognizes in Bash, such as cat, head, tail and sed.
Commit the file and your whole team is covered.
Caveat: a Python or Node script that opens the file itself isn't covered. For OS-level blocking, turn on the sandbox.

3. Your agent made CI green by deleting the failing test

Ask an agent to "make CI pass" and sometimes it takes the shortcut. It deletes the failing test, or marks it .skip, and reports green. Anthropic's own Claude prompting guide warns that Claude "can sometimes focus too heavily on making tests pass at the expense of more general solutions."

Catch it with git:

git diff main --name-only --diff-filter=D -- '*.test.*'
git diff main | grep -E '^\+.*\.(skip|only)\('

--diff-filter=D keeps only deleted files, and --name-only prints just their paths. In a git pathspec, * matches across folders, so src/cart/cart.test.ts is caught too.
The grep finds added lines that call .skip( or .only(, such as it.skip or test.only in Jest and Vitest.
In CI, diff against the base branch (for example origin/main...HEAD) and fail the job if either command prints anything.
What this misses: an agent that rewrites the assertion so it passes. You still need to read the test diff.

Put the rules where your agent reads them

Each of these checks has a matching line for AGENTS.md: no invented packages, never read .env*, and "green by cheating is red." They're all in the hard rules of our packs:

DRW-06: Supabase + Next.js Agent Kit ($19). AGENTS.md, CLAUDE.md, 8 scoped Cursor rules, 10 prompts and a Claude Code hook that blocks tables without RLS: https://agentkitdrawer.com/supabase-nextjs-agent-kit/?utm_source=devto&utm_medium=article&utm_campaign=2026-44&utm_content=agent-footguns
DRW-00: One-File Agent Rules ($9). One 160-line AGENTS.md for Cursor, Claude Code and Codex: https://agentkitdrawer.com/?utm_source=devto&utm_medium=article&utm_campaign=2026-44&utm_content=agent-footguns#one-file

Has your agent pulled any of these on you? Tell me in the comments.

A Codex AGENTS.md template for OpenAI Codex CLI

AgentKit Drawer — Wed, 21 Oct 2026 02:03:31 +0000

OpenAI Codex reads AGENTS.md before it does any work. That file is the Codex CLI agent instructions for the repo: stack, commands, hard never-dos, and what “done” means. A short, specific file gets followed. A 600-line essay gets skimmed.

This guide is a Codex AGENTS.md template you can paste today, plus how Codex actually discovers those files, and how that differs from CLAUDE.md and Cursor rules.

What Codex reads

Codex builds an instruction chain once per run (in the TUI, once per session):

Global: ~/.codex/AGENTS.override.md if it exists, otherwise ~/.codex/AGENTS.md. Personal defaults, not repo rules.
Project: from the repo root (usually the Git root) down to the current working directory. In each directory it prefers AGENTS.override.md, then AGENTS.md. At most one file per directory.
Merge: files concatenate root → cwd. Closer files appear later, so they override broader guidance.

Empty files are skipped. Combined project instructions cap at about 32 KiB by default (project_doc_max_bytes). Keep the root file short; put specialist rules in nested directories instead of one giant README. Official discovery notes: Custom instructions with AGENTS.md.

Codex does not read CLAUDE.md or .cursor/rules/*.mdc. If those are your only instruction files, Codex guesses.

Minimal copy-paste template

Drop this at the repo root as AGENTS.md. Fill every <<FILL>>. Codex’s /init can scaffold a starter; edit that result the same way — exact commands beat vague vibes.

AGENTS.mdcopy

# AGENTS.md
<!-- OpenAI Codex CLI agent instructions. Fill every <<FILL>>. -->

## Project
- App: <<FILL: name and one-line purpose>>
- Stack: <<FILL: e.g. Next.js 15 App Router, Supabase, Stripe, pnpm>>
- Layout: <<FILL: where app/, lib/, tests, and generated types live>>

## Commands
- Dev: <<FILL: e.g. pnpm dev>>
- Test: <<FILL>>
- Lint: <<FILL>>
- Typecheck: <<FILL>>

## Hard rules
- Never print, log, or commit secrets. Never prefix secrets with NEXT_PUBLIC_.
- Never disable tests, typecheck, RLS, or other safety checks to make something pass.
- Keep diffs small. Never edit generated files by hand.
- For auth, payments, or migrations: write a short plan and wait for go.

## Workflow
1. Restate the goal in one line and list the files you will touch.
2. Make one small change, then run the tests / typecheck you listed.
3. Report what you verified, and what you could not verify.

## Done means
The commands above pass, the change is described in plain words, and you did not expand the scope.

Paste a safety section from the free agent-guardrails.md (MIT) when the agent will call tools or read untrusted content. For Next.js + Supabase, the free nextjs-supabase-rls.mdc is a Cursor-shaped rule; copy the bullets into AGENTS.md (or a nested supabase/AGENTS.md) so Codex sees them too.

How this differs from CLAUDE.md and Cursor rules

File	Who reads it	Shape	Use it for
AGENTS.md	OpenAI Codex CLI, Cursor, and other AGENTS.md-aware tools	Plain Markdown; nested files concatenate root → cwd	Shared source of truth: stack, commands, never-dos, done criteria
CLAUDE.md	Claude Code	Markdown; can import files with `@path`	A thin file that starts with `@AGENTS.md`, then Claude-only notes
*.cursor/rules/.mdc**	Cursor	Markdown + YAML frontmatter (`globs`, `alwaysApply`)	Path-scoped rules that load only when matching files are in context

Recommended layout: write AGENTS.md first so Codex has instructions. Add a one-line CLAUDE.md that imports it. Add scoped Cursor .mdc files for auth, RLS, or Stripe — do not paste the whole essay into every format. Full comparison: AGENTS.md vs CLAUDE.md vs Cursor rules. Claude-specific template: CLAUDE.md template.

Nested files and overrides

When a subdirectory has different commands or never-dos, put a second AGENTS.md there. Codex running from that directory loads the root file, then the nested one. If you need to replace the directory’s file without deleting it, use AGENTS.override.md in that folder — Codex will take the override and ignore the sibling AGENTS.md.

layout sketchcopy

repo/
  AGENTS.md                      # shared source of truth (Codex + others)
  CLAUDE.md                      # @AGENTS.md + Claude-only notes
  .cursor/rules/                 # Cursor-only, path-scoped
  services/payments/
    AGENTS.md                    # payments commands and never-dos

Free files (MIT)

All of these live in the public eli-alvarado/agentkit-drawer repo:

agent-guardrails.md — injection defense, ask-vs-act, uncertainty
nextjs-supabase-rls.mdc — RLS bullets you can mirror into AGENTS.md
godot-jam-timeline.md and agents-md-game-modding.md — game-shaped AGENTS.md starters

FAQ

What file does OpenAI Codex read?

Codex CLI reads AGENTS.md (and AGENTS.override.md when present) before it starts work. Personal defaults can live in ~/.codex/AGENTS.md. It does not read CLAUDE.md or Cursor .mdc rules.

Does Codex read CLAUDE.md or .cursor/rules?

No. Keep shared rules in AGENTS.md. Point Claude Code at that file with @AGENTS.md. Keep Cursor path rules in .cursor/rules/*.mdc.

Where should the Codex AGENTS.md template live?

Repo root, next to your lockfile. Nested AGENTS.md files refine the root file for a subdirectory. Codex concatenates from the Git root down to the working directory.

What is AGENTS.override.md?

In a given directory, it wins over AGENTS.md. Use it for a local or temporary override without deleting the shared file. Codex still takes only one instruction file per directory.

How is this different from Cursor rules?

AGENTS.md is unscoped plain Markdown. Cursor .mdc files add frontmatter so a rule loads only for matching paths. Shared facts belong in AGENTS.md; path-scoped extras belong in Cursor rules.

Want the whole drawer?

The Vibe Starter Rules Pack ($19) ships a ready AGENTS.md + CLAUDE.md pair, 8 scoped Cursor rules, 12 slash-command prompts, and launch checklists for Next.js + Supabase + Stripe — the file Codex actually reads, plus the tool-specific extras. The Agent Builder Prompt Pack ($29) is the system-prompt and eval kit for Codex-class agents.

Buy Vibe Starter · $19
Buy Agent Builder · $29

Not ready for a full pack? Start with One-File Agent Rules ($9), one universal AGENTS.md for any stack, or get the free Starter AGENTS.md by email.

Originally published at agentkitdrawer.com.

Claude Code subagents, hooks and slash commands: a working setup

AgentKit Drawer — Wed, 21 Oct 2026 01:56:55 +0000

CLAUDE.md tells Claude Code what to do. Subagents, hooks and slash commands are how you make it actually happen: focused reviewers with limited tools, shell scripts that enforce your rules instead of hoping the model remembers them, and one-word commands for your workflow.

Subagents: `.claude/agents/*.md`

A subagent is a Markdown file with YAML frontmatter: name, a description that tells Claude when to delegate (write “Use PROACTIVELY after…” to get it used automatically), and an optional tools list. Each subagent runs in its own fresh context, so it does not clutter the main conversation, and it does not see that conversation either: pass it the exact files and goal.

Least privilege: a reviewer or security auditor gets Read, Grep, Glob only. If it cannot edit, it cannot “fix” things you did not ask for.
One job each: planner, code-reviewer, test-writer, debugger, security-auditor, docs-writer covers most teams.
Output contracts: “Report MUST / SHOULD / NIT with path:line” beats “review the code”.

Run /agents in Claude Code to list, create and edit them.

Hooks: rules the model cannot skip

Hooks live in .claude/settings.json under "hooks". Each event (PreToolUse, PostToolUse, Stop, and others) has a matcher on the tool name (Bash, Edit|Write) and a command. The hook gets the tool call as JSON on stdin. Exit code 2 blocks the action and sends your stderr message back to Claude; exit 0 allows it.

PreToolUse on Bash: block rm -rf, git push --force, git reset --hard, curl | sh, pushes to main.
PreToolUse on Read|Edit|Write: refuse .env, *.pem and lockfiles, while still allowing .env.example.
PostToolUse on Edit|Write: run your formatter on the edited file. Never block here.
Stop: run tests when code changed; exit 2 keeps Claude working. Check stop_hook_active to avoid loops.

Hooks run with your user's permissions. Read every script before enabling it and keep them in version control. Pair them with permissions.deny entries in the same file for a second layer.

Slash commands: `.claude/commands/*.md`

Each file becomes /filename. Use $ARGUMENTS for what you type after the command, and frontmatter such as description, argument-hint and allowed-tools. Good commands chain your subagents: /feature = plan → implement → test-writer → tests → code-reviewer → summary.

Free snippet: copy it

.claude/hooks/block-dangerous-bash.shcopy

#!/usr/bin/env bash
# PreToolUse (matcher: Bash). Exit 2 = block; stderr is shown to Claude.
cmd=$(jq -r '.tool_input.command // ""')
deny=(
  'rm -rf /' 'rm -rf ~' 'rm -rf \*' 'rm -rf \.' 'git push --force' 'git push -f' 'git reset --hard'
  'git clean -fd' 'DROP DATABASE' 'DROP TABLE' 'TRUNCATE ' 'supabase db reset' 'prisma migrate reset'
  'alembic downgrade base' 'chmod -R 777' 'mkfs' 'dd if=' ':(){'
)
for p in "${deny[@]}"; do
  if printf '%s' "$cmd" | grep -qiF -- "${p//\\/}"; then
    echo "Blocked by .claude/hooks/block-dangerous-bash.sh: '$p' is destructive. Explain why it's needed and ask the human to run it." >&2
    exit 2
  fi
done
if printf '%s' "$cmd" | grep -qE '(curl|wget)[^|]*\|\s*(ba|z)?sh'; then
  echo "Blocked: piping a download into a shell. Download, inspect, then ask." >&2; exit 2
fi
if printf '%s' "$cmd" | grep -qE 'git push[^&;|]*\b(main|master)\b'; then
  echo "Blocked: pushing to main/master. Push a branch and open a PR." >&2; exit 2
fi
exit 0

FAQ

Where do Claude Code subagents live?

Project subagents go in .claude/agents/ as Markdown files with YAML frontmatter (name, description, optional tools). Personal ones go in ~/.claude/agents/. Use /agents to manage them.

How do I block dangerous commands in Claude Code?

Add a PreToolUse hook with matcher Bash in .claude/settings.json. The script reads the tool call JSON from stdin and exits with code 2 to block it; its stderr is shown to Claude. Add matching permissions.deny rules as a second layer.

What does exit code 2 mean in a Claude Code hook?

Exit 2 blocks the action (for PreToolUse) or tells Claude to keep working (for Stop), and stderr is fed back to Claude. Exit 0 allows. Other codes are non-blocking errors shown to you.

How do I make Claude Code run tests before it finishes?

Use a Stop hook that runs your test command when code changed and exits 2 on failure. Check the stop_hook_active field in the input and exit 0 when it is true, so the hook cannot loop forever.

Do subagents see the main conversation?

No. Each subagent starts with a fresh context window and only gets the task you hand it, so include file paths and the goal in the delegation.

Want the whole drawer?

The Claude Code Kit ($24) ships a fill-in CLAUDE.md, 6 least-privilege subagents, 10 slash commands, a settings.json with permissions and hook wiring, and 4 tested hooks (dangerous Bash, secret files, lockfiles, format, tests-before-stop).

Buy Claude Code Kit · $24
Buy FastAPI Kit · $19

Not ready for a full pack? Start with One-File Agent Rules ($9), one universal AGENTS.md for any stack, or get the free Starter AGENTS.md by email.

Originally published at agentkitdrawer.com.

AGENTS.md vs CLAUDE.md vs .cursor/rules: which file does your AI agent read?

AgentKit Drawer — Wed, 21 Oct 2026 01:56:14 +0000

Different AI coding tools look for different instruction files. If you only keep rules in one tool's format, the others guess. If you copy the same wall of text into every format, the copies drift. This guide maps what each file is for, and a setup that stays maintainable.

The short answer

AGENTS.md is the cross-tool open convention. OpenAI Codex, Cursor, and many other agents read it as plain Markdown project instructions.
CLAUDE.md is Claude Code's project memory file. It can pull in other files with @path syntax (for example @AGENTS.md).
Cursor project rules live in .cursor/rules/*.mdc with YAML frontmatter (description, globs, alwaysApply). The legacy single-file .cursorrules format is deprecated; prefer .mdc rules.
Windsurf stores Cascade rules as Markdown under .windsurf/rules/.

Comparison

File	Who reads it	Shape	Best for
AGENTS.md	Codex, Cursor, and other AGENTS.md-aware tools	Plain Markdown at the repo root (and optionally nested)	Shared source of truth: stack, commands, hard rules, definition of done
CLAUDE.md	Claude Code	Markdown; can import other files with `@path`	Claude-specific notes on top of shared AGENTS.md
*.cursor/rules/.mdc**	Cursor	Markdown + frontmatter (`description`, `globs`, `alwaysApply`)	Path-scoped rules that load only when matching files are in context
.cursorrules (legacy)	Older Cursor setups	Single root file, no frontmatter	Migrate away; use `.mdc` rules or AGENTS.md
.windsurf/rules/	Windsurf Cascade	Markdown files with activation modes (always / glob / manual)	Same ideas as Cursor rules, in Windsurf's layout

What each file is for

AGENTS.md

AGENTS.md is a simple open format: a README for agents. Put durable project guidance here: how to build and test, folder layout, conventions, and the never-do list. Keep it short enough that tools will follow it. Codex discovers project AGENTS.md files along the path from the repo root to your working directory; closer files can refine broader ones. Copy-paste starter: Codex AGENTS.md template.

CLAUDE.md

Claude Code loads CLAUDE.md at the start of a session. Use @path/to/file anywhere in that file to import more Markdown. Relative paths resolve from the file that contains the import. A common pattern is a one-line import of shared rules, then a few Claude-only notes:

CLAUDE.mdcopy

@AGENTS.md

# Claude Code notes
- Prefer the project package scripts over ad-hoc commands.
- Before touching auth, payments, or migrations: write a short plan and wait for go.

For a fuller template, see the free CLAUDE.md guide.

Cursor `.cursor/rules/*.mdc`

Each rule is an .mdc file under .cursor/rules/. Frontmatter controls when it loads:

alwaysApply: true — included in every chat.
globs with alwaysApply: false — attached when matching files are in context.
description without globs — Cursor can pull the rule in when it looks relevant.
Neither description nor globs — manual via @rule-name.

Plain .md files in that folder are ignored by the rules system (no frontmatter). Prefer small scoped rules over one giant file. Example RLS rule (also free on GitHub as nextjs-supabase-rls.mdc):

.cursor/rules/30-database-rls.mdccopy

---
description: Migrations and row-level security
globs: supabase/**
alwaysApply: false
---
- For each new table: enable RLS + policies in the same migration.
- Policies use (select auth.uid()); separate policies per command.
- Never disable RLS to "make it work". Fix the policy instead.

More Next.js + Supabase detail: Cursor rules for Next.js + Supabase. For a Python backend skeleton (venv, pytest, type hints), see Cursor rules for Python.

Windsurf `.windsurf/rules/`

Cascade reads Markdown rules from .windsurf/rules/, with activation similar in spirit to Cursor (always on, glob, or manual). Keep those files thin and mirror the ideas already in AGENTS.md. See Windsurf rules.

Recommended setup: one source of truth

Write AGENTS.md first. Stack, commands, hard rules, workflow, definition of done.
Add a thin CLAUDE.md that starts with @AGENTS.md, then only Claude-specific notes.
Add scoped Cursor rules for paths that need extra precision (auth, RLS, Stripe, env). Do not paste the entire AGENTS.md into every .mdc.
If you use Windsurf, port the same scoped ideas into .windsurf/rules/ without inventing a third full copy of the essay.
Delete or migrate .cursorrules so you are not maintaining a legacy file Agent mode may ignore.

When a rule misbehaves, fix it in the source of truth (AGENTS.md or the one scoped rule), not in three places.

layout sketchcopy

repo/
  AGENTS.md                 # shared source of truth
  CLAUDE.md                 # @AGENTS.md + Claude-only notes
  .cursor/rules/
    00-core.mdc             # alwaysApply: true (short)
    30-database-rls.mdc     # globs: supabase/**
    40-stripe.mdc           # globs: app/api/stripe/**
  .windsurf/rules/          # optional mirror for Cascade
    database-rls.md

Free files you can drop in today

nextjs-supabase-rls.mdc — Cursor rule for Supabase RLS
agent-guardrails.md — guardrail snippets for AGENTS.md or system prompts
agents-md-game-modding.md — AGENTS.md template for mods and small game tools
godot-jam-timeline.md — 48-hour jam timeline for agents

FAQ

Do I need AGENTS.md, CLAUDE.md, and .cursor/rules all at once?

Only if you use more than one tool. Shared rules live in AGENTS.md. Claude Code gets a thin CLAUDE.md with @AGENTS.md. Cursor gets scoped .mdc files when you need path-based loading. Do not duplicate the essay.

Is .cursorrules still supported?

It is legacy. Prefer .cursor/rules/*.mdc with frontmatter, and migrate remaining content into those files or into AGENTS.md.

Can Claude Code read AGENTS.md?

Its native file is CLAUDE.md. Import shared rules with @AGENTS.md so you maintain one copy. Imports are expanded when the session starts.

What goes in AGENTS.md vs a Cursor rule?

AGENTS.md: stack, commands, never-dos, done criteria. Cursor .mdc: path-scoped guidance via globs so auth, migrations, or webhooks only load when those files are in context.

Where do Windsurf rules live?

Under .windsurf/rules/ as Markdown. Keep them aligned with AGENTS.md rather than inventing a separate doctrine.

Want the whole drawer?

Skip the setup. The Claude Code Kit ($24) ships a fill-in CLAUDE.md, 6 least-privilege subagents, 10 slash commands, settings.json permissions and 4 tested hooks. The Vibe Starter Rules Pack ($19) ships a ready AGENTS.md + CLAUDE.md pair, 8 scoped .cursor/rules, 12 slash-command prompts and launch checklists for Next.js + Supabase + Stripe.

Buy Claude Code Kit · $24
Buy Vibe Starter · $19
See all 5 kits

Not ready for a full pack? Start with One-File Agent Rules ($9), one universal AGENTS.md for any stack, or get the free Starter AGENTS.md by email.

Originally published at agentkitdrawer.com.

DEV Community: AgentKit Drawer

Stop AI agents creating Supabase tables without RLS

Why agents leave RLS off

The rule: same migration, or the table does not ship

What the migration should look like

What to tell the agent about clients

Prove it with a database test

AGENTS.md lines that actually get followed

FAQ

Why wrap auth.uid() in a select?

Does the service role bypass RLS?

Should I disable RLS to debug a failing query?

3 AI coding agent footguns, and the one command that catches each

1. Slopsquatting: your agent installs a package that doesn't exist

2. Claude Code reads your .env without asking

3. Your agent made CI green by deleting the failing test

Put the rules where your agent reads them

A Codex AGENTS.md template for OpenAI Codex CLI

What Codex reads

Minimal copy-paste template

How this differs from CLAUDE.md and Cursor rules

Nested files and overrides

Free files (MIT)

FAQ

Want the whole drawer?

Claude Code subagents, hooks and slash commands: a working setup

Subagents: .claude/agents/*.md

Hooks: rules the model cannot skip

Slash commands: .claude/commands/*.md

Free snippet: copy it

FAQ

Want the whole drawer?

AGENTS.md vs CLAUDE.md vs .cursor/rules: which file does your AI agent read?

The short answer

Comparison

What each file is for

AGENTS.md

CLAUDE.md

Cursor .cursor/rules/*.mdc

Windsurf .windsurf/rules/

Recommended setup: one source of truth

Free files you can drop in today

FAQ

Want the whole drawer?

Subagents: `.claude/agents/*.md`

Slash commands: `.claude/commands/*.md`

Cursor `.cursor/rules/*.mdc`

Windsurf `.windsurf/rules/`