DEV Community: Vildanden

Give your coding agent an "ask first" list, not just a "never" list

Vildanden — Tue, 06 Oct 2026 01:10:25 +0000

Most agent configs have two modes: things the agent may do, and things it must never do. Real work needs a third bucket: ask first.

A flat deny-list is too blunt. Ban git push outright and the agent can't finish a branch you actually wanted pushed. Allow it silently and one bad loop rewrites shared history. The middle bucket fixes that.

A three-bucket layout for `AGENTS.md`

## Never
- Invent secrets, API keys, or env var values
- Force-push or rewrite shared history
- Delete data outside the working tree

## Ask first (stop and describe the command)
- Any push to a remote
- Schema migrations against a non-local database
- Installing a new dependency
- Changing CI or deploy config

## Fine without asking
- Edit files in the working tree
- Run the test suite and linters
- Read logs and local docs

Keep each bucket under ten lines. When a line needs a paragraph of explanation, move it into a scoped Cursor rule (.cursor/rules/*.mdc) that only loads for the matching paths.

Why it works

The agent fails closed on irreversible actions without stalling on everyday ones.
Reviews get shorter: anything surprising should have triggered an "ask first" stop, so you know where to look.
New teammates read the same three lists and learn the house rules in a minute.

Vildanden's free Agent Config sample ships with this split for a Next.js-leaning repo:

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai. The paid multi-stack pack is optional; start with the free files and keep only what earns its place.

Keep agent config under 80 lines — push stack rules into .mdc files

Vildanden — Fri, 02 Oct 2026 01:14:56 +0000

A 400-line AGENTS.md feels thorough. It is usually a trap: the model greps, half-follows, and still invents a “temporary” env var because the deny-list was buried under framework essays.

Split the job:

Root AGENTS.md (short): deny-list first (no invented secrets, no force-push, no destructive shell without an ask), then a one-paragraph product/context blurb.
Scoped Cursor rules (.cursor/rules/*.mdc): Next.js routing, testing, API shape, naming — only where that stack file applies.
Optional CLAUDE.md: same edges, Claude Code–friendly wording — not a second novel.

You get fewer contradictions and faster reviews. Agents fail closed on the irreversible stuff and still get stack hints when the path matches.

Vildanden’s free Agent Config sample is built that way for a Next.js-leaning team:

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai. No personal founder pitch.

If the free baseline helps, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional upgrades — ignore them until the free files earn a place in your workflow.

Put a tiny deny-list in every agent config before the wish-list

Vildanden — Thu, 01 Oct 2026 01:17:02 +0000

Most starter AGENTS.md files read like a feature request: use this stack, prefer these patterns, write nice commits. Useful. Incomplete.

Coding agents fail more often by doing the wrong irreversible thing than by missing a style tip. Put the stop-rules first:

Never invent secrets, API hosts, or “temporary” credentials.
Never push, force-push, or open a PR unless the human asked in this turn.
Never run destructive shell (rm -rf, drop, prod migrate) without an explicit ask.
Prefer read → plan → small patch over rewriting half the repo.
Keep the wish-list (frameworks, folders, tone) after that deny-list so it cannot dilute the edges.

Vildanden’s free Agent Config sample is built that way for a Next.js-leaning team — short root guidance plus scoped Cursor rules:

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai. No personal founder pitch.

If the free baseline helps, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional upgrades — ignore them until the free files earn a place in your workflow.

One stack-specific Cursor rule file beats a giant AGENTS.md dump

Vildanden — Wed, 30 Sep 2026 01:27:39 +0000

Teams often paste everything an agent might need into one root AGENTS.md. That file grows. The model skims. The risky edges (secrets paths, deploy commands, “never invent APIs”) get diluted.

A tighter pattern:

Keep AGENTS.md short — install path, repo shape, where to look next.
Put enforceable boundaries in Cursor .mdc rules — stack-specific, scoped, fail-closed.
Add a compat note for Claude Code / other agents that read CLAUDE.md or root markdown.
Prefer one Next.js (or API) stack sample that a human can audit in five minutes over a mega monorepo dump.

Vildanden’s free Agent Config sample follows that shape for a Next.js-leaning team:

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai. No personal founder pitch.

If the free baseline helps, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional upgrades — ignore them until the free files earn a place in your workflow.

Make coding agents fail closed — a tiny PR checklist in your repo

Vildanden — Tue, 29 Sep 2026 01:15:09 +0000

Most agent setups tell the model what to prefer. Fewer tell it what must stop the change.

A useful Agent Config pack treats the repo like a PR bot with fail-closed defaults:

Never invent APIs — if the route or client helper is not in the tree, say so and stop.
Never widen scope — no drive-by refactors, dependency bumps, or “while I’m here” restyles.
Secrets stay out of the chat surface — path rules and env boundaries live in Cursor .mdc files; the shared AGENTS.md stays short.
App Router defaults — Server Components first; mutations go through the paths you already use.
Done means green locally — typecheck/lint/tests the repo already runs, not a new toolchain the agent invented.

That checklist is boring on purpose. Boring is what keeps a coding agent from shipping clever damage.

Vildanden’s free Agent Config sample is a Next.js-shaped starter for that contract (install guide included):

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai.

If the free baseline earns its place, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional — skip them until the free files prove useful.

Give your coding agent a deny-list for secrets and path writes

Vildanden — Mon, 28 Sep 2026 01:12:52 +0000

Most agent failures are less about model IQ and more about missing boundaries.

Put explicit deny-lists where the agent can actually apply them:

Secrets: .env*, credentials/, private keys, and token files
Path writes: build artifacts, .git/, system directories, and unrelated repos
Risky commands: curl | sh, destructive deletes, or publishing credentials

For a team, keep stack-specific rules in scoped Cursor .mdc files so they load only where relevant. Use AGENTS.md for repo-wide workflow and invariants. CLAUDE.md can carry Claude-specific instructions.

Avoid dumping every rule into one giant AGENTS.md: it gets noisy, stale, and hard to review. Start with a small deny-list, test it against real tasks, and expand only when you see a failure mode.

I made a free sample with scoped rules, AGENTS.md, and CLAUDE.md examples for Next.js:

https://vildanden.gumroad.com/l/xphax

Landing page:

https://fairly-charlie-907.rehost.page/

Put secrets and path rules in Cursor .mdc files, not AGENTS.md

Vildanden — Fri, 25 Sep 2026 01:19:34 +0000

Put secrets and path rules in Cursor `.mdc` files, not `AGENTS.md`

AGENTS.md is the repo contract: stack, layout, “don’t invent APIs.” It should stay short and shared.

Path-specific rules belong in Cursor .mdc files with globs, so an agent editing app/api/** does not also rewrite your design tokens, and a UI rule never sees production secrets.

A Next.js App Router split that holds up:

Root AGENTS.md / CLAUDE.md — stack, folders, security defaults, “no invented endpoints.”
UI rule (.mdc) — tokens, components, no drive-by restyles.
API/data rule (.mdc) — validation, mutations, where env secrets never go.
Routes rule (.mdc) — App Router conventions, Server Components first.

Vildanden’s free Agent Config sample ships that shape (plus a short install guide):

Free download: https://vildanden.gumroad.com/l/xphax
Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden. No personal founder pitch.

If the free baseline earns its place, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional — skip them until the free files prove useful.

A tiny contract that keeps coding agents scoped

Vildanden — Thu, 24 Sep 2026 01:28:41 +0000

A coding agent is most useful when the repository makes the boundaries obvious.

A small, practical contract can answer four questions before any code changes:

What is this repository responsible for?
Which commands are safe to run?
What must be checked before a change is considered done?
Which directories or files are out of scope?

That is the job of a few plain-text files: AGENTS.md, CLAUDE.md, and focused Cursor rules. They are not a replacement for review. They are a way to reduce ambiguity, keep context close to the code, and make agent behavior repeatable across contributors.

A useful starting point is to write one rule per failure mode you have actually seen: broad refactors, skipped tests, invented APIs, or edits outside the requested area. Keep the rules short, specific, and easy to verify.

Vildanden’s free Next.js sample includes a copy-ready baseline for this workflow: https://fairly-charlie-907.rehost.page/

What is the first boundary you would add to your repository?

Free AGENTS.md starter — copy into a Next.js App Router repo

Vildanden — Wed, 23 Sep 2026 01:19:31 +0000

Free AGENTS.md starter for Next.js App Router

If your coding agent keeps rewriting the same project conventions, put the rules next to the code.

Vildanden’s free sample is a small, copy-ready pack:

root AGENTS.md / CLAUDE.md
three scoped Cursor rules
a short public install path

Grab it here (free): https://vildanden.gumroad.com/l/xphax

Landing + install notes: https://fairly-charlie-907.rehost.page/

Brand: Vildanden. No personal identity in the listing.

When you outgrow the free baseline, the paid Agent Config pack and Claude Code Ops pack are optional upgrades on the same Gumroad shop — ignore them until the free sample actually helps your repo.

A Small AGENTS.md Baseline for Next.js Teams

Vildanden — Mon, 21 Sep 2026 01:22:44 +0000

A lightweight baseline prevents every coding agent from inventing its own workflow.

What to put in AGENTS.md

Start with the rules that are stable across the repository:

how to install dependencies and run tests
the expected Node.js version and package manager
where application code, tests, and generated files live
the commands that must pass before opening a pull request
boundaries for secrets, migrations, and production changes

Keep tool-specific instructions in their native files. For example, use scoped Cursor rules for editor behavior and a short CLAUDE.md pointer when Claude Code needs extra context. This keeps the shared baseline readable and makes the rules easy to review.

A practical review loop

Ask the agent to summarize the relevant rules before it edits.
Make the smallest change that satisfies the task.
Run the repository checks listed in AGENTS.md.
Review the diff, including generated files and dependency changes.
Update the rule only when the workflow truly changed.

Vildanden's free Agent Config sample includes a ready-to-adapt Next.js baseline, Cursor rules, and a CLAUDE.md pointer:

https://fairly-charlie-907.rehost.page/

The goal is not more prompt text. It is a small, explicit contract that keeps the agent's work scoped to the repository.

AGENTS.md Pitfalls: 7 Mistakes That Make Coding Agents Less Reliable

Vildanden — Fri, 18 Sep 2026 14:39:02 +0000

AGENTS.md can give a coding agent useful project context, but a poorly maintained file can create more confusion than clarity. The best guidance is short, specific, and checked against the repository it describes.

Here are seven common AGENTS.md pitfalls and practical ways to avoid them.

1. Treating AGENTS.md as universal truth

A repository guide is not a replacement for source code, tests, package scripts, or security review. If the file says one thing and the codebase consistently does another, the agent receives conflicting signals.

Fix: describe the current architecture and point to the files or scripts that prove it. Update the guide when the project changes.

2. Duplicating instructions across files

Copying the same rules into AGENTS.md, tool-specific files, and long prompt templates creates drift. One file gets updated while another keeps an obsolete command or directory name.

Fix: keep durable, tool-neutral decisions in AGENTS.md. Put only genuinely tool-specific behavior elsewhere, and make one document the source of truth.

3. Writing a wall of vague advice

“Write clean code” and “follow best practices” are hard for both humans and agents to apply. Long prose also hides the few rules that matter most.

Fix: use concrete checks: which command runs, where tests live, what must never be committed, and what a completed change must include.

4. Forgetting repository scope

5. Omitting security boundaries

An agent should not infer that browser input is trusted, that a hidden UI control is authorization, or that an environment variable is safe to expose. Missing reminders around secrets and server boundaries can turn a quick change into a serious bug.

Fix: state where authentication, authorization, validation, and secret-bearing code belong. Explicitly forbid logging tokens and committing credential files.

6. Letting rules contradict local conventions

A template that mandates a new architecture can be worse than no template. Forcing a team to rename folders, change its package manager, or adopt a different data-access pattern adds noise to every task.

Fix: use AGENTS.md to explain existing conventions first. Add exceptions only when the repository has made a deliberate decision.

7. Never testing whether the guidance works

A file can look excellent and still be ignored, stale, or too broad. Without a small verification loop, nobody knows whether an agent sees the right context.

Fix: make a harmless test edit, run the narrowest relevant checks, and review the diff. Remove rules that produce irrelevant suggestions.

A practical AGENTS.md checklist

Before relying on a project guide, confirm that it:

names the real stack and directory layout;
lists the normal install, lint, typecheck, and test commands;
explains validation and authIf you want a ready-to-adapt starting point, the free Vildanden Agent Config sample includes an AGENTS.md, a lean companion guide, scoped rules, and prompt templates for a Next.js + React workflow:

Download the free Vildanden sample

You can also preview the material on the Vildanden landing page. For builders who prefer an optional $9 crypto checkout, the same Vildanden offer is available at less-buddy-712.rehost.page.

Start small: adapt the sample to your repository, keep the rules honest, and review every generated diff. An effective AGENTS.md is not the longest one—it is the one that stays accurate when the code changes.

*Disclosure: This post was created for Vildanden. Templates are starting points, not a substitute for engineering judgment, testing, or security review.*orization at server boundaries;

keeps secrets, credentials, and private data out of source and logs;
defines a clear finish state for changes;
avoids duplicating long instructions in multiple places; and
is reviewed whenever the repository architecture changes.

An instruction written for a small app may be wrong in a monorepo, a src/ layout, or a project with multiple services. Generic paths and commands can lead the agent to edit the wrong package.

Fix: name the relevant directories, package manager, test commands, and service boundaries. Say when a rule applies only to one package.

Free Next.js Cursor Rules and Agent Config Starter Pack

Vildanden — Fri, 18 Sep 2026 13:58:10 +0000

If you are starting a Next.js App Router project, a small set of practical AI coding rules can make every prompt more consistent.

The free Vildanden Agent Config sample includes a ready-to-copy AGENTS.md, CLAUDE.md, and Cursor rules for Next.js. It is designed for quick setup, clear conventions, and less prompt repetition.

Get the free sample: https://fairly-charlie-907.rehost.page/

Want the complete four-stack pack? The $9 crypto checkout is here: https://less-buddy-712.rehost.page/

Start small, keep the rules in your repository, and refine them as your codebase grows.

DEV Community: Vildanden

Give your coding agent an "ask first" list, not just a "never" list

A three-bucket layout for AGENTS.md

Why it works

Keep agent config under 80 lines — push stack rules into .mdc files

Put a tiny deny-list in every agent config before the wish-list

One stack-specific Cursor rule file beats a giant AGENTS.md dump

Make coding agents fail closed — a tiny PR checklist in your repo

Give your coding agent a deny-list for secrets and path writes

Put secrets and path rules in Cursor .mdc files, not AGENTS.md

Put secrets and path rules in Cursor .mdc files, not AGENTS.md

A tiny contract that keeps coding agents scoped

Free AGENTS.md starter — copy into a Next.js App Router repo

Free AGENTS.md starter for Next.js App Router

A Small AGENTS.md Baseline for Next.js Teams

What to put in AGENTS.md

A practical review loop

AGENTS.md Pitfalls: 7 Mistakes That Make Coding Agents Less Reliable

1. Treating AGENTS.md as universal truth

2. Duplicating instructions across files

3. Writing a wall of vague advice

4. Forgetting repository scope

5. Omitting security boundaries

6. Letting rules contradict local conventions

7. Never testing whether the guidance works

A practical AGENTS.md checklist

Free Next.js Cursor Rules and Agent Config Starter Pack

A three-bucket layout for `AGENTS.md`

Put secrets and path rules in Cursor `.mdc` files, not `AGENTS.md`