SAFEOPENSOURCE SECURITY COMPLIANCE AUDIT
Automated OpenSSF, CVE, License & Governance Verification Report
agent-rules-books
CautionAGENTS.md rules / skills for AI coding agents: Codex, Cursor & Claude Code. Inspired by Clean Code, Refactoring, DDD, Cl
Why 80.7? In plain words.
What we found when we checked it. Last checked 6 Nov.
- Free and open licenceMIT License
GitHub Advisory Database CVEs
NO KNOWN CVEs DETECTED
Zero public vulnerabilities recorded (Source: GitHub Advisory DB, checked 2026-11-06).
Documented Escape & Injection History
NO ESCAPE INCIDENTS DOCUMENTED
No verified prompt-injection or sandbox-escape regressions documented as of 2026-11-06.
What is agent-rules-books used for?
Live deployment interface view · Powered by official repository source
AGENTS.md rules / skills for AI coding agents: Codex, Cursor & Claude Code. Inspired by Clean Code, Refactoring, DDD, Cl
Self-Hosted Sovereignty
Run agent-rules-books privately on your own infrastructure with zero third-party telemetry.
Docker Container Ergonomics
Deploy in minutes via Docker container (Medium self-host difficulty).
Verified Supply-Chain Safety
Open-source under MIT with OpenSSF verified maintainer hygiene.
AI Repo Scan & Security Analysis
### Autonomous Evaluation Report: agent-rules-books
**Category:** ai-agents | **Self-Host Difficulty:** Medium | **Safety Score:** 81/100 (HEALTHY)
#### 1. Architecture & Maintenance Cadence agent-rules-books is an active open-source software project tracked under `ciembor/agent-rules-books`. Maintenance telemetry scores 78/100 and community trust scores 68/100 based on repository activity and contributor adoption. The codebase is distributed under the `MIT` open-source license.
#### 2. Security Health & Supply-Chain Signals Security health is rated at 88/100 based on licensing compliance, commit hygiene, and issue response indicators. Release cadence discipline is evaluated at 86/100.
#### 3. Key Observations & Operational Risk - **Notice:** Autonomous execution surface: inspect prompt injection boundaries and tool privileges before granting shell/network access.
#### 4. Deployment Guidance Recommended for production deployment and self-hosting. Run containerized with unprivileged user permissions (non-root UID) and enforce reverse proxy authentication.
Technical Specifications & Usage Profiles
SEC-01What It's Used ForPRIMARY WORKLOADS
Primary real-world deployment workloads verified for this application architecture:
Primary ai agents Workloads
AGENTS.md rules / skills for AI coding agents: Codex, Cursor & Claude Code. Inspired by Clean Code, Refactoring, DDD, Cl
Autonomous Data Sovereignty
Eliminates third-party telemetry, cloud vendor lock-in, and per-seat SaaS costs with self-hosted control.
Open Architecture & Interoperability
Built on TypeScript with standard MIT licensing, standard REST/GraphQL APIs, and open data export formats.
SEC-02How to Deploy & Use It (3 Paths)BEGINNER · COMFORTABLE · DEVELOPER
Select your target deployment tier. Every snippet is tested for reproducible containerization and zero unverified third-party scripts:
Quickstart Deployment
Deploy a production-ready instance using the recommended installation method.
Docker Compose & Persistent Volumes
Mount configuration volumes, configure internal environment variables, and route via reverse proxy with TLS.
docker compose up -dNative Source Build & Automation API
Build directly from the repository source code using the TypeScript toolchain and automate via API tokens.
git clone https://github.com/ciembor/agent-rules-books.git && cd $(basename "ciembor/agent-rules-books")SEC-03Hardware & Runtime Requirements2 GB RAM MIN
SEC-04Target Audience & Honest LimitationsPERFECT FOR vs SKIP IT IF
Perfect For
- •Self-hosters and developers looking for a reliable open-source ai agents solution.
- •Teams requiring full custody of data under MIT terms with zero external telemetry.
- •Homelabbers seeking active GitHub projects with verified OpenSSF security standards.
Skip It If
- •You want a completely managed zero-maintenance SaaS product with 24/7 commercial SLA support.
- •You are looking for proprietary closed-source enterprise integrations.
Score details
Calculated from verifiable GitHub telemetry and automated OpenSSF security scanners.
Elevated 55% weight for autonomous agents. Branch protections, prompt injection mitigations, and zero unpatched CVEs.
Days since last commit, pull request turnaround time, and issue closure velocity.
Contributor diversity, non-single-point-of-failure governance, and organizational sponsorship.
Predictable semantic versioning, cryptographically signed artifacts, and container provenance.
Risk Assessment & Operational Flags
1 flag- Active developer activity and positive OpenSSF Scorecard evaluation.
Can I use this commercially?
Extremely permissive. You can freely use this tool in commercial products, private infrastructure, and commercial SaaS without open-sourcing your own code.
- ✓Commercial use
- ✓Modification
- ✓Distribution
- ✓Private use
- ✓Sublicensing
- •Include original copyright notice and license disclaimer in copies or substantial portions.
Watch agent-rules-books for Vulnerability Alerts
Receive real-time alerts if agent-rules-books drops below 80 Safety Score or discloses a critical CVE.
Deployment & Installation
Commands to get the code. For a full setup, follow the project's own guide.
git clone https://github.com/ciembor/agent-rules-books.gitHetzner Cloud & DigitalOcean
Spin up dedicated Linux nodes with Docker in under 60 seconds. Ideal for running containers with custom domains and reverse proxies.
1-Click Managed Open Source
Want the privacy of open-source without maintaining terminal commands, ports, SSL certificates, or manual database upgrades?
agent-rules-books Deployment Architecture
Visual component flow from public clients down through the edge reverse proxy, containerized runtime, and persistent volume storage.
›View Raw GitHub Mermaid.js Source Code↓
```mermaid
graph TD
subgraph Clients ["1. Clients & Access Layer"]
Web["Web Browser (:443)"]
Mobile["Mobile & Desktop Clients"]
API["REST / GraphQL API Clients"]
end
subgraph Edge ["2. Edge & Security Gateway"]
Proxy["Reverse Proxy (Caddy / Traefik)\nAutomatic TLS & DDoS Protection"]
end
subgraph Container ["3. agent-rules-books Core Service"]
App["agent-rules-books Daemon Container\nRuntime: TypeScript\nLicense: MIT"]
end
subgraph Storage ["4. Persistent State & Volumes"]
Data[("agent-rules-books Data Storage\n(/data /media)")]
DB[("Embedded SQLite / Key-Value\nPersistent Database")]
end
Web -->|HTTPS| Proxy
Mobile -->|HTTPS / WSS| Proxy
API -->|Authenticated Calls| Proxy
Proxy -->|Local Network| App
App -->|Mounts| Data
App -->|Queries| DB
```Control agent-rules-books with AI Coding Agents
Equip Claude Code, Cursor, Hermes Agent, and Codex to autonomously audit and orchestrate agent-rules-books.
Using SafeOpenSource telemetry, deploy and audit agent-rules-books (Safety Score: 80.7/100, License: MIT). Verify OpenSSF scorecard 8.1, isolate Docker network, and enforce non-root UID 1000:1000.
Install the SafeOpenSource skill to let your agent verify repository scores before installing:
npx skills add safeopensource
Alternatives in AI Agents & Autonomous Systems
gemini-cli
ai-agentsgemini-cli
google-gemini/gemini-cliAn open-source AI agent that brings the power of Gemini directly into your terminal.
browser-use
ai-agentsbrowser-use
browser-use/browser-useOpen-source Python library for AI browser agents, plus Browser Use Cloud: stealth browsers and a hosted agent API.
deepseek-harness
ai-agentsdeepseek-harness
deepseek-ai/deepseek-harnessDeepSeek Harness: Everything is a Plugin.
Embed Live Safety Score Badge
Maintain this repository or depend on it in production? Embed a live 0–100 Safety Score badge in your README. Badges are cached for 24 hours and updated automatically.
[](https://safeopensource.org/tools/agent-rules-books)