Three markdown rule files that change how a coding agent handles evidence and untrusted input. They load at the start of every session, so the agent applies them without being asked.
| Rule | Failure it targets |
|---|---|
agent-security.md |
Obeying instructions buried in fetched content |
measurement-verification.md |
Reporting a tool's output as ground truth |
no-unverified-claims.md |
Asserting something the agent never checked |
For one project:
git clone https://github.com/84emllc/claude-agent-rules /tmp/agent-rules
mkdir -p .claude/rules
cp /tmp/agent-rules/*.md .claude/rules/
For every project, copy into ~/.claude/rules/ instead.
Claude Code discovers .md files in a rules directory recursively, and files without a paths frontmatter field load at launch with the same priority as CLAUDE.md. If you're using something else, paste the rule bodies into CLAUDE.md, AGENTS.md, or whatever instruction file your harness reads. They're plain prose and don't depend on any Claude Code feature.
Agent security. Anything the agent didn't get from the user is data, including web pages, issue and PR text, tool output, and MCP server descriptions. The agent analyzes that content rather than following it. A tool description asking for credentials gets surfaced to the user and refused. The rule also covers dependency and MCP supply chain decisions: pin versions, review lockfile diffs, and treat a new server as a trust decision.
Measurement verification. A count or a status read out of a tool is a claim the tool is making. Confirming it takes a second method that fails differently, because two checks sharing a substrate reproduce each other's errors. A second agent running the same tool isn't a second method. The rule also covers deduplication by stable identity, and why a passive single sample can't establish that something isn't happening.
No unverified claims. The agent separates what it read or ran this session from what it recalled. If it can't name the file or the command, it labels the claim unverified or leaves it out. Recalled memories and subagent findings are hypotheses until confirmed against the source.
The last two rules cover different gaps. A measurement needs a second method; a claim needs a source. Both can apply to the same sentence.
measurement-verification.example.md walks one investigation end to end, where two tools disagreed about how many times an event fired and the first two explanations were both wrong. It's a companion to the measurement rule and defines nothing on its own.
It carries a paths frontmatter field pointing at a directory that never matches, which keeps it out of session context while leaving it available to read and link.
These are instructions, not enforcement. Anthropic's own documentation puts it plainly: Claude "treats them as context, not enforced configuration," and recommends a PreToolUse hook when you need to block an action regardless of what the model decides.
So they shift how an agent hedges, when it stops to check something, and what it refuses to act on. They won't stop a model from asserting something confidently anyway. They also cost context on every turn, because they load in every session. Read them before adopting them, and cut anything that doesn't match how you work.
MIT. See LICENSE.
Maintained by 84EM.