Skip to content

Centralized standards

The development standards live in the server, not in the repositories. This page explains what that changes, and how to point an agent to them from AGENTS.md.

What the server keeps

  • The standards are stored in the database, like the rules. They are not in your repository.
  • An administrator writes them on the Standards page of the web interface. They can also be imported from a TOML file.
  • Each standard lists its technologies and its file patterns (*.py, angular.json).
  • Every project gets the same standards. An update applies at once to every agent.

The benefit: you write your conventions once, for the whole organization. No repository needs to copy them anymore.

No skill to maintain

Without the server, sharing conventions with the agents usually means writing skills or instruction files: a Claude Code skill, Copilot instructions, Cursor rules... Each agent has its own format, and each file has to be copied into every repository or workstation, then kept up to date everywhere.

The centralized standards avoid this for the conventions:

Skills or instruction files Centralized standards
One format per agent Any MCP agent (Claude Code, GitHub Copilot, Codex, Cursor...) reads them through the security-review server
Copied into each repository or workstation Written once, on the Standards page
Updated by hand everywhere An update applies at once to every agent
All loaded, or chosen by the agent Selected by technology or by file (*.py, angular.json)

A skill is still useful for what is not a convention: a procedure, a script, a workflow of the team. The standards only replace the coding rules.

How to mention them in AGENTS.md

  • Do not copy the standards into AGENTS.md. The copies would soon drift apart.
  • Tell the agent to ask the server for them before coding.
  • Name the useful tools and resources: get_development_standards, list_development_standards, standard://{slug}.
  • Keep in AGENTS.md what is specific to the repository: test commands, structure, local exceptions.
  • Say who wins in case of conflict. For example: "AGENTS.md takes precedence over the standards of the server".

Example section:

## Coding conventions
The development standards are provided by the `security-review` MCP server.
Read them before writing code:
- tool `get_development_standards` (by technology or by file);
- tool `list_development_standards` to see the catalog;
- resource `standard://python` to read one standard.
This file only keeps the rules specific to this repository. In case of conflict, it wins.

A standard can never weaken security. If it does, the agent keeps the safe behavior and reports the conflict.