Free rules / Cursor

Free Cursor rules

Cursor reads project rules from .mdc files in .cursor/rules/. The frontmatter decides when a rule loads: alwaysApply: true puts it in every chat. This one sets the basics every agent should follow, whatever your stack.

Goes in: .cursor/rules/core.mdc · Format: Project rule (.mdc with frontmatter)

How to install

1. Create the folder .cursor/rules/ in your repo root.
2. Save the file below as .cursor/rules/core.mdc (any name works, but the extension must be .mdc; plain .md files there are ignored).
3. Fill in the [bracketed] project facts: stack, commands, files not to touch.
4. Commit it so your whole team gets the same rules. Check it shows up under Cursor Settings → Rules.

The rules file

---
description: Core agent workflow - read first, small diffs, no secrets, verify, report
alwaysApply: true
---
# Core agent rules (always on)

## Project facts (edit these)
- Stack: [e.g. Next.js 15, TypeScript, Tailwind, Postgres via Drizzle]
- Dev: `[npm run dev]` | Test: `[npm test]` | Typecheck: `[npx tsc --noEmit]` | Lint: `[npm run lint]`
- Don't touch: [generated files, e.g. `*.gen.ts`, `migrations/`, `components/ui/`]

## Before editing
- Read the files you will change plus 2-3 neighbours. Match their patterns, naming, error handling and test style.
- If the task touches more than one file or ~30 lines, write a short plan (files + approach) first.
- If the request is ambiguous, ask one focused question instead of guessing.

## While editing
- Make the smallest diff that fully solves the task. No drive-by refactors, renames or reformatting.
- Don't invent APIs, config options or package names. Check the codebase, lockfile or official docs first.
- Don't add a dependency without saying why. Prefer the standard library or what is already installed.
- Keep types honest: no `any`, `@ts-ignore`, `# type: ignore` or disabled lint rules to make errors go away.
- Don't hand-edit generated files, lockfiles or applied migrations unless asked.

## Secrets and safety
- Never hard-code, log or echo secrets. Read them from env vars at runtime.
- Every env var the code reads goes in `.env.example` with a placeholder value. `.env*` files (except `.env.example`) stay out of git.
- Public prefixes (`NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`, `PUBLIC_`) end up in the browser bundle. Never put server keys behind them.
- Ask before anything destructive: deleting data, dropping tables, `git push --force`, `rm -rf`, migrations against production.

## Verify
- Run what the project has: typecheck, lint, tests, build. Fix failures instead of suppressing them.
- New behaviour gets a test, or a one-line reason why not.

## Report
End every task with: what changed, files touched, how you verified it, and anything left undone or risky.

Notes

• Rule types come from the frontmatter: alwaysApply: true = always; globs = auto-attach for matching files; description only = the agent decides; none = only when you @-mention it.
• Prefer plain Markdown? Put the same body (without the frontmatter) in AGENTS.md at the repo root.

Want stack-specific .mdc rules for Next.js, FastAPI, Godot, Unity and discord.js, plus a detailed launch-safety rule? The Rules Mega Pack ($19) has them.

See how Cursor ranks on AgentRank (sister project)

Other tools: Claude Code · Windsurf · Lovable · Bolt