Home › Rules › API backend (FastAPI)

API backend (FastAPI) rules: AGENTS.md, CLAUDE.md & Cursor rules

Free to copy. File formats checked against the official docs on Oct 19, 2026 (sources).

Backends break their clients quietly. These rules make the AI validate input, keep existing endpoints stable, and prove changes with tests.

Stack these rules assume: Python 3, FastAPI, Pydantic models, pytest. Different stack? Customize it in the generator.

Quick start

  1. Copy the AGENTS.md below into your project's root folder.
  2. Fill in the three [bracketed] lines under "Project". Delete any rule that doesn't fit.
  3. Start your first chat with: "Read AGENTS.md and follow it for this whole session."

AGENTS.md (works across tools)

Read by OpenAI Codex, Cursor, GitHub Copilot, Claude Code (when there's no CLAUDE.md) and many other agents.

AGENTS.md
# AGENTS.md: API backend (FastAPI)

Instructions for AI coding agents working on this project. Replace anything in [brackets].

## Project
- What it is: [one sentence: what you are building and who it is for]
- Stack: Python 3, FastAPI, Pydantic models, pytest
- Version 1 only needs to: [the ONE thing it must do]

## Commands
- Install: `pip install "fastapi[standard]" pytest`
- Run the dev server: `fastapi dev main.py`
- Run tests: `pytest`
- Interactive docs: `http://127.0.0.1:8000/docs`

## Project rules
- Every request body and response uses a Pydantic model. No raw dicts in and out.
- Don't change the path, method, or response shape of an existing endpoint without asking. Add a new one instead.
- Every new endpoint gets at least one pytest test. Run pytest before saying it's done.
- Return proper HTTP status codes (400/401/403/404/422) with a short message. Never return a stack trace to the client.
- Secrets and database URLs come from environment variables.
- Put authentication on every endpoint that reads or changes user data. Ask if unsure which endpoints should be public.

## How to work
- Do one task per request. If my request is really several tasks, list them and do only the first.
- Before writing code, give a 3-line plan: what you'll change, which files, and how I'll test it.
- Make the smallest change that works. Don't refactor, rename, or reformat code I didn't ask about.
- Ask before adding a dependency, deleting or moving files, changing the data/database structure, or touching more than 3 files.
- If you're not sure a library, API, or setting exists in the version we use, say so and check the installed package or the docs instead of guessing.
- Never say something works unless you ran it or I confirmed it. Report errors exactly.
- Secrets (API keys, tokens, passwords) live only in environment variables or a .env file listed in .gitignore. Never print, hardcode, or commit them.
- Never run destructive commands (rm -rf, git reset --hard, force-push, dropping tables) without asking first.

## Finish every task with
1. What changed (list the files).
2. How to run or test it in under a minute, and what I should see.
3. A suggested git commit message.

Want a step-by-step kit?

Our paid templates ($6 to $9) add a full prompt sequence and a worked example on top of rules like these, for games, Discord bots, email triage, MVPs and fixing messy code.

Browse the kits → or get all 5 kits for $25 (save $14) →

Why each rule exists

Use it as CLAUDE.md (Claude Code)

Pick one:

  1. Do nothing. Current Claude Code versions read AGENTS.md when the project has no CLAUDE.md. Run /memory in a session to check it loaded.
  2. Import it (best if you want Claude-only extras, or you're on an older Claude Code). Create CLAUDE.md next to AGENTS.md:
CLAUDE.md (imports AGENTS.md)
@AGENTS.md

## Claude Code
- Use plan mode before any change that touches more than 3 files.
  1. Claude only? Save the same AGENTS.md text as CLAUDE.md instead. Don't keep two separate copies; they drift apart.

Heads-up: if a project has both files and CLAUDE.md doesn't import AGENTS.md, Claude Code reads only CLAUDE.md by default. More in AGENTS.md vs CLAUDE.md.

Use it as Cursor rules (.cursor/rules/*.mdc)

Cursor reads AGENTS.md too, so the file above already works. If you prefer Cursor's own Project Rules, split it into two .mdc files. The .mdc extension and frontmatter are required; Cursor ignores plain .md files in .cursor/rules.

.cursor/rules/core.mdc
---
description: Project overview and working rules for API backend (FastAPI)
alwaysApply: true
---

# API backend (FastAPI)

Instructions for AI coding agents working on this project. Replace anything in [brackets].

## Project
- What it is: [one sentence: what you are building and who it is for]
- Stack: Python 3, FastAPI, Pydantic models, pytest
- Version 1 only needs to: [the ONE thing it must do]

## Commands
- Install: `pip install "fastapi[standard]" pytest`
- Run the dev server: `fastapi dev main.py`
- Run tests: `pytest`
- Interactive docs: `http://127.0.0.1:8000/docs`

## How to work
- Do one task per request. If my request is really several tasks, list them and do only the first.
- Before writing code, give a 3-line plan: what you'll change, which files, and how I'll test it.
- Make the smallest change that works. Don't refactor, rename, or reformat code I didn't ask about.
- Ask before adding a dependency, deleting or moving files, changing the data/database structure, or touching more than 3 files.
- If you're not sure a library, API, or setting exists in the version we use, say so and check the installed package or the docs instead of guessing.
- Never say something works unless you ran it or I confirmed it. Report errors exactly.
- Secrets (API keys, tokens, passwords) live only in environment variables or a .env file listed in .gitignore. Never print, hardcode, or commit them.
- Never run destructive commands (rm -rf, git reset --hard, force-push, dropping tables) without asking first.

## Finish every task with
1. What changed (list the files).
2. How to run or test it in under a minute, and what I should see.
3. A suggested git commit message.

The project rules only attach when a matching file is in the chat (globs with alwaysApply: false). Want them on all the time? Change it to alwaysApply: true.

.cursor/rules/api-backend.mdc
---
globs: **/*.py
alwaysApply: false
---

# Project rules: API backend (FastAPI)

- Every request body and response uses a Pydantic model. No raw dicts in and out.
- Don't change the path, method, or response shape of an existing endpoint without asking. Add a new one instead.
- Every new endpoint gets at least one pytest test. Run pytest before saying it's done.
- Return proper HTTP status codes (400/401/403/404/422) with a short message. Never return a stack trace to the client.
- Secrets and database URLs come from environment variables.
- Put authentication on every endpoint that reads or changes user data. Ask if unsure which endpoints should be public.

Use either AGENTS.md or these .mdc files, not both, so you don't send the same rules twice. See Cursor rules vs AGENTS.md.

Related

Get the free Starter Rules, emailed instantly

  • A copy-paste rules file to save as AGENTS.md or CLAUDE.md, or paste into Lovable, Bolt, v0 or Replit: small steps, ask before risky changes, no fake "it works", secrets kept out of code.
  • A kickoff prompt that makes your AI ask up to 3 questions and plan 5 to 8 small, testable steps before it writes any code.
  • The habit that saves projects: work, test, commit.

After that, an occasional email when we publish a new guide or rules file.

Free. No spam. Unsubscribe anytime. See our privacy note.