Skip to main content

Open Source Compliance Common Rules Template

Rules Generator

Select options in the generator below to create a configuration file you can download immediately.

This tool requires an Anthropic API key

It calls the Anthropic API directly from your browser. Enter your own Anthropic API key to use it right away; your key and inputs are sent only from your browser to Anthropic (they never pass through a trustedoss server). Usage is billed to your own Anthropic account.

Overview

This template is a common ruleset that makes AI coding tools automatically recognize open source policy when generating code. Paste it into each tool's configuration file such as CLAUDE.md, .cursor/rules, or .clinerules. As of 2026, OpenAI Codex, Cursor, GitHub Copilot, Devin Desktop, and Cline all officially support the common rules file AGENTS.md, so you can also keep a single AGENTS.md as the baseline and let per-tool files carry only the differences. Please modify the allowed/forbidden license lists to match your internal policy.

This template vs the Developer Guide

This page is a quick-start template for creating Rules files for AI coding tools on the spot. If you have already established an organizational Open Source Policy, see the Developer Guide for automatically applying that policy to development.

The rules file itself is an attack surface

A rules file is an instruction set the AI coding tool reads in every session. Anything planted there influences every code suggestion that follows.

The Rules File Backdoor, published by Pillar Security on 2025-03-18, hides instructions in a rules file using invisible characters such as zero-width joiners and Unicode Tags. The hidden instructions make the AI insert a backdoor into the code it suggests, and because the characters do not render on screen or in a PR diff, a change arriving from a fork passes review as-is. It was reproduced against Cursor's Rules for AI and GitHub Copilot instruction files.

How well this path actually works was measured by the AIShellJack study (arXiv:2509.22040). Evaluating GitHub Copilot and Cursor with 314 attack payloads covering 70 MITRE ATT&CK techniques, attack success rates across platforms ranged from 41% to 84%. The highest was 83.4% for Cursor in auto-approve mode on TypeScript scenarios; Copilot was comparatively lower at 41.1% to 52.2%.

So settle three things before you paste the template below.

  • Treat rules file changes as code review targets like any other change. Register CLAUDE.md, AGENTS.md, .cursor/rules/, .clinerules, and .github/copilot-instructions.md in CODEOWNERS so they cannot merge without approval.
  • Check for invisible Unicode characters before merging. The example below finds zero-width characters and the Unicode Tags block. If your diff viewer offers an invisible-character highlight option, turn it on as well.
  • Do not merge rules files from untrusted sources as-is. Pull requests from forks, rules copied from third-party repositories, and distributed templates should pass the check above and then be read in full by a person before merging.
Bash
# GNU grep syntax. The default macOS grep does not support -P, so use ggrep or rg.
grep -rlP '[\x{200B}-\x{200D}\x{2060}\x{FEFF}\x{E0000}-\x{E007F}]' \
  CLAUDE.md AGENTS.md .cursor/rules/ .clinerules .github/copilot-instructions.md

Controls covering the MCP servers, skills, and IDE extensions an agent calls are in Agent and MCP Tool Governance.

Full template

Markdown
---
## Open Source Policy

### License Management

When adding new external packages/libraries, always verify and document the license.

**Allowed Licenses**: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC

**Review Required Licenses** (legal review required): LGPL, MPL, CC-BY-SA

**Prohibited Licenses** (cannot be used without prior approval): GPL, AGPL, SSPL, Commons Clause

### Security Management

- Do not use package versions with known CVEs
- After adding dependencies, run one of the following commands:
  - npm: `npm audit`
  - Python: `pip-audit`
  - Container/General: `trivy fs .`
- Use the latest stable package version whenever possible

### SBOM Management

- SBOM update required when dependencies change
- Generation tools: cdxgen, syft, trivy
- Recommended format: CycloneDX (alternative: SPDX)

### Copyright

- Keep existing code copyright headers
- Include project license header when creating new files
- When copying code from another project, include source and license
---

Copy the content above and paste it into each tool's settings file. Once pasted, apply the three checks from the overview section to that file as well. For tool-specific application steps, see the links below.

Section-by-section explanation

Allowed, caution, and forbidden licenses

Allowed licenses in the MIT, Apache-2.0, BSD, and ISC families generally permit commercial use, modification, and distribution with notice obligations only, making them safe for most enterprise projects.

Caution licenses such as LGPL and MPL may trigger source disclosure obligations depending on how they are used, so legal review is required. CC-BY-SA is also a caution license. It does not restrict commercial use, but as a content license it leaves the reach of the ShareAlike obligation in software undefined. See License Classification for the reasoning.

GPL, AGPL, SSPL, and Commons Clause cannot be used without prior approval due to derivative-work disclosure obligations or commercial-use restrictions.

LicenseClassificationPrimary reason
MITAllowedNotice obligation only, no restrictions
Apache-2.0AllowedIncludes explicit patent grant
BSD-2/3-ClauseAllowedSimilar to MIT, no advertising clause
ISCAllowedSimplified MIT-family variant
LGPLCautionPossible source disclosure obligation for dynamic linking
MPLCautionSource disclosure obligation for modified files
CC-BY-SACautionContent license, derivative-work scope undefined
GPLForbiddenFull derivative source disclosure obligation
AGPLForbiddenSource disclosure obligation for network use as well
SSPLForbiddenFull service infrastructure disclosure obligation
Commons ClauseForbiddenRestricts commercial use

Security management

Because AI may recommend outdated versions based on its training data, it is important to run an audit command after adding packages and verify CVE exposure.

Prioritize the latest stable versions that include security patches. If you must pin a specific version, verify that no known vulnerabilities affect that version before use.

SBOM management

An SBOM is a specification that records all dependencies used by a project and serves as the foundation for vulnerability tracking and license audits. For CI/CD integration, refer to Quick CI/CD.

Internal policy customization

You should definitely customize this section

When adding allowed licenses, include only licenses approved by your internal legal team in the allowed list.

If you need to relax forbidden licenses and have an exception approved for a specific component, annotate that item with the approval reason and date.

You can also add language-specific audit commands to match your environment. For example, add cargo audit for Rust, govulncheck for Go, and dependency-check for Java in the security management section.

Tool-specific application

Self-study

Apply to a real project with Claude Code

The generator above creates a generic template. To analyze real project dependencies and generate customized files, use the agent below.

Prerequisite: Clone the Trusted OSS repository

Bash
cd agents/en/ai-coding-setup
claude

The agent automatically performs the following:

  • Analyzes project dependency files (package.json, requirements.txt, etc.)
  • Pre-detects forbidden-license packages and suggests replacement packages
  • Generates customized Rules files per selected AI coding tool
  • Generates a license risk report

Next steps