A Next.js AGENTS.md should answer the questions an agent cannot resolve safely from source code: which router is in use, where server boundaries live, how the repository proves a change, and what must never be exposed to the browser.
The broader AGENTS.md guide covers instruction design and nesting. This guide supplies a web-project template for Next.js, React, Tailwind, forms, metadata, and deployment checks.
Kill the default approach: repository encyclopedias
The default instruction file grows by accumulation. It repeats the README, lists every folder, records old incidents, and tells the agent to "follow best practices." Long context is not the same as useful context.
Keep only instructions that change a decision. Put tutorials in docs, repeated procedures in skills or scripts, and enforceable rules in code or CI.
By the end you will have
- A short root
AGENTS.mdfor a Next.js application - A rule for nested instructions in sensitive areas
- A verified command ladder
- The Next.js AGENTS.md Starter
- A monthly pruning test
Derive instructions from the repository
Before writing prose, inspect the actual project:
sed -n '1,220p' package.json
find src -maxdepth 3 -type d | sort
find . -name 'AGENTS.md' -o -name 'CLAUDE.md'
rg -n '"use client"|use server|generateMetadata|export const metadata' srcConfirm:
- App Router or Pages Router
- Next.js, React, and Tailwind versions
- Package manager and lockfile
- Test runner and real scripts
- Import alias and source layout
- Authentication and data clients
- Hosting platform and environment naming
Do not write commands you did not run. An instruction that says npm test in a pnpm repository creates failure before the agent edits a line.
Put architecture boundaries before style
Agents can infer semicolons from nearby code. They are less likely to infer why authentication must stay server-side or why one route is dynamic.
A useful file states:
- Server Components are the default
"use client"belongs on the smallest interactive leaf- Secrets and privileged clients never enter client bundles
- Mutations validate input and derive identity on the server
- Existing design tokens and components take precedence
- Metadata uses the repository's current helper or route pattern
- The narrow verification command runs before the full build
These rules protect architecture. Formatting belongs to Prettier and ESLint.
Scope nested files by risk
GitHub documents that the nearest AGENTS.md in the directory tree takes precedence for its area. GitHub's repository instruction guide also distinguishes repository-wide, path-specific, and agent instructions.
Use a nested file only when a subtree has a different contract:
AGENTS.md
src/
app/
api/
billing/
AGENTS.md
components/
lib/
db/
AGENTS.mdThe billing file may require idempotency tests and forbid live provider calls. The database file may require tenant-policy checks. Do not copy the root file into each folder.
Magnet: Next.js AGENTS.md Starter
Replace every bracketed value with repository truth:
# Repository guidance
## Stack and structure
- Next.js [version], React [version], [App/Pages] Router.
- Source lives in [src/]. Import alias: [@/].
- Package manager: [pnpm/npm/bun]. Do not change lockfile tooling.
## Architecture
- Prefer Server Components. Add "use client" only to the smallest interactive leaf.
- Keep secrets, privileged clients, and authorization checks on the server.
- Validate mutation input at the server boundary and derive identity there.
- Reuse existing components and design tokens before adding new patterns.
## Commands
- Focused check: [exact command]
- Typecheck: [exact command]
- Lint: [exact command]
- Tests: [exact command]
- Production build: [exact command]
## Working rules
- Preserve unrelated dirty changes.
- Keep the diff inside the requested user outcome.
- Read the nearest nested AGENTS.md before editing a scoped directory.
- Do not add dependencies, migrations, or external services unless the task requires them.
## Verification
- Run the narrowest relevant check after editing.
- Before handoff, run typecheck, lint, affected tests, and the production build.
- Browser-test changed user journeys at mobile and desktop widths.
- Report commands run, results, and any unverified risk.
## Security
- Never print or commit secrets.
- Do not trust client-supplied identity, roles, prices, or ownership.
- Ask before destructive data operations or production mutations.You should see: project-specific nouns and commands. If the file works unchanged in any repository, it is too generic.
Add a verified command ladder
Order commands by feedback cost:
- Formatter or file-level lint
- Focused unit or component test
- Typecheck
- Repository lint
- Integration or browser test
- Production build
The agent should run the cheapest command that can disprove its current change, then broaden before handoff. This keeps fast iterations without replacing the release gate.
Keep prompts out of enforceable policy
An instruction can request a test. CI can require it. Use the right layer:
| Need | Best home |
|---|---|
| Repository map and commands | AGENTS.md |
| Repeated release procedure | Script or skill |
| Formatting | Prettier or ESLint |
| Forbidden dependency or secret pattern | CI scanner |
| One task's acceptance criteria | Issue or plan |
| Durable architecture decision | ADR or focused documentation |
The instruction file points to enforcement; it should not imitate enforcement.
Failure modes
| Smell | Result | Repair |
|---|---|---|
| "Use best practices" | No decision changes | Name the exact boundary or command |
| Every historical incident becomes a rule | Important guidance loses attention | Promote repeats; archive one-offs |
| Full folder inventory | Rots after moves | List only architectural entry points |
| Commands copied from another repo | Verification fails immediately | Run and record local commands |
| Client/server rules omitted | Secrets or privileged code drift client-side | State the server boundary near the top |
When not to add another instruction
- The behavior can be enforced by a formatter, type, test, or permission
- The guidance applies to one issue only
- The text duplicates official framework documentation
- No observed mistake or repeated decision supports the rule
For a one-off incident, write a receipt. Promote it only when recurrence shows the repository needs persistent guidance.
Prune the file monthly
For every line, ask:
- Does it change a real decision?
- Is it still true in the current stack?
- Can a tool enforce it instead?
- Does a closer nested file own it?
Delete stale lines. Then give an agent a small task and check whether it selects the correct files and verification commands without extra prompting.
path
Turn instructions into an operating system
Agent OS Setup connects repository rules to skills, permissions, verification, memory, scheduled work, and handoff.
Your next action: paste the Next.js AGENTS.md Starter, replace every placeholder with verified repository truth, and delete any line that does not change a decision.