Drop-in instructions & skills that make any AI assistant integrate CardOS correctly and safely.
Building with the CardOS virtual-card API and using an AI coding assistant? Copy the file(s) for your tool into your project and your agent will know how to issue and manage cards the right way — auth, sandbox-first, idempotent money operations, no raw card data, signed webhooks.
| File | For | What it does |
|---|---|---|
AGENTS.md |
Any agent (Cursor, Codex, Claude Code…) | The universal guide — auth, SDK, idempotency, webhooks, safety rules, common flows. Follows the agents.md standard. |
skills/cardos/ |
Claude Code | A /cardos skill (SKILL.md + REFERENCE.md) that knows how to issue/manage cards via the SDK or MCP. |
.cursor/rules/cardos.mdc |
Cursor | A project rule with the CardOS do's and don'ts. |
CLAUDE.md |
Claude Code | Project memory pointing at the guide + skill. |
.windsurfrules |
Windsurf | Condensed rules. |
llms.txt |
LLMs / discovery | Machine-readable summary. |
Cursor — copy .cursor/rules/cardos.mdc into your repo's .cursor/rules/.
Claude Code — copy skills/cardos/ into your project's .claude/skills/ (or personal ~/.claude/skills/), and/or drop CLAUDE.md + AGENTS.md at the repo root. Then ask: "Issue a CardOS card for user 123456."
Codex / other agents — put AGENTS.md at your repo root.
Windsurf — copy .windsurfrules to your repo root.
- Use the
cardosSDK (TS) or thecardos-mcpserver (AI clients) — don't hand-roll HTTP. - API key is server-side only;
cms_sk_test_…= sandbox. Default to sandbox; confirm before live money actions. - Money operations are idempotent. Never display or log full card numbers — use hosted reveal/session links. Verify webhook signatures on the raw body.
- CardOS — https://cardos.dev · Docs — https://cardos.dev/docs · Reference — https://cardos.dev/reference
- SDK — https://github.com/CMSCardOS/cardos-sdk · MCP — https://github.com/CMSCardOS/cardos-mcp