Free download · v1.1.0 · MIT

Cursor rules pack
for Next.js apps.

9 scoped .cursor/rules files and an AGENTS.md template for Next.js apps on Supabase, Stripe, Tailwind v4 + shadcn/ui and the Vercel AI SDK. They target the mistakes agents make most in those stacks.

Download free pack20 KB

No email, no signup. One zip, MIT license. Read the files first ↓

View on GitHub

~/my-app

$ unzip vibeboot-cursor-rules-pack.zip

  • .cursor/rules/
  • 00-workflow.mdcalways
  • security.mdcalways
  • access-control.mdc**/app/**
  • nextjs-app-router.mdc**/app/**
  • supabase.mdc**/supabase/**
  • stripe.mdc**/stripe/**
  • stripe-webhooks.mdc**/*webhook*/**
  • tailwind-shadcn.mdc**/*.tsx
  • ai-sdk-chat.mdc**/api/chat/**
  • AGENTS.mdall agents
  • CLAUDE.mdclaude code
  • README.md · CHANGELOG.md · LICENSE

14 files · 20 KB · ready

  • 9 .mdc rules
  • 2 always on
  • 7 load by file glob
  • released Oct 27, 2026

01What's inside

One rule per stack. Each loads only when it's needed.

  • 01always

    Agent workflow

    00-workflow.mdc

    Read first, plan multi-file changes, keep diffs small, ask before new dependencies, no surprise version bumps, verify before saying done.

    Any project

  • 02always

    Security guardrails

    security.mdc

    Secrets stay server-side, every action re-checks auth, ownership-scoped queries, no open redirects or SSRF.

    Any project

  • 03auto-attach

    Access control

    access-control.mdc

    Session checked in every action and route, ownership-scoped reads and writes, 404 for other users' ids, roles and plans from the database.

    Any Next.js app

  • 04auto-attach

    Next.js App Router

    nextjs-app-router.mdc

    Server Components by default, async params, Server Actions that validate, updateTag/revalidateTag, proxy.ts.

    Next.js 15 / 16

  • 05auto-attach

    Supabase

    supabase.mdc

    Per-request server clients, getClaims()/getUser() instead of getSession(), RLS on every table, migrations + types.

    @supabase/ssr

  • 06auto-attach

    Stripe billing

    stripe.mdc

    Prices decided server-side, Checkout tied to the user, webhook-only plan sync, server-side gating, Customer Portal.

    Stripe Node SDK

  • 07auto-attach

    Stripe webhooks

    stripe-webhooks.mdc

    Raw body with req.text(), the right whsec_ per environment, test vs live never mixed, duplicate and out-of-order events, CLI replay.

    Stripe Node SDK

  • 08auto-attach

    Tailwind v4 + shadcn/ui

    tailwind-shadcn.mdc

    CSS-first @theme, v4 class renames, no interpolated class names, semantic tokens and cn().

    Tailwind CSS v4

  • 09auto-attach

    AI SDK chat

    ai-sdk-chat.mdc

    convertToModelMessages + toUIMessageStreamResponse, useChat parts, server-owned prompts, stopWhen, quotas.

    AI SDK 5+

  • 10template

    AGENTS.md template

    AGENTS.md

    Project, stack, commands, file map, conventions and a definition of done, with placeholders to fill in.

    Cursor, Claude Code, Codex

02What it catches

The mistakes agents keep making.

Each line below is written into a rule as a direct instruction, so the agent gets it right on the first pass instead of after your third correction.

nextjs-app-router.mdc

Without the rule: "use client" on the page to fix one onClick

With the rule: Server Component page, a small client leaf for the button

supabase.mdc

Without the rule: getSession() to authorize on the server

With the rule: getClaims() or getUser(), which verify the token

stripe-webhooks.mdc

Without the rule: await req.json() before constructEvent, and one whsec_ copied into every environment

With the rule: await req.text() first, one secret per endpoint and mode, repeated event ids skipped

access-control.mdc

Without the rule: findUnique({ where: { id } }) with the id from the URL

With the rule: { id, userId: session.user.id } in the query, 404 if it isn't yours

security.mdc

Without the rule: NEXT_PUBLIC_STRIPE_SECRET_KEY

With the rule: Secrets stay server-only, in .env.example with a comment

tailwind-shadcn.mdc

Without the rule: bg-${color}-500 and a new tailwind.config.js

With the rule: Full class names, tokens in @theme, v4 renames

ai-sdk-chat.mdc

Without the rule: toDataStreamResponse() and a client-sent system prompt

With the rule: toUIMessageStreamResponse(), prompt and model stay on the server

03Read every file

Preview, copy, or take one file.

These are the exact files in the zip. Copy a single rule into your project or download it on its own.

Download all · 20 KB

vibeboot-cursor-rules-pack/

.cursor/rules/00-workflow.mdc

Agent workflow17 linesloads on every request
---
description: How the agent plans, edits and verifies changes in this repo
alwaysApply: true
---

# Working agreement

- Read before you write. Open the files you're about to change and the closest existing example of the same pattern (another route, component or action), then follow that pattern instead of inventing a new one.
- For changes that touch more than two files or change structure, write a short plan first (files, approach, risks), then implement it.
- Keep diffs scoped to the task. Don't reformat, rename or "clean up" unrelated code, and don't delete comments or tests you didn't add.
- Ask before adding a dependency: say what it's for and why an installed package or a few lines of code won't do. Use the package manager that matches the lockfile (`package-lock.json` npm, `pnpm-lock.yaml` pnpm, `bun.lock` bun, `yarn.lock` yarn).
- Don't change the version of `next`, `react`, the auth library, the ORM or the payment SDK, and don't run upgrade codemods, unless the task asks for it. Version bumps go in their own change with the lockfile committed.
- Check the installed version in `package.json` before using a library API. If your memory of an API disagrees with the installed types, the installed version wins.
- Never invent env vars, routes, table names or API fields. Search the codebase first. If something really doesn't exist yet, say so and propose it.
- Stop and ask one specific question before anything destructive or hard to undo: deleting data, migrations, auth or billing changes, renaming public URLs.
- Before you say "done", run the typecheck, lint, test and build scripts that exist in `package.json`, fix what fails, and report what you ran. If you couldn't run something, say so.
- End with a short summary: what changed and where, plus anything a human must do (new env var, migration, dashboard setting).

next: skip the next one

Skip the setup. The VibeBoot SaaS Starter ships with its own project, Stripe and database .cursor/rules, AGENTS.md and CLAUDE.md already written for its code, plus auth, Stripe and a database on Next.js 16.4.3. $49, one-time.

14-day money-back guarantee · lifetime updates

Get the SaaS StarterWhat's inside →

Building an AI chat app? The AI Chatbot Starter ships streaming chat, saved conversations, Free/Pro usage limits enforced on the server and Stripe, with AGENTS.md and .cursor/rules. Get the AI Chatbot Starter, $59

04Install

In your repo in about a minute.

  1. 1

    Unzip and copy

    Copy the rules and AGENTS.md into your project root. cp -n never overwrites a file you already have.

  2. 2

    Delete what you don't use

    No Supabase? Delete supabase.mdc. No AI? Delete ai-sdk-chat.mdc. Unused rules only cost context.

  3. 3

    Fill in AGENTS.md

    Replace the <placeholders>: commands, folder map, landmines. Then check Customize > Rules in Cursor.

terminal · project root

$ unzip vibeboot-cursor-rules-pack.zip$ mkdir -p .cursor/rules$ cp -n vibeboot-cursor-rules-pack/.cursor/rules/*.mdc .cursor/rules/$ cp -n vibeboot-cursor-rules-pack/AGENTS.md vibeboot-cursor-rules-pack/CLAUDE.md .
How Cursor loads a rule
FrontmatterWhen it loadsIn this pack
alwaysApply: trueEvery Agent request00-workflow, security
alwaysApply: false + globsA matching file is in contextnextjs, supabase, stripe, tailwind, ai-sdk
alwaysApply: false + descriptionAgent decides it's relevantEvery rule has a description too
no globs, no descriptionOnly when you @-mention itNone

05Skip the setup

Want the rules already wired into a working app?

The VibeBoot starters ship with their own .cursor/rules, AGENTS.md and CLAUDE.md, written for their exact files and following the same conventions as this pack. Auth, Stripe and the database are already built and tested.

One-time price, no subscription. Full refund terms in the terms.

$ not buying today?

Get the next template and the build guides by email.

New VibeBoot starters, Cursor + Claude Code workflows, Stripe and Next.js how-tos. Free, occasional, unsubscribe in one click.

Subscribe free

Need a full AGENTS.md for your exact stack? Use the free AGENTS.md generator. Need one rule tailored to your exact stack instead? Try the free Cursor rules generator, or read the best Cursor rules for a Next.js SaaS.

FAQ

Is the Cursor rules pack really free?

Yes. It's a direct zip download under the MIT license. No email, no account. You can use, change and share the rules in personal and commercial projects. The newsletter is optional and only sends rule updates and new templates.

Where do the files go?

The .mdc files go in .cursor/rules/ in your project root, and AGENTS.md and CLAUDE.md go in the root itself. Cursor picks up .cursor/rules automatically. Plain .md files inside .cursor/rules are ignored, which is why the rules use the .mdc extension with frontmatter.

Will these rules flood my context window?

No. Only the two short rules (workflow and security) use alwaysApply: true. The stack rules use globs, so Cursor attaches them only when you work on matching files, like the Stripe rule for billing code.

Does it work with Claude Code, Codex or other agents?

Yes. AGENTS.md is read by Cursor, Codex and other agents that follow the AGENTS.md convention. The included CLAUDE.md imports AGENTS.md for Claude Code and tells it which .mdc file to read before each area of the code.

Which versions do the rules target?

Next.js 15 and 16 (App Router), React 19, Tailwind CSS v4, shadcn/ui, @supabase/ssr, the Stripe Node SDK and AI SDK 5 or later. Each rule tells the agent to check the installed version in package.json first and to trust installed types over memory.

How is this different from the Cursor rules generator?

The generator builds one project.mdc from the options you pick. The pack is a set of separate, scoped rules plus an AGENTS.md template that you drop in and trim. Many people use both: the pack for the stack rules, the generator for a project-specific always-on rule.

Do the VibeBoot starters include these rules?

They ship with their own .cursor/rules, AGENTS.md and CLAUDE.md, written for their exact file layout, and follow the same conventions: Server Components by default, server-side auth checks, raw-body Stripe webhook verification and re-fetching subscriptions before writing. The SaaS Starter has project, Stripe and database rules; the AI Chatbot Starter adds an AI rule. They aren't identical copies of this pack.

vibeboot saas starter

Skip the setup. The VibeBoot SaaS Starter ships with its own project, Stripe and database .cursor/rules, AGENTS.md and CLAUDE.md already written for its code, plus auth, Stripe and a database on Next.js 16.4.3. $49, one-time.

14-day money-back guarantee · lifetime updates

Get the SaaS StarterWhat's inside →

Building an AI chat app? The AI Chatbot Starter ships streaming chat, saved conversations, Free/Pro usage limits enforced on the server and Stripe, with AGENTS.md and .cursor/rules. Get the AI Chatbot Starter, $59

> More free tools

All tools →