OrcaPromptVault

_{English · 简体中文 · 日本語 · 한국어 · Deutsch · Français · Español · العربية}

The open archive of how AI agents actually work.

A versioned, verifiable archive of system prompts, developer instructions, tool schemas and agent
harnesses powering today's AI products. Captured with
OrcaReplay.

Built by the team behind OrcaRouter — one API key and one endpoint
for Claude, GPT, Gemini, Grok, DeepSeek, Qwen and the rest.

Find us: All model APIs · OrcaCode Review · OrcaReplay · OrcaRouter Lite

Connect: X · Discord · Hugging Face · Ollama

Why this exists

An agent's behaviour is not only in its weights. It is in the twenty-odd thousand characters of
instructions a harness assembles and sends before your first word, and in the thirty-five tool
definitions it sends with them. That text decides what the agent refuses, which tool it reaches for
first, how it talks to you, and what it has been told about you.

Read it and the product stops being a black box. Keep it dated and diffable and a change in
behaviour stops being folklore: you can point at the line that changed.

What's inside

Thirty-five of these files are captures taken off the wire on our own machines — twenty-three
runs, listed
with their sizes, harness versions and the command that reproduces each one in
docs/CAPTURES.md. The other seventy-five are inherited from CL4R1T4S,
unedited, and indexed path by path in docs/UPSTREAM.md.

Captured, or reported

Every file here is one of two things, and the difference matters more than the contents.

Captured — pulled off the wire by a local proxy while the real harness ran unmodified: the
prompt the tool on this machine actually sent, scrubbed of anything identifying, filed with its
harness version, its mode, its size and the one command that produces it again. You do not have to
trust it. Run the command and diff.

Reported — everything a local proxy cannot see. A chat product assembles its prompt
server-side: claude.ai, ChatGPT and Gemini never send one from your machine, so their text can only
come from the model repeating it, and it arrives as a transcript rather than as bytes on a wire.
Those files are archived as received, dated where the date is known, and they carry the uncertainty
that comes with that. Treat a captured file as evidence and a reported one as testimony.

Capture one yourself

npm i -g orcareplay
git clone https://github.com/Continuum-AI-Corp/OrcaReplay
node capture/capture.mjs claude --model claude-opus-5

It stands up a local proxy, launches the agent unmodified, waits for the request that carries the
prompt, pulls the prompt out, replaces your home directory, username, git identity and gateway host
with placeholders, and writes one file. Then open a pull request here — see
CONTRIBUTING.md.

Codex, OpenCode, Qwen Code, Cursor, MiMoCode, Kilo and Hermes work the same way; the
capture notes cover
the per-harness detail, including the five that have to be reached with --tls-intercept, because
their origin cannot be moved with an environment variable.

What the archive already shows

Four findings you can check against the files in this repository, without taking anyone's word:

• The harness is the variable. One model, nemotron-3.5-lightning-free, on two harnesses:
  9,656 characters and 11 tools from OpenCode,
  14,049 and 19 from Hermes.
  Same model, same free endpoint, different instructions and a different tool surface.
• So is the model. OpenCode sends three different templates across seven
  models. Five free ones open with You are opencode, an interactive CLI tool; Muse Spark gets a
  different opening and the responses dialect; GPT-5.6-Sol gets a third template and apply_patch
  in place of edit and write. The prompt and the wire format are both chosen per model.
• Interactive is not the same prompt as -p. Claude Code on Fable 5.1 sends
  26,131 characters and 35 tools
  from a terminal and
  20,806 and 29
  from a script, where the identity line itself changes to You are a Claude agent, built on
  Anthropic's Claude Agent SDK. The prompt behind daily use and the one your CI job gets are two
  different prompts.
• A tier is not a prompt. MiMoCode sends
  byte-identical text and tools
  for mimo-v2.5 and mimo-v2.5-pro. The tier changes the model behind the request and nothing
  about the request. And Cursor's system prompt
  is 1,955 characters — composed on Cursor's servers and sent back in the response, with another
  19 KB of environment, rules, skills and tool namespaces riding in the user turn instead.

Layout

Orca-PromptVault/
├── README.md · CONTRIBUTING.md · LICENSE
├── docs/
│   ├── CAPTURES.md          every captured entry + the command that reproduces it
│   ├── UPSTREAM.md          what came from CL4R1T4S, path by path
│   └── i18n/                this README in 7 more languages
├── ChatGPT/        Codex/ · ChatKit-Studio/          OpenAI
├── Claude/         Claude-Code/                      Anthropic
├── Gemini/         Gemini-CLI/                       Google
├── Grok/                                             xAI
├── Kimi/ · Qwen/ · GLM/ · Meta-AI/ · DeepSeek/       Moonshot · Alibaba · ZAI · Meta
├── Cursor/ · Windsurf/ · Cline/ · Kilo-Code/         editors and IDE agents
├── OpenCode/ · Hermes/ · MiMoCode/ · MiniMax/        terminal agents
├── Devin/ · Manus/ · Replit/ · Factory-Droid/        autonomous and hosted
└── …                                                 one folder per product

One product, one folder, at the top level. Files sit under whoever ships the prompt, not
whoever trained the model: an NVIDIA model driven by OpenCode is filed under OpenCode/, because
OpenCode wrote those instructions; Meta AI's own assistant is filed under Meta-AI/, because Meta
did. The vendor is a column in the table above, not a directory — a path is for finding one
product, and nesting it under a lab meant knowing the lab before you could look. One file per capture, named
<harness>-<model>-<artifact>-<date>, so a file pulled out on its own still says where it came
from.

Contributing

Prompts, tool schemas, skill definitions, harness instructions — from any product, in any language.
A capture with a reproducible command is the gold standard; a dated, honest transcript is welcome
too. CONTRIBUTING.md has the naming rules, the provenance header and the short
list of what we will not take (anything with credentials, personal data, or text you wrote
yourself and cannot source).

Most wanted right now: DeepSeek, Gemini CLI, Kimi CLI/K2 agent, GLM coding plane, Copilot, Devin's
current build, and anything from a non-English product.

Provenance, ethics, takedowns

These are the instructions a vendor sends to a model on behalf of a user — visible to that user by
construction, and archived here for research, interoperability and public understanding of systems
that millions of people now trust. Nothing in this repository is obtained by breaking into
anything: the captures come from a proxy on our own machines, reading our own traffic, during our
own sessions.

Nothing here contains credentials, API keys, personal data or account identifiers; every capture is
scrubbed before it is written and a capture that cannot be scrubbed is not published. Prompts remain
the property of their authors. If you own one and want it removed, open an issue and it goes.

This archive is for understanding agents, not for defeating their safety work. Pull requests whose
purpose is a jailbreak payload are declined.

Credits

Everything here that is not an OrcaReplay capture — 75 of the 106 artifacts, four fifths of the
bytes — is inherited from CL4R1T4S by
@elder_plinius, whose work made the case that these documents are worth keeping at all. This
repository carries that history commit by commit, keeps the corpus under AGPL-3.0, and adds to it
rather than replacing it. Every inherited file is indexed back to its upstream path in
docs/UPSTREAM.md.

The captured half is produced by OrcaReplay,
which records any coding agent and replays the run byte-for-byte with no model called.

License

AGPL-3.0 for this repository. The archived prompts are the work of their respective
owners and are collected here under fair use for research and transparency.