OrcaReplay provides open, versioned archive of AI agent prompts and tool schemas

English · 简体中文 · 日本語 · 한국어 · Deutsch · Français · Español · العربية

A versioned, verifiable archive of system prompts, developer instructions, tool schemas and agent harnesses powering today's AI products. Captured with OrcaReplay.

Built by the team behind OrcaRouter — one API key and one endpoint for Claude, GPT, Gemini, Grok, DeepSeek, Qwen and the rest.

Find us: All model APIs · OrcaCode Review · OrcaReplay · OrcaRouter Lite

Connect: X · Discord · Hugging Face · Ollama

An agent's behaviour is not only in its weights. It is in the twenty-odd thousand characters of instructions a harness assembles and sends before your first word, and in the thirty-five tool definitions it sends with them. That text decides what the agent refuses, which tool it reaches for first, how it talks to you, and what it has been told about you.

Read it and the product stops being a black box. Keep it dated and diffable and a change in behaviour stops being folklore: you can point at the line that changed.

Thirty-one of these files are captures taken off the wire on our own machines — twenty runs, listed with their sizes, harness versions and the command that reproduces each one in docs/CAPTURES.md. The other seventy-five are inherited from CL4R1T4S, unedited, and indexed path by path in docs/UPSTREAM.md.

Every file here is one of two things, and the difference matters more than the contents.

Captured — pulled off the wire by a local proxy while the real harness ran unmodified: the prompt the tool on this machine actually sent, scrubbed of anything identifying, filed with its harness version, its mode, its size and the one command that produces it again. You do not have to trust it. Run the command and diff.

Reported — everything a local proxy cannot see. A chat product assembles its prompt server-side: claude.ai, ChatGPT and Gemini never send one from your machine, so their text can only come from the model repeating it, and it arrives as a transcript rather than as bytes on a wire. Those files are archived as received, dated where the date is known, and they carry the uncertainty that comes with that. Treat a captured file as evidence and a reported one as testimony.

npm i -g orcareplay
git clone https://github.com/Continuum-AI-Corp/OrcaReplay
node capture/capture.mjs claude --model claude-opus-5

It stands up a local proxy, launches the agent unmodified, waits for the request that carries the prompt, pulls the prompt out, replaces your home directory, username, git identity and gateway host with placeholders, and writes one file. Then open a pull request here — see CONTRIBUTING.md.

Codex, OpenCode, Qwen Code, Cursor, MiMoCode, Kilo and Hermes work the same way; the capture notes cover the per-harness detail, including the five that have to be reached with --tls-intercept, because their origin cannot be moved with an environment variable.

Four findings you can check against the files in this repository, without taking anyone's word:

• The harness is the variable. One model,nemotron-3.5-lightning-free , on two harnesses: 9,656 characters and 11 tools from OpenCode, 14,049 and 19 from Hermes. Same model, same free endpoint, different instructions and a different tool surface.
• So is the model. OpenCode sends three different templates across seven models. Five free ones open withYou are opencode, an interactive CLI tool ; Muse Spark gets a different opening and the responses dialect; GPT-5.6-Sol gets a third template andapply_patch in place ofedit andwrite . The prompt and the wire format are both chosen per model.
• Interactive is not the same prompt as -p. Claude Code on Fable 5.1 sends 26,131 characters and 35 tools from a terminal and 20,806 and 29 from a script, where the identity line itself changes toYou are a Claude agent, built on Anthropic's Claude Agent SDK . The prompt behind daily use and the one your CI job gets are two different prompts.
• A tier is not a prompt. MiMoCode sends byte-identical text and tools formimo-v2.5 andmimo-v2.5-pro . The tier changes the model behind the request and nothing about the request. And Cursor's system prompt is 1,955 characters — composed on Cursor's servers and sentback in the response, with another 19 KB of environment, rules, skills and tool namespaces riding in the user turn instead.

Orca-PromptVault/
├── README.md · CONTRIBUTING.md · LICENSE
├── docs/
│   ├── CAPTURES.md          every captured entry + the command that reproduces it
│   ├── UPSTREAM.md          what came from CL4R1T4S, path by path
│   └── i18n/                this README in 7 more languages
├── OpenAI/         ChatGPT/ · Codex/
├── Anthropic/      Claude/ · Claude-Code/
├── Google/         Gemini/ · Gemini-CLI/
├── xAI/            Grok/
├── Cursor/
├── Moonshot/       Kimi/
├── Alibaba/        Qwen/
├── ZAI/            GLM/
├── DeepSeek/
├── Meta/
└── Others/         one folder per product

Files sit under whoever ships the prompt, not whoever trained the model. An NVIDIA model driven by OpenCode is filed under OpenCode, because OpenCode wrote those instructions; Meta AI's own assistant is filed under Meta, because Meta did. One file per capture, named <harness>-<model>-<artifact>-<date>, so a file pulled out on its own still says where it came from.

Prompts, tool schemas, skill definitions, harness instructions — from any product, in any language. A capture with a reproducible command is the gold standard; a dated, honest transcript is welcome too. CONTRIBUTING.md has the naming rules, the provenance header and the short list of what we will not take (anything with credentials, personal data, or text you wrote yourself and cannot source).

Most wanted right now: DeepSeek, Gemini CLI, Kimi CLI/K2 agent, GLM coding plane, Copilot, Devin's current build, and anything from a non-English product.

These are the instructions a vendor sends to a model on behalf of a user — visible to that user by construction, and archived here for research, interoperability and public understanding of systems that millions of people now trust. Nothing in this repository is obtained by breaking into anything: the captures come from a proxy on our own machines, reading our own traffic, during our own sessions.

Nothing here contains credentials, API keys, personal data or account identifiers; every capture is scrubbed before it is written and a capture that cannot be scrubbed is not published. Prompts remain the property of their authors. If you own one and want it removed, open an issue and it goes.

This archive is for understanding agents, not for defeating their safety work. Pull requests whose purpose is a jailbreak payload are declined.

Everything here that is not an OrcaReplay capture — 75 of the 106 artifacts, four fifths of the bytes — is inherited from CL4R1T4S by @elder_plinius, whose work made the case that these documents are worth keeping at all. This repository carries that history commit by commit, keeps the corpus under AGPL-3.0, and adds to it rather than replacing it. Every inherited file is indexed back to its upstream path in docs/UPSTREAM.md.

The captured half is produced by OrcaReplay, which records any coding agent and replays the run byte-for-byte with no model called.

AGPL-3.0 for this repository. The archived prompts are the work of their respective owners and are collected here under fair use for research and transparency.