Everything
Claude Code

The Numbers

Compatible Harnesses

• Claude Code (primary)
• Cursor IDE
• OpenCode
• Codex CLI
• Antigravity IDEs

# Quick install via marketplace
/plugin marketplace add \
  affaan-m/everything-claude-code

/plugin install \
  everything-claude-code@everything-claude-code

# Or clone + selective install
git clone https://github.com/affaan-m/everything-claude-code
./install.sh typescript   # language-specific

# Start using immediately
/everything-claude-code:plan "Build auth system"

Key Design Decisions

• Manifest-driven — tracks install state for incremental updates
• Language-scoped — install only what you need
• Cross-platform — macOS, Linux, Windows (PowerShell)
• Non-destructive — doesn't override existing configs

Language & Framework

Engineering Practices

• TDD methodology with verification loops
• E2E testing (Playwright)
• Code review patterns
• Strategic compaction

Infrastructure & Data

• ClickHouse query optimization
• PostgreSQL tuning
• Docker orchestration
• Database migrations
• API design patterns

Business & Content

• Article writing & content engines
• Investor materials & outreach
• Market research
• Documentation generation

Specialized

• On-device ML (PyTorch)
• Video processing (VideoDB)
• MCP server patterns

Planning & Architecture

/plan       # Structured task breakdown
/architect  # System design decisions
/research   # Deep-dive investigation

Development

/tdd         # Test-driven development
/build-fix   # Auto-resolve build errors
/refactor    # Structured refactoring
/dead-code   # Find and remove dead code

Quality & Security

/code-review    # Senior-level review
/security-scan  # Vulnerability analysis
/e2e            # End-to-end test generation

Learning & Evolution

/learn    # Capture mid-session insight
/evolve   # Cluster instincts into skills
/review   # Review learned patterns

Language-Specific Agents (v1.9.0)

• TypeScript reviewer + build resolver
• Python / PyTorch reviewer + build resolver
• Java / Kotlin reviewer + build resolver
• Go / Rust / Swift specialists

Hook Phases

Runtime Controls

# Profile levels
ECC_HOOK_PROFILE=minimal   # light touch
ECC_HOOK_PROFILE=standard  # default
ECC_HOOK_PROFILE=strict    # maximum checks

# Disable specific hooks
ECC_DISABLED_HOOKS=hook-a,hook-b

Rules are the guardrails that ensure consistent code quality regardless of which skill or agent is active. They're organized by language and always present in the agent's system prompt.

Supported Languages

What Rules Enforce

• Coding standards — naming, structure, idioms
• Security mandates — input validation, sanitization
• Error handling — explicit error types, no swallowing
• Testing requirements — minimum coverage, edge cases
• Framework patterns — idiomatic usage, anti-patterns

# Example: TypeScript rule enforcement
# The agent will always:
- Use strict TypeScript (no `any`)
- Prefer interfaces over types
- Handle errors explicitly
- Use ESM imports
- Add JSDoc for public APIs

How It Works

Contexts are layered on top of the base system prompt. They don't replace rules — they add mode-specific guidance.

# Context composition:
Base prompt
  + Language rules (always)
  + Active context (mode)
  + Skill knowledge (on demand)
  + Memory/state  (persisted)
  = Final system prompt

This layering keeps the base lean while allowing rich, task-specific knowledge to be injected only when needed.

The Problem

AI agents lose all context when a session ends. Every new session starts from scratch — no memory of decisions, patterns, or project state.

The Solution

• SessionEnd hook — auto-saves context to SQLite
• SessionStart hook — auto-loads context on resume
• Strategic compaction — prunes low-value context
• Pattern extraction — distills sessions into instincts

SQLite State Store

# State persists structured data
# between sessions:

session_context
  - project decisions
  - architecture choices
  - resolved issues

learned_patterns
  - coding preferences
  - error resolution paths
  - project conventions

instincts
  - confidence scores
  - usage frequency
  - evolution history

# Capture an insight
/learn "This project uses barrel exports
  for all feature modules"

# Review learned patterns
/review

# Evolve instincts into skills
/evolve

# Import/export for sharing
/export-instincts > team-patterns.json
/import-instincts < team-patterns.json

Why It Matters

AI agents generate code fast but can introduce vulnerabilities: SQL injection, XSS, leaked secrets, insecure defaults. AgentShield catches these before they ship.

Coverage

What It Scans

• SQL injection & NoSQL injection
• Cross-site scripting (XSS)
• Secret/credential leaks
• Insecure dependencies
• Missing authentication checks
• Improper input sanitization

# Run a security scan
/security-scan

# Output example:
CRITICAL SQL injection in user_query()
  Line 42: f"SELECT * FROM users
    WHERE id = {user_input}"
  FIX: Use parameterized queries

HIGH Hardcoded API key detected
  Line 8: api_key = "sk-..."
  FIX: Use environment variables

LOW Missing rate limiting on /api/login
  FIX: Add express-rate-limit middleware

Model Selection

Match model capability to task complexity. Don't use a large model for simple refactors.

Optimization Techniques

• System prompt slimming — remove redundant instructions
• Background process pruning — kill idle watchers
• Strategic compaction — auto-detect context bloat
• Selective skill loading — only inject relevant knowledge
• Context window awareness — monitor token usage

Git Worktrees

Run multiple agent instances on separate branches simultaneously using git worktree. Each gets its own working directory.

# Create parallel workstreams
git worktree add ../feature-auth feature/auth
git worktree add ../feature-api feature/api

# Run agents in each worktree
# They share the same repo but
# work on different branches

Cascade Method

Coordinated execution where one agent's output feeds the next:

1. 1. Planner decomposes the task
2. 2. Architect designs the solution
3. 3. Multiple coders implement in parallel
4. 4. Reviewer validates all branches
5. 5. Build resolver fixes integration issues

Bundled MCP Servers

MCP configs give the agent authenticated access to external services without embedding credentials in prompts.

# MCP config structure
# mcp-configs/github.json
{
  "name": "github",
  "transport": "stdio",
  "command": "npx",
  "args": [
    "@modelcontextprotocol/server-github"
  ],
  "env": {
    "GITHUB_TOKEN": "${GITHUB_TOKEN}"
  }
}

SaaS: Next.js + Supabase + Stripe

# .claude/config
language: typescript
framework: nextjs
database: supabase
payments: stripe
skills:
  - typescript-strict
  - nextjs-app-router
  - supabase-rls
  - stripe-webhooks

Go Microservices: gRPC + PostgreSQL

language: go
framework: grpc
database: postgresql
skills:
  - go-error-handling
  - grpc-protobuf
  - postgres-migrations

Django REST API: DRF + Celery

language: python
framework: django
async: celery
skills:
  - django-drf
  - celery-tasks
  - python-typing

Rust Service: Axum + SQLx

language: rust
framework: axum
database: postgresql
skills:
  - rust-ownership
  - axum-handlers
  - sqlx-queries

Detection Priority

Why This Matters

AI agents frequently generate wrong install commands (npm install in a pnpm project). This detection ensures correct commands every time.

# Project-level config
# .claude/package-manager.json
{
  "manager": "pnpm",
  "version": "9.x"
}

# The agent then uses:
pnpm add express     # not npm install
pnpm run build       # not npm run
pnpm exec tsc        # not npx

Checkpoint vs. Continuous

Grader Types

• Type checker — does it compile?
• Unit tests — does it pass existing tests?
• Linter — does it follow style rules?
• Security scan — is it safe?
• LLM grader — does it match intent?

Pass@k Metrics

Generate k solutions and measure what fraction passes all graders. Useful for benchmarking agent configurations against each other.

# CLAUDE.md - your project's brain
# This file is read by the agent at
# every session start.

# Project: E-commerce Platform

## Stack
- Next.js 15 (App Router)
- Supabase (Auth + DB + Storage)
- Stripe (Payments)
- Resend (Email)

## Conventions
- All components in src/components/
- Server actions in src/actions/
- Always use RLS policies
- Never use any type

## Active Skills
- nextjs-app-router
- supabase-rls
- stripe-webhooks
- typescript-strict

The Composition

When you run a command like /plan "add subscription billing", the system composes:

1. 1. CLAUDE.md context (always loaded)
2. 2. TypeScript rules (language match)
3. 3. Stripe skill (relevant to task)
4. 4. Planner agent (command delegation)
5. 5. Persisted memory (past decisions)

By the Numbers

Translations

• Korean translation (community)
• Chinese translation (community)

Notable Contributions

• InsAIts — security hook for CI/CD
• Biome optimization — faster linting rules
• VideoDB integration — video processing skills
• PowerShell installer — Windows support
• Bun/Next.js toolchains — modern runtime support

Selective Install

• Manifest-driven installer
• Tracks installation state
• Incremental updates (no full reinstall)

Language Expansion

• 6 new agents (TS, PyTorch, Java, Kotlin)
• Total: 10 language ecosystems covered
• Each gets reviewer + build resolver

Session Infrastructure

• SQLite state store for persistence
• Session adapters for structured recording
• Skill evolution foundation

Observer Reliability

• Memory explosion fixes
• Throttling + tail sampling
• Sandbox access correction
• Re-entrancy guards

New Skills

• PyTorch patterns, Bun/Next.js toolchains
• 8 operational domain skills
• MCP server patterns

What to Include

• Project structure — where things live
• Tech stack — exact versions and tools
• Conventions — naming, folder structure, patterns
• Active skills — which plugins to load
• Forbidden actions — what NOT to do

What to Avoid

• Verbose prose (wastes tokens)
• Obvious instructions ("write clean code")
• Credentials or secrets
• Long code examples (link to files instead)

# Lean, high-signal CLAUDE.md

# MyApp
Stack: Next.js 15, Supabase, TypeScript
Style: Biome (not ESLint)
Test: Vitest + Playwright

## Rules
- NO any types
- NO default exports
- Server components by default
- All DB access via Supabase RLS

## Structure
src/app/      # Routes
src/components/ # UI
src/lib/      # Shared utils
src/actions/  # Server actions
supabase/     # Migrations

Without everything-claude-code

• Generic code, no project awareness
• Wrong package manager commands
• No security scanning
• Forgets decisions between sessions
• One-size-fits-all approach
• Manual context re-loading
• No verification pipeline

With everything-claude-code

• Project-aware, convention-following code
• Auto-detected package manager
• AgentShield scans every PR
• Persistent memory across sessions
• Language-specific expertise loaded
• Auto-context from hooks + skills
• TDD + type check + lint pipeline