create-claude-setup

Scaffold a production-grade .claude/ directory into any repo.

npm create claude-setup

No prompts, no dependencies, no network calls. Writes files that don't exist, skips ones that do. Safe to re-run, safe in a repo that already has a .claude/.

--force     overwrite existing files
--dry-run   print what would be written, change nothing

What you get

CLAUDE.md                    project memory, @-imports the rules
.mcp.json                    4 MCP servers, no API keys needed
.claude/
  settings.json              permissions + hooks, with $schema
  .gitignore                 keeps settings.local.json out of git
  rules/                     code-style, testing, security
  agents/                    code-reviewer, security-reviewer, explorer, test-writer
  commands/                  /review, /test, /commit
  skills/learn-codebase/     fills the scaffold with real repo knowledge
  hooks/                     session-start.sh, pre-tool-guard.mjs

Then run /learn-codebase

The scaffold ships placeholders. Left unfilled, CLAUDE.md costs context every session and teaches nothing — so the CLI ends by pointing at the skill that replaces them.

Open Claude Code in the repo and run /learn-codebase. It fans out the shipped explorer agents to scan the repo in their own context windows, then fills in the CLAUDE.md TODOs, retunes the settings.json allow-list for your real package manager (the shipped one assumes npm), and writes at most two rules specific to this codebase.

It verifies before reporting: no TODO left, and the test, build and lint commands it wrote actually run. It writes only what it confirmed in a file — a CLAUDE.md with three invented commands costs more than an incomplete one.

Manual only (disable-model-invocation: true) — it never fires on its own.

MCP servers: claude-code-docs (http), context7, sequential-thinking, playwright. Picked because none need an API key and none duplicate a built-in tool. Claude Code asks approval on first run for each, so delete what you won't use. For servers that do need credentials, use ${API_KEY} expansion rather than committing the value.

Hooks: session-start.sh injects your branch, dirty-file count, and last three commits. pre-tool-guard.mjs denies rm -rf /, curl | sh, DROP TABLE and chmod 777; asks before force-push (--force-with-lease passes) and git reset --hard. Edit its RULES array. Both emit the JSON envelope on stdout and nothing else — a stray echo there breaks parsing silently.

If you'd rather fill it in by hand

/learn-codebase does all of this; the list is here so you know what it touches.

1. Replace every TODO in CLAUDE.md. Build and test commands first — the single-file test command is the one that pays for itself daily. Keep it under 200 lines; it loads into context every session.
2. Retune the settings.json allow list — it assumes npm. Leave the deny list alone, it blocks reading .env and keys.
3. Commit everything except settings.local.json.

MIT.