Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/anilcancakir/claude-code-plugin/setup-global-claude-mdgit clone --depth 1 https://github.com/anilcancakir/claude-code-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/anilcancakir/claude-code-plugin/setup-global-claude-md)<a href="https://agentmods.dev/commands/anilcancakir/claude-code-plugin/setup-global-claude-md"><img src="https://agentmods.dev/badge/commands/anilcancakir/claude-code-plugin/setup-global-claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00025 | $0.02879 |
| Opus 5 | $0.00013 | $0.01439 |
| Sonnet 5 | $0.00005 | $0.00576 |
| Haiku 4.5 | $0.00003 | $0.00288 |
Grade D, and why
setup-global-claude-md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat ~/.claude/.mcp.json 2>/dev/null; cat ~/.claude.json 2>/dev/null Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
cat ~/.claude/.mcp.json 2>/dev/null; cat ~/.claude.json 2>/dev/null Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
find ~/.claude/skills -name "SKILL.md" -maxdepth 3 2>/dev/null How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup Global CLAUDE.md
Generate or update ~/.claude/CLAUDE.md. Injected into every CC conversation as user-rules — main session AND plugin subagents.
Authoring knowledge: Section patterns, quality scoring, compression tactics, and dedup boundaries live in the claude-md-writer skill. Read it before writing any section content. The template at ${CLAUDE_PLUGIN_ROOT}/references/global-claude-md-template.md provides structural guidance.
Scope: This config is deliberately lightweight. It does NOT inject planning pipelines, Intent Gate, delegation directives, tier routing, or parallel subagent mandates. CC's native plan mode and default agent behavior stay in charge.
Section Ownership
| Type | Sections | Update Behavior |
|---|---|---|
| Fixed defaults | Identity bullets, Behavioral Guidelines, Rules defaults | Always regenerated verbatim from template. Never preserved from existing file — users get the latest baseline every run |
| Plugin-managed | Skills, MCP, LSP | Regenerated from template every run |
| User-managed | Identity opening line, Tech Stack, Rules extras | Preserved across updates. Changed only via interview |
The Identity bullet list, full Behavioral Guidelines block, and Rules default block are non-negotiable baselines — they are rewritten verbatim on every update, enhance, and overwrite run. Interview (Q3/Q5) can only APPEND rules, never remove or rewrite defaults. Q1 only tunes the opening sentence of Identity.
Phase 1: Discovery
-
Check
~/.claude/settings.json→ detect existingpermissions.denyandhooks.PreToolUseentries. Store as EXISTING_SETTINGS for Phase 4 merge. -
Check
~/.claude/CLAUDE.mdexistence → determine mode:- Exists +
$ARGUMENTS= "update" → extract user-managed sections (opening sentence, Tech Stack, Rules extras) verbatim, skip Phase 2. Fixed defaults and Behavioral Guidelines regenerate from template - Exists +
$ARGUMENTS= "enhance" or no argument → pre-fill interview from existing content. Fixed defaults still rewritten verbatim - Exists +
$ARGUMENTS= "overwrite" → fresh generation - Not exists → fresh generation
- Exists +
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 214 lines · 25 tokens per session scan D 92d484d1af40
setup-global-claude-md is a command published in the GitHub repository anilcancakir/claude-code-plugin (2 stars, last pushed 4mo ago), licensed MIT. It adds 25 tokens to every session and 2,879 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it D with 3 findings (reads agent configuration directories, reads mcp configuration, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
cc-council
Comprehensive multi-agent council review with 6 protocols, 10 specialists, scoped scoring (per-scope thresholds and weights), state machine orchestration, auto-fix, and 50+ configuration flags.
release
Release the plugin — bump version across 4 files, then optionally commit, tag, push, and create a GitHub Release.
agentos-status
Show AgentOS system status — agents, workers, health.
fierce-review
Deterministic adversarial code review (Workflow tier) for high-stakes scope.
micro-execute
Micro-task execution with per-task two-stage review (spec compliance + code quality).
design-review
Compare design (Figma URL or mockup image) against implementation to detect UI mismatches (colors, layout, typography).