Borrowing it
Nothing to install: this file belongs to design-and-deliver/claude-code-autoconfig. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/design-and-deliver/claude-code-autoconfig/main/.claude/commands/autoconfig.mdgit clone --depth 1 https://github.com/design-and-deliver/claude-code-autoconfigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/design-and-deliver/claude-code-autoconfig/autoconfig)<a href="https://agentmods.dev/commands/design-and-deliver/claude-code-autoconfig/autoconfig"><img src="https://agentmods.dev/badge/commands/design-and-deliver/claude-code-autoconfig/autoconfig/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/design-and-deliver/claude-code-autoconfig/autoconfig"><img src="https://agentmods.dev/badge/commands/design-and-deliver/claude-code-autoconfig/autoconfig.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04476 |
| Opus 5.5 | $0.00000 | $0.01790 |
| Sonnet 5.5 | $0.00000 | $0.00895 |
| Haiku 4.5 | $0.00000 | $0.00448 |
Grade B, and why
autoconfig scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Offer Claude Code's auto permission mode. This is deliberately a **user-level** opt-in: Claude Code ignores `permissions.defaultMode: "auto"` in project `.claude/settings.json` (a repository cannot grant itself auto mode How it starts
The opening of the file, as written. The whole thing — 312 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Autoconfig
Configure Claude Code scaffolding for this project — settings, permissions, hooks, commands, and docs.
CLAUDE.md is intentionally kept minimal. Claude can read your config files directly — pre-populating project descriptions wastes tokens and dilutes important rules. Instead, CLAUDE.md grows organically through Discoveries as you work.
Setup Note: During autoconfig, prefer Glob/Read/Write tools over Bash commands. This ensures smooth setup without permission prompts. Only use Bash for the bootstrap step and opening the guide at the end.
Step 0a: Bootstrap files from latest package
MANDATORY: You MUST run this Bash command before doing anything else. Do not skip it. Do not assume it will fail. It is designed to work inside Claude Code sessions:
npx claude-code-autoconfig@latest --bootstrap
This downloads the latest package and copies slash commands, hooks, agents, docs, and settings into .claude/. The --bootstrap flag makes it safe to run inside Claude Code — it copies files and exits silently with code 0. If it fails (e.g., no network), continue anyway — the existing files will still work.
One failure is a hard stop. If the output says claude-code-autoconfig requires a newer Claude Code (● claude-code-autoconfig requires Claude Code vA.B.C or newer. followed by Your environment is running vX.Y.Z.), nothing was copied and nothing below can run correctly: the package's settings turn on Claude Code's Concise output style, which this version does not have. Show the user that block verbatim — the version required, the version found, and the claude update line — tell them to update Claude Code and then run /autoconfig again, and STOP. Do not continue to the later steps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 6c3418e70312
- 1mo ago Changed · +19 lines 4182db66e57d
- 1mo ago Changed · -1 lines 70d18694ffed
- 1mo ago Changed · +2 lines 77688195cb92
- 2mo ago First seen · 291 lines · 0 tokens per session scan B a68f7457f2a4
autoconfig is a command published in the GitHub repository design-and-deliver/claude-code-autoconfig (2 stars, last pushed 10d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,476 tokens. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
update-counts
Explicitly refresh public toolkit and committed marketplace source snapshots and numeric documentation.
watch
You are executing the /hydra:watch command. Live monitoring of all background agents with real-time status updates.
render
Inspect an archived transcript (gzipped) — show counts, tool calls, errors. Useful after a PreCompact or SessionEnd, before deciding to write a retroactive /continuum:checkpoint.
firebase-publish
Create or reuse a Firebase project, configure Hosting, and deploy the current static site. Never deletes.
gws-people
Search and look up Google Contacts and directory profiles.
check
Run a quick scan of the memory system's health. For daily use.