agentmods.dev

claude-code-setup

claude-code-setup is a command for coding agents from XinyuQu/llm-review. It costs 17 tokens per session (822 once invoked), scanned C, original, Apache-2.0.

A guided setup command for connecting Claude to the LLM Review add-on. It lets you choose Claude's command-line subscription login or an Anthropic API key when both are available.

In plain words
What is it for?
Use it to install or use the Claude command-line tool, provide an API key, check the current setup, or reconfigure Claude reviews.
Why use it?
It checks whether Claude is ready and guides you through the appropriate connection method. This removes the need to configure provider settings manually.

Command

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the llm-review plugin — 1 skill, 16 commands shipped together

not rated 6 +1 3mo ago C scan 17 tokens original Apache-2.0
View the source file XinyuQu/llm-review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/xinyuqu/llm-review/claude-code-setup
Clone the repo
git clone --depth 1 https://github.com/XinyuQu/llm-review

Or install llm-review, the plugin that ships this one along with the rest of its 1 skill, 16 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for claude-code-setup

README.md
[![agentmods](https://agentmods.dev/badge/commands/xinyuqu/llm-review/claude-code-setup.svg)](https://agentmods.dev/commands/xinyuqu/llm-review/claude-code-setup)
Your own site
<a href="https://agentmods.dev/commands/xinyuqu/llm-review/claude-code-setup"><img src="https://agentmods.dev/badge/commands/xinyuqu/llm-review/claude-code-setup.svg" alt="Measured on agentmods" height="20"></a>
Per session 17 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 822 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00017 $0.00822
Opus 5 $0.00009 $0.00411
Sonnet 5 $0.00003 $0.00164
Haiku 4.5 $0.00002 $0.00082

Measured 4d ago against content hash 159444d12fe4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

claude-code-setup scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Advanced — the **user** runs this in their own terminal (never you): `printf %s 'THE_KEY' | node "${CLAUDE_PLUGIN_ROOT}/scripts/llm-review.mjs" config-set --provider claude --transport api --api-key-stdin` (key via std

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

**Security — hard rule:** never run any command containing the literal key yourself; a crafted key can inject shell commands. If the user pasted a key into the chat, do NOT put it in a command — tell them it is now expos

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

allowed-tools: Bash(node:*), Bash(npm:*), Bash(curl:*), Bash(bash:*), Bash(sh:*), Bash(brew:*), AskUserQuestion
commands/claude-code-setup.md · 42 lines

What it actually says

Guided setup for the claude provider. Follow this exactly; do not improvise extra steps.

Step 1 — probe status:

node "${CLAUDE_PLUGIN_ROOT}/scripts/llm-review.mjs" setup --provider claude --json

Parse the JSON: mode, cli (command, installed, installCmd, login), api (hasKey, primaryEnv, keyHelp), ready, resolvedTransport, reviewCommand.

Step 2 — if already ready: tell the user it's set up via resolvedTransport, then AskUserQuestion once: Keep current setup vs Reconfigure. If keep → show status and stop.

Step 3 — choose a path by mode:

  • api-only → API KEY FLOW.
  • cli-only → SUBSCRIPTION FLOW.
  • both → AskUserQuestion exactly once: "How do you want to connect to Claude?" with options, first one suffixed (Recommended):
    • Subscription via the {cli.command} CLI (Recommended) — reuses your existing Claude Code login, usually cheaper for heavy use
    • API key — pay-per-token Anthropic API

SUBSCRIPTION FLOW:

  1. If cli.installed is false and cli.installCmd is set: AskUserQuestion once — Install {cli.command} now (Recommended) vs Skip for now. If install, run cli.installCmd via Bash, then re-run the Step 1 probe. If skip, present status and stop.
  2. Persist the choice: node "${CLAUDE_PLUGIN_ROOT}/scripts/llm-review.mjs" config-set --provider claude --transport cli
  3. Re-run the Step 1 probe. If cli.login indicates a login is still required (it is not the "already authenticated" note), tell the user to authenticate themselves in this session by typing: !{cli.login} — this is an interactive login you cannot perform for them. (For Claude this is normally already authenticated because Claude Code is running.)
  4. Present the final probe output.

API KEY FLOW:

  1. Tell the user where to get a key: api.keyHelp.

  2. Offer how to provide it, most secure first:

    • Recommended: run /plugin, open llm-review config, paste the key into the secure prompt (stored in the OS keychain).
    • Or export api.primaryEnv in their shell for this session.
    • Advanced — the user runs this in their own terminal (never you): printf %s 'THE_KEY' | node "${CLAUDE_PLUGIN_ROOT}/scripts/llm-review.mjs" config-set --provider claude --transport api --api-key-stdin (key via stdin, never in argv; writes ~/.config/llm-review/config.json, chmod 600).

    Security — hard rule: never run any command containing the literal key yourself; a crafted key can inject shell commands. If the user pasted a key into the chat, do NOT put it in a command — tell them it is now exposed, to add it via the keychain (/plugin) or their own shell env, and to rotate it.

  3. Re-run the Step 1 probe and present it.

Step 4 — finish: state whether the provider is now ready and show the exact review command (reviewCommand, i.e. /llm-review:claude-code). Use AskUserQuestion at most twice total in this whole flow.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 42 lines · 17 tokens per session scan C 159444d12fe4

Subscribe to this mod's changes

claude-code-setup is a command published in the GitHub repository XinyuQu/llm-review (6 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 17 tokens to every session and 822 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (asks for root, unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other commands, from other repositories

git

Git operations with intelligent commit messages and workflow optimization.

SuperClaude-Org/SuperClaude_Framework · 11 tokens

checklist

Generate a custom checklist for the current feature based on user requirements.

github/spec-kit · 13 tokens

clarify

Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.

github/spec-kit · 27 tokens

specify

Create or update the feature specification from a natural language feature description.

github/spec-kit · 13 tokens

analyze

Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.

github/spec-kit · 26 tokens

converge

Assess the current codebase against the feature's spec, plan, and tasks, then append any remaining unbuilt work as new tasks to tasks.md so implement can complete it.

github/spec-kit · 35 tokens