devkit CLAUDE.md

A navigation and convention guide for devkit, a Claude Code plugin containing workflow tools and agent capabilities. It explains where the repository's skills, workflows, engine code, and enforcement rules live.

In plain words
What is it for?
Use it when working on devkit to locate skills and workflow definitions, understand the Go execution engine, inspect command restrictions, and keep its CLAUDE.md documentation accurate.
Why use it?
It helps an agent find the right files and follow the project's architectural conventions. It also reduces the chance of making changes that conflict with documented workflow or code rules.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/5uck1ess/devkit/claude-md
Clone the repo
git clone --depth 1 https://github.com/5uck1ess/devkit
Per session 1,620 This file is loaded in full into every session.
When invoked 1,620 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01620 $0.01620
Opus 5 $0.00810 $0.00810
Sonnet 5 $0.00324 $0.00324
Haiku 4.5 $0.00162 $0.00162

Measured yesterday against content hash 2fb78940e12c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

devkit CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 64 lines

How it starts

The opening of the file, as written. The whole thing — 64 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

Navigation map for Claude Code working in this repo. Anchor-style, not narrative — keep it short. pr-ready's doc-check targets this file, so stale entries get caught at PR time.

devkit is a Claude Code plugin: deterministic YAML workflow engine, dispatcher and capability skills, enforcement hooks, multi-agent consensus.

Layout

Path What Grep here for
skills/ 38 SKILL.md skills (engine dispatchers + capability tools) Skill descriptions; what each skill triggers (workflow or direct exec)
skills/_principles.yml Shared cross-cutting principle config Rules applied to every skill
skills/creating-workflows/ Workflow YAML schema reference Step types, parallel:/branch:/loop:/expect: semantics
workflows/ 22 YAML workflow definitions What each skill actually runs
src/engine/engine.go Go workflow executor How parallel: [ids] skips-then-fans-out (parallelChildren), branch eval, loop gates
src/engine/workflow.go Workflow struct + YAML parsing Step field definitions
src/cmd/guard.go Hook gatekeeper What Bash/Edit/etc. is allowed per step type + enforce level
src/cmd/workflow.go devkit workflow CLI command Workflow invocation entry point
src/cmd/mcp.go devkit mcp CLI command MCP server bootstrap
src/cmd/probe_local.go devkit probe-local CLI command Local-inference endpoint health probe (human + --json)
src/mcp/tools.go MCP tool schemas devkit_start, devkit_advance, devkit_list, devkit_status contracts
src/mcp/server.go MCP server implementation Tool dispatching
src/mcp/principles.go Principle injection How _principles.yml reaches workflows
src/runners/runner.go Model tier interface The smart/general/fast contract
src/runners/{claude,codex,gemini}.go Cloud tier implementations How each external CLI is called
src/runners/local.go Local runner (Ollama/llama-server/vLLM) OpenAI-compatible HTTP client; opt-in via DEVKIT_LOCAL_ENABLED=1
src/lib/state.go + state_json.go Workflow state persistence Running-state schema, step outputs
src/lib/state_lock_{unix,windows}.go Cross-platform file locking OS-specific state lock
src/lib/git.go Git helpers Diff collection, branch checks
src/lib/report.go Final-report formatting Workflow output rendering
hooks/hooks.json PreToolUse/PostToolUse/SubagentStop/Stop wiring Which shell script runs for which event
hooks/*.sh Individual hook scripts safety-check, audit-trail, pr-gate, stop-gate, lang-review, etc.
agents/*.md 6 subagent definitions documenter, improver, researcher, reviewer, security-auditor, test-writer
mcpb/ MCPB bundle (launcher, manifest.json, server) Packaged distribution artifact
bin/devkit User-facing CLI wrapper Shells out to the devkit-engine Go binary
resources/rules/ Language coding rules (common + go/python/rust/typescript/shell/java/kotlin/swift/csharp) Installed via the setup-rules skill
.claude-plugin/plugin.json Plugin manifest Name, version, mcpServers pointer
src/Makefile Build + test + version sync make build, make test, make check, make sync-version
commands/references/ 3 reference files pulled in by skills (debug-checklists.md, domain-probes.md, stub-patterns.md) Shared checklist/probe/stub content; write new work as skills

Read the full file on GitHub · 64 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 64 lines · 1,620 tokens per session scan A 2fb78940e12c

Subscribe to this mod's changes

devkit CLAUDE.md is an instructions file published in the GitHub repository 5uck1ess/devkit (5 stars, last pushed 13d ago), licensed MIT. It adds 1,620 tokens to every session, about $0.0081 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.