Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/alex-feel/claude-code-toolbox/claude-mdgit clone --depth 1 https://github.com/alex-feel/claude-code-toolboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/alex-feel/claude-code-toolbox/claude-md)<a href="https://agentmods.dev/instructions/alex-feel/claude-code-toolbox/claude-md"><img src="https://agentmods.dev/badge/instructions/alex-feel/claude-code-toolbox/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.15653 | $0.15653 |
| Opus 5 | $0.07827 | $0.07827 |
| Sonnet 5 | $0.03131 | $0.03131 |
| Haiku 4.5 | $0.01565 | $0.01565 |
Grade F, and why
claude-code-toolbox CLAUDE.md scanned grade F with 6 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
All Linux/macOS scripts refuse to run as root/sudo by default (`id -u == 0` in shell, `os.geteuid() == 0` in Python). Applies to all 6 entry points. Override: `CLAUDE_CODE_TOOLBOX_ALLOW_ROOT=1` (only exact value `1`; `tr Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
3. **Tier 3 -- `/dev/tty` fallback:** `_dev_tty_sudo_available()` → sudo with stdin from `/dev/tty` (enables password entry in piped mode like `curl | bash`; default `tty_timeout=60`) Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
**Null-as-delete (RFC 7396):** `null` values in `user-settings`/`global-config` delete the key from the target JSON. `_merge_recursive()` handles via `target.pop(key, None)`. Null in arrays is NOT deletion. Bare YAML key Reads MCP configurationmediumAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
`claude mcp remove` deletes the stored MCP OAuth tokens and client config of http/sse servers (keyed `<name>|sha256(JSON.stringify({type,url,headers}))[:16]` in `.credentials.json`), and `claude mcp add` restores only th Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
The repository publishes to PyPI as `cc-toolbox` via an in-place hatchling remap: `[tool.hatch.build.targets.wheel]` `only-include`s exactly four files (`scripts/{__init__,cli,setup_environment,install_claude}.py`) and ` Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
**Windows Executable Resolution:** On Windows, `shutil.which()` can resolve a command (e.g. `npm`/`npx`) to the extensionless Unix shell shim Node.js ships beside its `.cmd` wrapper; `subprocess.run(shell=False)` launche How it starts
The opening of the file, as written. The whole thing — 436 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Repository Purpose
This is the Claude Code Toolbox - a community project providing automated installers and environment configuration tools for Claude Code across Windows, macOS, and Linux. The toolbox enables users to quickly set up specialized environments with custom agents, MCP servers, slash commands, and hooks.
Key Architecture
Two-Tier Installation System
-
Platform-specific bootstrap scripts (minimal ~60 lines each)
- Windows: PowerShell scripts in
scripts/windows/ - Linux/macOS: Bash scripts in
scripts/linux/andscripts/macos/ - These install
uv(Astral's Python package manager) and run Python scripts
- Windows: PowerShell scripts in
-
Cross-platform Python scripts (comprehensive installers)
scripts/install_claude.py: Installs Git Bash (Windows) and Claude Code via native installers with npm fallbackscripts/setup_environment.py: Configuration-driven environment setup from YAML (sources: repo name, local file path, or remote URL)
Native Claude Code Installation Support
The installer uses a native-first approach with automatic npm fallback. Entry point: ensure_claude() → install_claude_native_cross_platform() → platform-specific install_claude_native_{windows,macos,linux}(). Platform-specific fallback chains: Windows uses Native installer (with HTTP retry) → GCS direct download → npm; macOS/Linux use Native installer → GCS direct download → npm. In native mode, npm is excluded from the chain.
Corrupt-binary detection and quarantine: get_claude_version() delegates to _probe_claude_version(), which classifies exec-format launch failures via _is_exec_format_error() (Windows winerror 193/216, POSIX errno.ENOEXEC) as a WARNING ("cannot execute on this machine (corrupt or architecture mismatch)") instead of the generic [FAIL]; FileNotFoundError is never classified as corruption. run_command() is untouched (its contract for other callers is preserved). ensure_claude()'s initial probe runs get_claude_version(quarantine_corrupt=True), so a corrupt native binary is moved aside via _quarantine_corrupt_native_binary() BEFORE any installation dispatch -- Windows renames to .exe.old (swept by _cleanup_old_claude_files() on the next run), Unix unlinks -- so it can no longer shadow npm installs through find_command()'s native-first priority. Quarantine acts only on the native target ~/.local/bin/claude[.exe]. Post-install verification executes the installed binary via _verify_installed_binary_executes() (probe + quarantine on corruption) on the native-installer and all GCS install paths across Windows, macOS, and Linux; on the Windows native-installer primary path a non-executing binary enters the existing recovery chain.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 436 lines · 15,653 tokens per session scan F b9beb2816efb
claude-code-toolbox CLAUDE.md is an instructions file published in the GitHub repository alex-feel/claude-code-toolbox (16 stars, last pushed 8d ago), licensed MIT. It adds 15,653 tokens to every session, about $0.0783 per session on Opus 5. A static security scan graded it F with 6 findings (asks for root, downloads and executes remote code, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
claude-code-artifacts-public CLAUDE.md
Instructions for alex-feel/claude-code-artifacts-public, covering claude.md, readme maintenance, category order, a category appears only when it has content and only standalone artifacts are cataloged.
semba-claude-plugins CLAUDE.md
Claude Code instructions for lc-semba-ryuichiro/semba-claude-plugins, covering claude.md, commands, linting, formatting and git hooks (lefthook).
cconami CLAUDE.md
Claude Code instructions for memyselfandm/cconami, covering claude code enhancements system, project overview, project goals, architecture overview and core components.
claude-skills CLAUDE.md
Claude Code instructions for secondsky/claude-skills, covering claude skills - project context, ⚠️ critical: communication rule — the most important rule, ⚠️ critical: repository policy - never touch jezweb repo, ❌ forbidden actions (jezweb repo) and ✅ required actions (secondsky repo).
claude-skills AGENTS.md
AGENTS.md instructions for secondsky/claude-skills, covering agent instructions, ⚠️ critical: communication rule — the most important rule and full project context.
goblin-mode CLAUDE.md
Claude Code instructions for JasonWarrenUK/goblin-mode, covering jason warren - claude code config, 1. technical profile, 1a. scales: preference & proficiency, 1b. domains and 1.2. frontend.