What is bounded-tools-mcp CLAUDE.md?

A set of project instructions for working on the bounded-systems/bounded-tools-mcp repository. It describes required startup checks, claiming work on an issue, and limits for working when organization context is unavailable.

Use it when contributing to the bounded-tools-mcp project and following its repository-specific operating rules.

It helps an agent follow that project’s workflow and avoid starting work without the required ownership and safety checks.

How bounded-systems/bounded-tools-mcp configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to bounded-systems/bounded-tools-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/bounded-systems/bounded-tools-mcp/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/bounded-systems/bounded-tools-mcp

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/bounded-systems/bounded-tools-mcp/claude-md/github.svg)](https://agentmods.dev/instructions/bounded-systems/bounded-tools-mcp/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/bounded-systems/bounded-tools-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/bounded-systems/bounded-tools-mcp/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/bounded-systems/bounded-tools-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/bounded-systems/bounded-tools-mcp/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 672 This file is loaded in full into every session.

When invoked 672 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00672	$0.00672
Opus 5.5	$0.00269	$0.00269
Sonnet 5.5	$0.00134	$0.00134
Haiku 4.5	$0.00067	$0.00067

Measured 1mo ago against content hash 19e8e9ef7e0f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bounded-tools-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

Copies of this mod

2 near-identical copies found in the catalogue:

site-mcp CLAUDE.md — 100% identical, 39 lines differ
verbspec-mcp CLAUDE.md — 100% identical, 39 lines differ

CLAUDE.md · 41 lines

What it actually says

bounded-systems sessions — before anything else

Bootstrap: run bash .claude/org-repair.sh — pre-approved where this repo's settings carry the org floor; generator-owned repos may still prompt. It executes a local or fetched copy ONLY if the bytes hash to a resolved digest, and refuses otherwise. The digest comes from the channel manifest (written only by the OIDC-pinned boot-manifest lane on main), with the legacy $ORG_BOOT_SHA256 honored first while it still exists — that variable was retired outright on 2026-08-16 (.github#192) and is absent from the dialog, so the manifest is the live source. bootstrap in effect → continue. REFUSED or a permission denial → stop and report; do not work around it.
Claim before working — doors, best reachable first (#529). Both mechanized doors REQUIRE a passkey token since .github#264: run node claim-ceremony.mjs (in bounded-systems/.github), approve on your device, pass what it prints as human_authorization. No token is a red run and there is no break-glass. The window can be as short as two minutes, so mint it immediately before dispatching. Releasing needs none.
1. claim-ticket.yml in bounded-systems/.github (workflow_dispatch: repo, issue, claimant, human_authorization) — the real door, lease-backed. Reachable only from a session created with .github attached; mid-session add_repo refuses it.
2. claim.yml in bounded-systems/.github-private (workflow_dispatch: issue, claimant, human_authorization) — for .github-private issues when door 1 is unreachable. A caller of the shared _claim.yml. Attests a KEYHOLDER approved this exact (repo, issue, claimant) — still not that the session IS the claimant (#530).
3. Hand-claim (assign + comment) — last resort only, when no door is reachable. It provides no exclusion (keycard#7, signerSelfAsserted) — a marker, not a claim; say plainly the window was down.
Whichever door: confirm the claim comment ON THE ISSUE names your claimant AND reads human-authorized. Any assignee or claimed label → someone else's; do not start. No issue → open one and claim it.
Degraded mode: no "bounded-systems — Claude context" block in your session context means the org context did not load. You may claim and work THIS repo only — no org-level [settings]/[org] changes, no cross-repo work.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · +19 lines · +324 tokens per session 19e8e9ef7e0f
2mo ago First seen · 22 lines · 348 tokens per session scan A f8b033304e9b

Subscribe to this mod's changes

bounded-tools-mcp CLAUDE.md is an instructions file published in the GitHub repository bounded-systems/bounded-tools-mcp (0 stars, last pushed 2d ago), licensed MIT. It adds 672 tokens to every session, about $0.0027 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

bounded-tools-mcp CLAUDE.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
bounded-tools-mcp CLAUDE.mdbounded-systems/bounded-tools-mcp	Instructions file	0	2d ago	MIT	A	672	Claude Code
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

bounded-tools-mcp: Instructions file for Claude Code