Borrowing it
Nothing to install: this file belongs to Houseofmvps/ultraship. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Houseofmvps/ultraship/main/CLAUDE.mdgit clone --depth 1 https://github.com/Houseofmvps/ultrashipWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/houseofmvps/ultraship/claude-md)<a href="https://agentmods.dev/instructions/houseofmvps/ultraship/claude-md"><img src="https://agentmods.dev/badge/instructions/houseofmvps/ultraship/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/houseofmvps/ultraship/claude-md"><img src="https://agentmods.dev/badge/instructions/houseofmvps/ultraship/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02635 | $0.02635 |
| Opus 5 | $0.01318 | $0.01318 |
| Sonnet 5 | $0.00527 | $0.00527 |
| Haiku 4.5 | $0.00264 | $0.00264 |
Grade A, and why
ultraship CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- All tools use `execFileSync` (not `execSync`) to prevent shell injection How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ultraship — Claude Code Plugin
All-in-one builder plugin for Claude Code. npm: ultraship, GitHub: Houseofmvps/ultraship.
Project Structure
.claude-plugin/ — Plugin manifest (plugin.json)
skills/ — 45 skills (workflow + specialist + growth/launch/intelligence; includes staying-current, a11y, ship-gate, evals)
agents/ — 13 agents (review, seo, seo-strategist, security, pentest, perf, a11y, browser, compete, launch, incident, growth, canary)
commands/ — 16 command files (/ship, /seo, /secure, /review, /perf, /profile, /bundle, /deps, /health, /redirects, /codex, /content, etc.). NOTE: every skill is ALSO a slash command, so /a11y, /sprint, /pentest, /compete, /canary, /launch, /rescue, /grow etc. all work — the 21 redundant command launchers that duplicated same-named skills were removed 2026-06-28 (Anthropic merged commands into skills).
tools/ — 41 Node.js tools (ga4-client, keyword-intelligence, index-doctor, seo-scanner, a11y-scanner, ship-gate, vibe-security-scanner, eval-scanner, lighthouse, pentest-scanner, codex-generator, etc.) + shared lib/ship-scoring.mjs (single source of truth for /ship + ship-gate scoring)
hooks/ — SessionStart + UserPromptSubmit (Currency Guard) + PostCompact hooks + guard hooks (PreToolUse for destructive command blocking)
docs/ — Documentation
Tech Stack
- Node.js ESM (type: module)
- Zero external dependencies — HTML parsing via
tools/lib/html-parser.mjs(inline SAX-style parser) - No build step — tools run directly via
node tools/<tool>.mjs - All tools use
execFileSync(notexecSync) to prevent shell injection
Key Tools
| Tool | Purpose |
|---|---|
seo-scanner.mjs |
SEO scanner (39 rules) + GEO signals (20 rules: AI bot access, snippet restrictions, structured data) + AEO signals (4 rules: schema checks). Cross-page analysis, analytics detection, canonical conflicts. |
a11y-scanner.mjs |
Static accessibility scanner (WCAG 2.2 A/AA subset): missing alt, unlabeled form controls, empty buttons/links, missing lang/title/main, heading order, positive tabindex, zoom disabled, duplicate ids, broken aria references. Zero false positives. Dispatched by /ship; rendered contrast/focus checks escalate to npx pa11y via the /a11y skill. |
ship-gate.mjs |
Blocking quality gate. Subcommands: init (write .ultraship/ship-gate.json thresholds), run (score via shared lib/ship-scoring.mjs, compare to thresholds, hard-fail on leaked secrets / critical findings, exit 1 on fail), ci (write .github/workflows/ship-gate.yml), hook (write .git/hooks/pre-push). Same scoring as /ship so they never disagree. |
content-scorer.mjs |
Readability (Flesch-Kincaid), keyword density, GEO heading analysis |
og-validator.mjs |
Open Graph tag validation, image reachability check |
redirect-checker.mjs |
Redirect chain/loop detection, mixed protocol, sitemap-based bulk check |
lighthouse-runner.mjs |
Lighthouse via headless Chrome, extracts CWV + diagnostics |
health-check.mjs |
Production health check (status, response time, SSL, security headers) |
env-validator.mjs |
Validates required env vars from .env.example against actual .env |
migration-checker.mjs |
Detects pending DB migrations (Drizzle, Prisma, Knex) |
bundle-tracker.mjs |
Bundle size tracking with history, heavy dependency detection |
audit-history.mjs |
Saves/compares audit scores over time |
api-smoke-test.mjs |
API endpoint smoke testing (status codes, response times, CORS) |
gsc-client.mjs |
Google Search Console API (JWT auth via service account) |
bing-webmaster.mjs |
Bing Webmaster API — 11 commands: submit-sitemap, list-sitemaps, submit-url, submit-url-batch, url-info, query, indexnow, keyword-research, backlinks, site-scan, url-inspection |
code-profiler.mjs |
Static analysis for N+1 queries, sync I/O, memory leaks, unbounded queries |
dep-doctor.mjs |
Detects unused/outdated dependencies, recommends removals |
secret-scanner.mjs |
Detects leaked secrets, skips .env.example files |
vibe-security-scanner.mjs |
Vibe-Coding Security Sentinel — context-aware checks secret-scanner misses: server-only secrets behind a public env prefix (NEXT_PUBLIC_/VITE_/etc.), a decoded Supabase service_role JWT exposed to the client, service_role referenced in a "use client" file, Supabase tables created without RLS (gated on a Supabase signal), and an advisory for mutation routes with no auth lib. Zero false positives. |
eval-scanner.mjs |
Locates every LLM call site (Anthropic, OpenAI, Gemini, Mistral, Cohere, Ollama, Vercel AI SDK, LangChain) by provider + model id via real import/require detection (no local ./ai false positives), detects the test runner and whether a Promptfoo/eval suite already exists, and flags AI features shipping with no evals. Seeds the /evals skill. Zero false positives. |
sitemap-generator.mjs |
Generates sitemap.xml from HTML files |
robots-generator.mjs |
Generates AI-friendly robots.txt (allows GPTBot, PerplexityBot, etc.) |
structured-data-generator.mjs |
Generates JSON-LD structured data |
llms-txt-generator.mjs |
Generates llms.txt for AI discoverability |
compete-analyzer.mjs |
Competitive X-Ray — compares two sites on tech stack, SEO, perf, security |
launch-prep.mjs |
Launch Day Autopilot — generates launch copy, checklist, press kit |
incident-commander.mjs |
Production Incident Commander — diagnoses outages, suggests rollback |
growth-tracker.mjs |
Post-Ship Growth Intelligence — tracks metrics over time |
cost-tracker.mjs |
AI Build Cost Tracker — tracks spend per feature/model |
onboard-generator.mjs |
Instant Project Onboarding — generates developer onboarding guide |
architecture-mapper.mjs |
Living Architecture Map — auto-generates Mermaid diagrams |
pattern-analyzer.mjs |
Learn From the Best — analyzes and compares codebase patterns |
demo-prep.mjs |
Demo-Ready Mode — finds dev artifacts, generates walkthrough |
pentest-scanner.mjs |
Penetration testing — XSS, SQLi, SSTI, CORS, JWT, GraphQL, prototype pollution, race conditions. Zero false positives. |
canary-monitor.mjs |
Post-deploy canary monitoring — HTTP status, response time, error patterns, baseline regression detection |
retro-analyzer.mjs |
Sprint retrospective — git velocity, commit patterns, test health, hot files, shipping cadence |
learnings-manager.mjs |
Project learnings CRUD — save, search, list, prune, export structured knowledge |
ga4-client.mjs |
Google Analytics 4 Data API — 12 commands: overview, top-pages, traffic-sources, conversions, landing-pages, user-journey, search-terms, geo, devices, realtime, ai-traffic (ChatGPT/Perplexity/Copilot), organic. --organic flag for search-only filtering. Key event rates per page. |
keyword-intelligence.mjs |
Keyword analysis — 12 commands: analyze (with difficulty + topical authority + SERP features + position bands), quick-wins, cannibalization, content-gaps, intent-map, trending, high-intent, page-keywords, content-decay, difficulty, anomalies (low-position high-CTR), cross-reference (GSC↔GA4). Brand filtering via --brand flag. |
index-doctor.mjs |
Index diagnosis — inspects URLs via GSC, diagnoses non-indexing reasons (nosnippet/max-snippet detection), auto-submits fixes to Bing |
codex-generator.mjs |
Codebase index — compact map of routes, schema, components, lib exports, structure. Stack-agnostic (JS/TS, Python, Go, Ruby, PHP, Rust, Java). Writes .ultraship/codex.md to save AI tokens. Skips audit fields + shadcn/radix UI primitives. Route paths validated (no false positives from non-route code). |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 106 lines · 2,635 tokens per session scan A 522decb0cc2c
ultraship CLAUDE.md is an instructions file published in the GitHub repository Houseofmvps/ultraship (121 stars, last pushed 2mo ago), licensed MIT. It adds 2,635 tokens to every session, about $0.0132 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.