What is pikiloom CLAUDE.md?

Project instructions for Pikiloom, an open agent orchestrator that connects chat or web entry points to coding agents, AI models, and tools in separate layers.

Use them when an agent needs to understand Pikiloom's architecture, locate code, or work consistently with its agent, model, terminal, and tool layers.

They give an agent a shared map of the project's structure, dependencies, concepts, and quick references, reducing guesswork when changing the code.

How xiaotonng/pikiloom configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to xiaotonng/pikiloom. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/xiaotonng/pikiloom/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/xiaotonng/pikiloom

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/xiaotonng/pikiloom/claude-md/github.svg)](https://agentmods.dev/instructions/xiaotonng/pikiloom/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/xiaotonng/pikiloom/claude-md"><img src="https://agentmods.dev/badge/instructions/xiaotonng/pikiloom/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/xiaotonng/pikiloom/claude-md"><img src="https://agentmods.dev/badge/instructions/xiaotonng/pikiloom/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 1,620 This file is loaded in full into every session.

When invoked 1,620 The same file — it is already loaded in full.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.01620	$0.01620
Opus 5.5	$0.00648	$0.00648
Sonnet 5.5	$0.00324	$0.00324
Haiku 4.5	$0.00162	$0.00162

Measured 2mo ago against content hash 19516bbfdc74, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pikiloom CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 130 lines

How it starts

The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Pikiloom

A layered, open Agent orchestrator. Not "an IM bridge for coding agents" — IM is one of several pluggable terminals.

Four layers (top → bottom):

Terminal — IM channels and the Web Dashboard are equal, pluggable entry points.
Agent — Wraps best-in-class agents (Claude Code, Codex, Gemini, Hermes) through a driver registry; ACP-compatible agents plug in via the same contract.
Model — Routes across frontier models (Claude, GPT/Codex, Gemini), domestic Chinese series (DeepSeek, 豆包, MiMo, MiniMax), OpenRouter, and any OpenAI-compatible proxy. Providers + Profiles vault injects credentials per agent at spawn time.
Tool — Skills, MCP servers, CLI tools, merged across global / workspace scopes.

The orchestrator is the product. Lead with the layered framing.

Project Structure

src/
  core/                        Zero-business-logic infrastructure
    constants.ts               Centralized timeouts, retries, numeric constants
    logging.ts                 Structured logging with scoped writers
    platform.ts                Cross-platform OS primitives (IS_WIN, path, which)
    process-control.ts         Restart coordination, watchdog, process tree kill
    utils.ts                   Pure utilities
    version.ts                 Package version
    config/
      user-config.ts           ~/.pikiloom/setting.json load/save/sync
      runtime-config.ts        Runtime agent / model / effort resolution
      validation.ts            Channel credential validation

  catalog/                     Data-only manifests for the Extensions page
    mcp-servers.ts             Recommended MCP servers
    cli-tools.ts               Recommended CLIs
    skill-repos.ts             Recommended skill repos

  agent/                       Agent abstraction layer
    driver.ts                  AgentDriver interface + pluggable registry
    drivers/{claude,claude-tui,codex,gemini,hermes}.ts
    session.ts                 Session workspace CRUD, classification
    stream.ts                  CLI spawn framework, stream orchestration
    skills.ts                  Project skill discovery (.pikiloom/skills)
    skill-installer.ts         Wrapper around `npx skills add`
    auto-update.ts             Background agent CLI version checking
    cli/                       External CLI tool detection + OAuth-web auth
    mcp/
      bridge.ts                Per-stream MCP bridge orchestration
      session-server.ts        Stdio MCP server for agent CLIs
      registry.ts              Recommended MCP server types
      extensions.ts            MCP extension CRUD + session merge
      oauth.ts                 MCP OAuth 2.1 + Dynamic Client Registration
      tools/{workspace,ask-user,types}.ts

  bot/                         Channel-agnostic bot runtime
    bot.ts                     Bot base class: chat state, runStream()
    commands.ts                Structured command data
    command-ui.ts              Selection UI models, action executor
    orchestration.ts           Message pipeline helpers
    human-loop.ts              Human-in-the-loop state machine (Codex + im_ask_user)
    streaming.ts / render-shared.ts / menu.ts / host.ts / session-hub.ts / session-status.ts

  channels/                    Physically isolated IM implementations
    base.ts                    Abstract Channel transport + capability flags
    telegram/  feishu/  weixin/  slack/  discord/  dingtalk/  wecom/

  dashboard/                   Hono HTTP server + React SPA
    server.ts / runtime.ts / platform.ts / session-control.ts
    routes/{config,agents,sessions,extensions,cli}.ts

  cli/                         CLI entry points
    main.ts                    --daemon / --no-daemon / --setup / MCP serve
    channels.ts / setup-wizard.ts / onboarding.ts / run.ts

  browser-profile.ts           Managed Chromium profile dir for Playwright
  browser-supervisor.ts        Process-singleton: probe / ensure / invalidate

Read the full file on GitHub · 130 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 130 lines · 1,620 tokens per session scan A 19516bbfdc74

Subscribe to this mod's changes

pikiloom CLAUDE.md is an instructions file published in the GitHub repository xiaotonng/pikiloom (293 stars, last pushed 4d ago), licensed MIT. It adds 1,620 tokens to every session, about $0.0065 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents ai claude cli codex coding nodejs

pikiloom CLAUDE.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
pikiloom CLAUDE.mdxiaotonng/pikiloom	Instructions file	293	4d ago	MIT	A	1,620	Claude Code
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

pikiloom: Instructions file for Claude Code