claudeers.
// Examples & Templates

claude-starter-kit

A disciplined engineering team for Claude Code — not a prompt. 11 specialist agents auto-chain plan → build → audit → ship, with security/privacy gates and a…

// Examples & Templates[ cli ][ api ][ desktop ][ web ][ mobile ][ claude ]#claude#agent-skills#agents#ai-agents#anthropic#automation#boilerplate#claude-code#templatesMIT$open-sourceupdated about 1 month ago
Actively maintained
100/100
last commit 3 days ago
last release 3 days ago
releases 54
open issues 0
// star history

Install with your AI

Paste into Claude Code, Cursor, or any agent — it reads the repo and wires the tool into your project.

Install and set up claude-starter-kit (claude-plugin project) into my current project.
Found on https://claudeers.com/claude-starter-kit
Repo: https://github.com/byerlikaya/claude-starter-kit
Homepage/docs: https://www.npmjs.com/package/@byerlikaya/claude-starter-kit
Detected install method: claude-plugin → /plugin install claude-starter-kit@byerlikaya/claude-starter-kit
Category: templates. Platforms: cli, api, desktop, web, mobile.
Read the repo's README for exact setup and env vars, then install it and wire it into my project.

Claudeers Health Verdict:
active; community-verified: false. Confirm the source before running anything.
// or install directly (claude-plugin)
/plugin marketplace add byerlikaya/claude-starter-kit
/plugin install claude-starter-kit@byerlikaya/claude-starter-kit
// or clone
git clone https://github.com/byerlikaya/claude-starter-kit

// compatibility

Platformscli, api, desktop, web, mobile
Operating systems
AI compatibilityclaude
LicenseMIT
Pricingopen-source
LanguageShell

🛠️ Claude Starter Kit

An agentic working kit for Claude Code — a reusable scaffold that drives any project, at any stage, with the same engineering discipline.

plan → build → review → commit, where every critical rule is a gate, not a reminder.

🇬🇧 English · 🇹🇷 Türkçe


Why this kit?

Most "agent setups" are a pile of suggestions — the rules sit in a file, and whether they're honored is left to the model. This kit is different: it drops a disciplined engineering team into Claude Code, where the rules that matter are gates, not reminders — it doesn't just tell the agent the rules, it makes breaking the critical ones impossible, and it installs safely onto the repo you already have.

👥A team, not a prompt — 11 specialist agents auto-chain across plan → build → audit → ship; you don't wire them, the main thread does.
🛡️Security & privacy are gates, not options — risk-critical changes must clear the security/privacy audit before they can close.
🚦Every commit is yours to approve — no commit/push runs without your explicit OK, enforced at the tool level even in auto/bypass mode.
🌿Safe on an existing repoadopt hands the kit over on a branch; main is never touched, and you review before you keep it.

🧠 The agents — the heart of the kit

11 agents, each a thin trigger — it says only who and when, and delegates the how to a skill. The main thread selects and chains them across five stages, escalating quality before anything is committed:

Agent orchestration across five stages

🧭 Understand  →  🔨 Produce  →  🔍 Audit  →  ✅ Close  →  🤝 Hand off

AgentStageFires whenModel
planner-csk🧭 Understandscope is ambiguousinherit
backend-expert-csk🔨 Produceserver / API / business logicinherit
database-expert-csk🔨 Produceschema, migration, index, cacheinherit
frontend-expert-csk🔨 ProduceUI, component, client workinherit
devops-expert-csk🔨 Producedeployment, CI pipeline, incidentinherit
security-expert-csk🔍 Auditauth / IDOR / injection / secret · mandatory if security-criticalsonnet
privacy-agent-csk🔍 Auditpersonal data (KVKK / GDPR)sonnet
test-expert-csk🔍 Audittests, coverage, regressioninherit
review-agent-csk✅ Closepre-commit code-health reviewhaiku
commit-agent-csk✅ Closeproposes the commit, waits for approvalhaiku
session-manager-csk🤝 Hand offcontext fills / phase boundaryhaiku

Agent names carry a -csk suffix (Claude Starter Kit) so they never collide with the host project's own agents. Each agent is thin; the real method lives in a skill — the single source of truth.


Three principles

  1. Agent = thin trigger. An agent only says "who, when"; it stays short and leaves the "how" to a skill.
  2. Skill = single source of truth. The actual method and rule live in the skill; they are not copied into the agent.
  3. Rule → gate. The rule that matters is enforced at the tool level (hook · permission · eval). The model is not expected to remember it.

Install & run

Two entry points: start.sh sets up a fresh project; adopt (adopt.sh) hands the kit over to an existing one. Pick any channel — each runs the same two commands.

npx — nothing to install:

npx @byerlikaya/claude-starter-kit          # fresh project
npx @byerlikaya/claude-starter-kit adopt    # existing project
npx @byerlikaya/claude-starter-kit@latest update   # refresh a project that already has the kit

Homebrew:

brew install byerlikaya/tap/claude-starter-kit
claude-starter-kit          # fresh project
claude-starter-kit adopt    # existing project

Release tarball — no package manager:

gh release download --repo byerlikaya/claude-starter-kit -p '*.tgz' && tar xzf claude-starter-kit-*.tgz
bash start.sh               # fresh project
bash adopt.sh              # existing project

Just want the agents & skills inside your existing Claude Code (no scaffolding)? /plugin marketplace add byerlikaya/claude-starter-kit then /plugin install claude-starter-kit@byerlikaya.

Windows: the kit is bash-based — run it inside Git Bash (from git-scm.com) for the smoothest experience; WSL works as a fallback.

🌱 Fresh project — start.sh

bash start.sh [--backend|--frontend|--mobile|--fullstack] [--dotnet|--generic] [-h]

An install wizard. With no flags it walks each step (profile → backend stack → summary and approval); the flags are for silent/CI use, and -h / --help prints usage. Every choice shows what it will install before installing it.

After install, paste .claude/FIRST_PROMPT.md as your first Claude Code message — an optional kickoff that verifies the agents/skills and plans the first sprint. (CLAUDE.md loads the discipline every session regardless, so this is a one-time convenience, not a requirement.)

ProfileExpert agentsHighlighted skills
--backendbackend · databasedb-migration · api-design · observability
--frontendfrontendfrontend · a11y · i18n-integrity
--mobilefrontend (+ React Native/Expo layer)frontend-rn-expo · a11y
--fullstackall of themall skills — backend and web and mobile (RN/Expo)

There is no separate mobile agent: frontend-expert-csk covers web, mobile and desktop, and the mobile how lives in the frontend-rn-expo skill. --fullstack installs it too, so a fullstack project is ready for mobile without picking --mobile.

The backend stack is asked only for --backend/--fullstack: --dotnet brings the .NET / DevArchitecture pattern (MediatR CQRS · IResult · AOP) behind an approval gate; --generic installs the same expert without it — for Node, Go, Python, or a .NET project on a different pattern.

.NET — start proven, not from scratch. --dotnet clones the production-ready DevArchitecture foundation (CQRS · IResult · AOP · auth) and installs agents that already know it — so you skip the tokens an agent would burn regenerating a standard architecture; they go to your business logic, not boilerplate. Opinionated by default, not by force: the backend expert applies your project's pattern skill — DevArchitecture out of the box, or your own (Clean Architecture, Vertical Slice, Minimal API, plain layered) dropped into .claude/skills/. --generic stays stack-agnostic.

On --fullstack + --dotnet the DevArchitecture backend is placed in ./backend, ./frontend is reserved for your frontend, and the solution file is renamed to your project's name — so the project root stays clean instead of looking like a bare backend.

🔄 Existing project — adopt.sh

bash adopt.sh          # at the root of the target project

Applies the kit to a project already in motion, like one team handing a project over to another — the project is not broken, decisions already made are not lost, and the kit does not stay passive.

adopt.sh handover flow

All changes land on a separate git branch staged, not committed — so every added and changed file shows up in your editor's Source Control / Changes panel; you review it there, then git commit to accept (or reset to discard). main stays untouched. Kit agents install side-by-side (never colliding), the discipline is bound via a single @import, settings.json is merged schema-aware, and existing husky/lefthook chains run alongside the kit via a shim. It closes with a durable docs/HANDOVER.md and an ADR, so decisions live in version control, not in a chat.

🔁 Update an installed project

npx @byerlikaya/claude-starter-kit@latest update    # `update` is an alias of `adopt`; run it at the project root

At install time the kit stamps .claude/kit.conf with the profile, the backend stack and which installer ran, plus .claude/VERSION. The updater reads that stamp and refreshes the project in the shape it was installed in: a --backend project does not get frontend agents grafted back on, and a --dotnet project keeps its devarch-module pattern skill. Where the stamp is absent, the updater derives the shape from the installed files and writes it. Compare cat .claude/VERSION against npm view @byerlikaya/claude-starter-kit version to see whether an update is waiting.

On update
.claude/ agents · skills · commands · hooks · evalrefreshed from the new version
.claude/DISCIPLINE.mdoverwritten — it is kit-owned, so keep nothing of your own in it
./CLAUDE.mdnever touched — your project rules stay exactly as you wrote them
.claude/settings.jsonmerged schema-aware; your own hooks and permissions survive
your own agents and skills (no -csk suffix)untouched

Like adopt, an update needs a git repo and lands on a kit-adopt-<timestamp> branch, staged and uncommitted — review the diff, then commit to accept or reset to discard.

If a project's CLAUDE.md carries the discipline inline instead of importing it, discipline updates cannot reach that project. The updater detects this, shows which lines hold the inline block, and offers to replace them with the single @.claude/DISCIPLINE.md import — writing a backup first, on a branch you review. Decline and nothing is touched; your project section and your own rules survive either way.


What's inside

  • 11 agents — see the table above.
  • 30 skills — the single source of "how", one per area (full catalogue below).
  • 6 slash commands/brainstorm · /plan · /review · /ship · /handoff · /simplify.
  • Hooksguard-bash.sh (tool-level gate), pre-commit + commit-msg (trace + secret scan), context-usage.sh and session-guard.sh (session measurement).
  • CLAUDE.md — behavior, the three principles, workflow, Definition of Done, token discipline, and prohibitions.
Full skill catalogue — all 30, generated from each skill
SkillWhat it does
a11yFrontend accessibility audit (WCAG): semantic HTML, keyboard access, focus management, contrast, ARIA, screen readers.
adrArchitecture Decision Record: context-decision-consequences, for decisions that are expensive to reverse.
api-designAPI contract design: resource naming, error model, versioning, pagination, backward compatibility, OpenAPI.
brainstormDivergent discovery BEFORE planning: turn a fuzzy ask into 2–4 scoped options + named unknowns, pick a direction, hand to spec-planning.
ci-pipelineCI pipeline discipline: lint→build→test→quality→security, fail-fast, deterministic build, secret handling, PR gates.
code-reviewCode review discipline: severity-ranked, reasoned feedback on whether a change improves the system's overall code health.
commit-messageConventional Commits: reads the staged diff and proposes type(scope): summary, with body/footer when needed.
db-migrationApply schema migrations safely: detect the tool, classify the change by risk, gate destructive ones behind approval, back up in prod,…
dependency-auditDependency audit: known CVEs, licence compliance, abandoned/outdated packages, lockfile integrity, and a justification for every new…
devarch-moduleDevArchitecture backend pattern: MediatR CQRS handler/command/query, IResult/IDataResult, Autofac AOP chain, FluentValidation, i18n.
docs-writerKeeps documentation in sync with the code: README, usage and related docs when a public API or behavior changes.
frontend-rn-expoOPTIONAL, stack-specific: React Native + Expo (prebuild).
frontendStack-agnostic frontend discipline (web · mobile · desktop): component structure, state, data fetching, loading/empty/error states,…
handoffSession handover: when context fills, a phase closes, or the topic changes, write an action-oriented handover to docs/SESSION_STATE.md,…
i18n-integrityTranslation integrity: every key present in every language, no hardcoded strings, consistent placeholders and plurals.
incident-runbookProduction incident response: diagnose → mitigate → resolve, then a blameless postmortem and a repeatable runbook.
iterateRefine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded.
observabilityStack-agnostic observability: structured logs, correlation ids, metrics and traces; no PII or secrets in logs.
performanceStack-agnostic performance: measure first, find the bottleneck, then optimise.
privacy-complianceKVKK/GDPR audit method: data inventory, purpose/basis/retention, minimisation, consent, transparency, data-subject rights, cross-border…
red-teamAttacker's-eye test of LLM/agent defenses: instruction hijacking, data exfiltration and tool abuse through untrusted content; verifies…
reflectRetrospective self-audit after nontrivial work: unverified assumptions, skipped items, is-this-the-right- approach — findings, not code.
releaseVersioning and CHANGELOG: SemVer mapped from Conventional Commits, Keep a Changelog format, tagging, pre-release gates.
security-scanStack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws.
sonarqube-checkSonarQube quality gate (language-agnostic): 0 Bugs · 0 Vulnerabilities · 0 Security Hotspots · 0 Code Smells, build 0 warnings / 0…
spec-planningSpec-first planning: task breakdown, measurable acceptance criteria, dependency order, risk priority.
testingThe how of testing: pyramid, AAA, isolation, risk coverage, determinism.
token-budgetContext/token discipline: subagent isolation, output = summary, move-to-file, delegation threshold, lean skills.
trace-scanTrace scan (§4.1/§4.2): before a commit, scans the staged changes and the message for AI traces (co-author trailers, footers, robot…
vps-deployDeploy to a VPS safely: runtime detection, reverse proxy + SSL, atomic swap, keep the previous version, post-deploy health gate,…

Session & token management

An assistant cannot run /context itself, so most setups guess the session fill. This kit measures it. context-usage.sh reads the real token count from the last turn's API usage in the transcript — the same figure /context shows. The UserPromptSubmit hook injects it every turn; the Stop hook (session-guard.sh) warns you the first time fill crosses 75%, and once more at 90% — one warning per threshold, and it never blocks your turn. The session-health line rests on a measurement, not a guess.

Token cost

DISCIPLINE.md and the agent/skill descriptions load into every session's context. That always-on material measured 9,198 tokens on a real turn for 11 agents and 28 skills; brainstorm and reflect add ~660 bytes (≈ 280 tokens) on top — the price of the whole discipline layer.

smoke-test.sh enforces a byte budget per component (discipline · agent descriptions · skill descriptions), so the cost cannot drift upward unnoticed. A budget can be raised, but only by editing smoke-test.sh explicitly.

Profile pruning does not save tokens. A --backend install (10 agents, 27 skills) costs only ~640 tokens less than --fullstack (11 agents, 30 skills). Pick a profile to narrow the scope of the work.


Rule → gate

RuleEnforcing mechanism
Commit/push only with approval — in every permission modeguard-bash.sh (PreToolUse) raises an approval prompt only you can answer; approve once and Claude runs the commit. Fails closed under bypassPermissions; CLAUDE_GIT_OK=1 pre-authorises headless runs
Destructive op (reset --hard · force push · rm -rf · --no-verify)guard-bash.sh (blocked at the tool level)
No AI-authorship trace or external vendor name in a commitpre-commit + commit-msg git hook — scans your project's files; the kit's own .claude/ tree is exempt (it names the tool it configures), secrets never are
No API key / token / private key committedpre-commit secret scan (secret-blocklist.txt + .secret-allowlist.txt)
Session thresholdcontext-usage.sh + session-guard.sh (Stop hook)
Always-on context stays leansmoke-test.sh byte budgets per component (discipline · agent descriptions · skill descriptions)
A running session never follows stale rulescontext-usage.sh compares .claude/VERSION against the version the session started with, and says so
Quality gate (SonarQube projects — language-agnostic)sonarqube-check + /ship

The gates are armed via settings.json and git core.hooksPath; smoke-test.sh verifies they are ready after every change.


Verification

bash .claude/eval/smoke-test.sh      # structure, frontmatter, gate integrity
bash .claude/eval/routing-eval.sh    # does an example prompt route to the right agent/skill

Workflow

/plan (ambiguous scope) → expert agents build → /review (security · quality · test) → /ship (DoD gate; proposes the commit, waits for approval) → when context fills up, /handoff/clear.

Extending

When you add an agent or skill, follow the AGENT_TEMPLATE.md contract: frontmatter (name · description + Trigger phrases · least-privilege tools · model tier) and body (When → Expertise stance → How/skill → Coordination → DoD → Output & context → Errors/escalation → Example → Constraints).

License & attribution

MIT — see LICENSE. The discipline layer builds on these upstream sources:

// faq

What is claude-starter-kit?

A disciplined engineering team for Claude Code — not a prompt. 11 specialist agents auto-chain plan → build → audit → ship, with security/privacy gates and approval-guarded commits. Set up a fresh project or safely adopt an existing repo.. It is open-source on GitHub.

Is claude-starter-kit free to use?

claude-starter-kit is open-source under the MIT license, so it is free to use.

What category does claude-starter-kit belong to?

claude-starter-kit is listed under templates in the Claudeers registry of Claude-compatible tools.

0 views
22 stars
unclaimed
updated about 1 month ago

// embed badge

claude-starter-kit on Claudeers
[![Claudeers](https://claudeers.com/api/badge/claude-starter-kit.svg)](https://claudeers.com/claude-starter-kit)

// retro hit counter

claude-starter-kit hit counter
[![Hits](https://claudeers.com/api/counter/claude-starter-kit.svg)](https://claudeers.com/claude-starter-kit)

// reviews

// guestbook

0/500

// related in Examples & Templates

🔓

👨🏻‍💻👩🏻‍💻 Use Ant Design like a Pro!

// templatesant-design/TypeScript38,683MIT[ claude ]
🔓

Claude Code skill that removes signs of AI-generated writing from text

// templatesblader/37,063MIT[ claude ]
🔓

Clone any website with one command using AI coding agents

// templatesJCodesMore/TypeScript32,410MIT[ claude ]
🔓

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landi…

// templateswasp-lang/TypeScript15,550MIT[ claude ]
→ see how claude-starter-kit connects across the ecosystem