ironcode
Production-grade engineering gate skill for AI coding agents (Claude Code + Codex CLI)
Install with your AI
Paste into Claude Code, Cursor, or any agent — it reads the repo and wires the tool into your project.
Install and set up ironcode (claude-skill project) into my current project. Found on https://claudeers.com/ironcode Repo: https://github.com/djfksjd/ironcode Homepage/docs: — Detected install method: claude-skill → # copy this skill into .claude/skills/ironcode/ Category: devtools. Platforms: cli. Read the repo's README for exact setup and env vars, then install it and wire it into my project. Claudeers Health Verdict: active; community-verified: false. Confirm the source before running anything.
# copy the skill dir into your project: # .claude/skills/ironcode/ (or ~/.claude/skills/ironcode/ for all projects)
git clone https://github.com/djfksjd/ironcode
// compatibility
| Platforms | cli |
|---|---|
| Operating systems | — |
| AI compatibility | claude |
| License | MIT |
| Pricing | open-source |
| Language | — |
⚔️ ironcode
A production-grade engineering gate for AI coding agents.
One discipline that produces and protects production-grade code — security, resource safety, backend cost, defensive edges, and evidence that the work is actually done.
Why
AI agents write plausible code fast — and skip the same checks humans skip
under time pressure: the undisposed stream, the query in a loop, the catch {},
the "should work now" with nothing actually run.
ironcode is not a style guide. It is a gate. It forces the checks that get skipped, and it forbids claiming "done" without observable proof.
The Iron Laws
| # | Law | Meaning |
|---|---|---|
| 1 | Evidence before claims | Never say "done / fixed / works" without fresh test, build, or run output. |
| 2 | Spec before style | First prove it solves the right problem; only then critique quality. |
| 3 | Root cause before fix | Reproduce and trace before patching. Symptom-patching is failure. |
| 4 | Own analysis before external input | Verify every linter/tool/agent finding against the actual code. |
| 5 | Cost is a correctness property | N+1 queries and unbounded fetches are defects, not "optimizations for later". |
The five quality dimensions
Reference files load on demand — a one-line change never pulls in a thousand lines of checklist.
| Dimension | Reference | Catches |
|---|---|---|
| 🔐 Security | references/security.md | Secrets, injection, authz/RLS, SSRF, OWASP Top 10 |
| 🧹 Resource safety | references/resource-safety.md | Leaked listeners, streams, timers, controllers, unbounded caches |
| 💸 Data access & cost | references/data-access.md | N+1, missing pagination, over-fetching, schema drift, missing indexes |
| 🛡️ Defensive coding | references/defensive.md | Null/edge cases, swallowed errors, races, idempotency |
| 🧭 Maintainability | references/checklist.md | Naming, size, duplication, dead code — plus the full gate checklist |
| 🚀 Ship-readiness | references/ship-readiness.md | Release scope: testing strategy, observability, deploy compatibility, supply chain, privacy |
How it works
The skill is adaptive — it detects which mode the agent is in:
PLAN → design the checks in before writing
BUILD → apply the patterns while writing (teardown written with every resource)
GATE → spec → diagnostics → five dimensions → verify → report with evidence
Every finding is concrete and actionable:
🔴 home_controller.dart:120 — fetches all rows (no limit), re-runs every rebuild.
Fix: keyset pagination + in-flight guard + cache.
Verification: flutter analyze → 0 issues · make test → 250 passed
Verdict: CHANGES NEEDED
Install — Claude Code
git clone https://github.com/djfksjd/ironcode.git ~/.claude/skills/ironcode
Then invoke with /ironcode, or just ask for a production-grade / rigorous /
leak-free implementation or review — the skill self-triggers on its
description.
Install — Codex CLI
Codex CLI reads the same open SKILL.md skill format (the old
~/.codex/prompts custom prompts are deprecated). Depending on your Codex
version, the user skill directory is ~/.codex/skills or ~/.agents/skills:
git clone https://github.com/djfksjd/ironcode.git ~/.codex/skills/ironcode
# or
git clone https://github.com/djfksjd/ironcode.git ~/.agents/skills/ironcode
Invoke via the skill selector (/skills) or $ironcode.
Scope
Language- and stack-agnostic by design: patterns are given for Flutter/Dart, JS/TS, C#/Java/Kotlin, Go, Rust, and SQL/Postgres (incl. Supabase RLS). Examples lean on real production incidents; adapt the specifics to your stack.
Severity rubric
| Severity | Disposition | |
|---|---|---|
| 🔴 | Security hole, data loss, crash, leak, unbounded cost | Fix before merge |
| 🟠 | Real bug, strong smell, missing edge handling | Fix before merge |
| 🟡 | Style, minor naming, optional cleanup | When convenient |
| 🔵 | Optional improvement | Author's call |
Findings are ranked by severity × exploitability × blast radius — never inflated, never flattened.
License
// faq
What is ironcode?
Production-grade engineering gate skill for AI coding agents (Claude Code + Codex CLI). It is open-source on GitHub.
Is ironcode free to use?
ironcode is open-source under the MIT license, so it is free to use.
What category does ironcode belong to?
ironcode is listed under devtools in the Claudeers registry of Claude-compatible tools.
// embed badge
[](https://claudeers.com/ironcode)
// retro hit counter
[](https://claudeers.com/ironcode)
// reviews
// guestbook
// related in Developer Tools
🔓The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Curs…
🔓Use Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
🔓AI coding assistant skill (Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and more). Turn any folder of code, SQL schemas, R scripts, shell scripts, docs,…
🔓Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.