# Claude Code bundle: four packs and a setup runbook a script checks before your agent touches anything risky

> Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install in full, tied into one checked Claude Code setup by a new Claude Code Setup Runbook. cc_check.py reads CLAUDE.md, .claude/settings.json, skills, subagents, hooks and .mcp.json and names fifteen kinds of problem: bypass mode left on, .env readable, blanket allows, git push that never asks, skills that cannot trigger, subagents with every tool, unpinned servers, keys in config, and third-party pieces nobody vetted. cc.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.

- URL: https://paperchasewebb.ai/bots/marketplace/items/claude-code-bundle-four-packs-and-a-checked-setup-runbook/
- Type: Bundle
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Built for Claude Code; a skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block. The runbook scripts were tested on Linux with Python 3.13; the agent files were not loaded inside each harness
- Price: $69 USD
- Difficulty: Intermediate
- Setup time: 1 hr
- Time to result: A checked, ratified setup in one afternoon once the packs are installed
- Format: Markdown (.md) file, claude-code-bundle-four-packs-and-a-checked-setup-runbook.md
- Version: 1.0, updated 2026-10-29
- License: Use on your own machines and on projects you build for yourself, clients and teams, including commercial work. Do not resell or republish the bundle itself.

## What you end up with

A Claude Code project where you know what every skill, subagent, hook and server is and where it came from, the permissions file denies your keys and asks before a push, and no setup change goes in without your typed yes.

## What you get

- Four packs in full: Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install ($101 bought separately)
- The Claude Code Setup Runbook (only in this bundle): setup files for the owner, the pinned version, every skill and server with source, version, sha256 and who vetted it, and ten gated setup changes
- cc_check.py: fifteen read-only checks across CLAUDE.md, settings, skills, subagents, hooks and .mcp.json, with a seeded test project (15 findings, then 0)
- cc.py: a gate for every action (0 go, 11 ask the owner, 12 never), requests, owner approval at a terminal tied to the request sha256, verify with expiry, one use per yes
- A starting settings.json that denies .env, allows named commands only and asks before git push
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at Claude Code skill packs, guardrail packs and vetting tools, with sources

## Who it is for

Developers and small teams on Claude Code who want one place that says what the setup is, where each piece came from, and which changes wait for a person.

## Tools needed

- Claude Code: the main harness; its CLAUDE.md, .claude/settings.json, skills, subagents, hooks and .mcp.json are what the checker reads
- Grok Bot, Codex or Hermes: other agents on the same project; each reads the skill file, AGENTS.md snippet or rules block and checks cc.py gate before acting
- Python 3: runs cc.py (init, hash, gate, request, owner approval, verify, done) and the fifteen-check checker; standard library only, no network
- The project's owner: pins the Claude Code version, vets third-party skills and servers, and types each yes at their own terminal
- You need: Claude Code, and optionally Grok Bot, Codex or Hermes
- You need: Python 3.9 or newer
- You need: A project in git and a terminal you control

Cost to run: The bundle is the only purchase. The checker and cc.py use no model tokens. Your Claude Code plan is separate.

## What is in the bundle (4 packs)

| Pack | Format | Separate price |
|---|---|---|
| [AGENTS.md, CLAUDE.md and Cursor rules starter files](https://paperchasewebb.ai/bots/marketplace/items/agents-md-claude-md-and-cursor-rules-starter-files.md) | Prompt pack | $14 |
| [Agent Skills Workshop: write, test and run SKILL.md skills for Hermes, Claude Code and Codex](https://paperchasewebb.ai/bots/marketplace/items/agent-skills-workshop-skill-md-hermes-claude-code-codex.md) | Bot template | $29 |
| [MCP server setup playbook: connect your agent to real tools without handing over the keys](https://paperchasewebb.ai/bots/marketplace/items/mcp-server-setup-playbook.md) | Agent use case pack | $19 |
| [Vet Before You Install: twelve checks, a sandbox recipe and a tested vetting folder for third-party agent code](https://paperchasewebb.ai/bots/marketplace/items/vet-before-you-install.md) | Prompt pack | $39 |
| Bought separately | | $101 |
| The bundle | | $69 |

## How it works

1. **Run the tests.** Copy the claude-code-bundle folder and run sh test_all.sh. Expected: 15 findings on the seeded project and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 47 passed, cc tests 38 passed, exit 2 on a missing folder.
2. **Install the packs.** Write CLAUDE.md from Agent Rules, set up your servers with the MCP Setup Playbook, write your own skills with the Agent Skills Workshop, and vet anything third-party with Vet Before You Install. Expected: A short CLAUDE.md, the fewest servers, skills that trigger, and a written decision for each outside piece.
3. **Start the runbook.** Run cc.py init ., fill setup/harness.json, tighten .claude/settings.json and list every skill, subagent and server in setup/sources.csv. Expected: One pinned Claude Code version, deny rules for your keys, and a source row for every piece.
4. **Gate the risky changes.** Add your safe daily actions as agent-ok and keep the ten risky ones owner-yes. Expected: cc_check.py shows only C15.
5. **Ratify and work.** Run cc.py approve . --setup at your own terminal. From then on agents check cc.py gate before every action. Expected: Safe work goes ahead, permission changes, new servers, skill installs, pushes and deploys arrive as requests you approve by hash, and any setup edit stops every gate until you ratify again.

## Sample prompt: Session start (Claude Code, Grok Bot, Codex, Hermes)

```
Run cc_check.py on this project. Show me the findings in order, the smallest fix for each, and the setup hash.
Edit nothing until I say yes.
```

Prompt 2 of 10.

## Sample prompt: Third-party skill (Claude Code, Grok Bot, Codex, Hermes)

```
Run the Vet Before You Install checks on <URL> at version <v>. Give me the sha256, what it reads and writes, and anything that calls the network.
Add a sources.csv row with vetted no.
```

Prompt 7 of 10.

## Free preview of claude-code-bundle-four-packs-and-a-checked-setup-runbook.md

````markdown
# Claude Code bundle: four packs and a setup runbook that a script checks before your agent touches anything risky

Version 1.0, 2026-10-29. By PaperChaseWebb. A bundle of four paid packs (Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook, Vet Before You Install) plus a new Claude Code Setup Runbook that ties them into one checked setup for one project. The runbook comes with a gate and approval script, a read-only checker with fifteen checks, templates, a seeded test project, ten prompts and the tests, all Python 3 standard library. Built for Claude Code, and it also works with Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 10: the scripts ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the checker reads your setup files without starting Claude Code. Each limit is marked where it matters.

Most Claude Code kits for sale lead with a count: 50 skills, 120 agents, 198 skills. Buyers say the same things about them in reviews and threads. Half the skills never trigger because the description does not say when to use them. The kit says "tested" and shows nothing. An MCP server is installed from a bare package name, so the next run pulls whatever version is newest. A permissions file allows plain Bash because it was faster. CLAUDE.md grows to
````

## Test record

- Date: Oct 29, 2026
- What was run: cc_check.py on a seeded project and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result: 15 findings on the seeded project, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 47 checker and 38 cc.py tests passed, 0 failed.
- Not run: The agent files inside Claude Code, Codex, Hermes or Grok Bot. Claude Code itself; the checker reads files only. Windows and macOS.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The checker checks that each setup decision was made and written down. It cannot tell whether a skill is good or a vetted server is safe; you and Vet Before You Install do that.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot for this release. The checker reads files and does not start Claude Code. The test project is made up. Linux only; Windows and macOS were not tested.
- The gate makes the rules plain and testable; it does not sandbox an agent. In Claude Code the permission rules in settings.json are the enforced part, which is why three checks read them.
- Claude Code changes often. The checks follow the settings, permissions, skills, subagents, hooks and MCP docs as read on 2026-10-29.
- The approval script refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: cc_check.py gave 15 findings on the seeded project (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, any missing required file or broken JSON; checker tests 47 passed, 0 failed; cc.py tests at a pseudo-terminal 38 passed, 0 failed.
- The bundle contains the versions listed on this page on the day you buy. Each included pack keeps its own notes and limits.

## Questions

**Why not buy the four packs on their own?** You can, for $101. The bundle is $69 and adds the Claude Code Setup Runbook, which is only here: one checker across CLAUDE.md, settings, skills, subagents, hooks and servers, and approvals tied to one request.

**Is this a skill library?** No. It has a few skills and teaches you to write and vet your own. If you want hundreds of skills, use a free list and run what you pick through Vet Before You Install and the checker.

**Does it work with Codex too?** The skill file, AGENTS.md snippet and gate work in Codex, Hermes and Grok Bot. The checks read Claude Code's files. For Codex's config.toml, see the Codex bundle.

**Can an agent change permissions or add a server on its own?** Not through the gate. permission-change, mcp-add and the other risky actions are owner-yes, and cc.py approve refuses piped input and the agent environments it recognizes. Your settings.json deny and ask rules are what Claude Code itself enforces.

**What if I want it set up with me?** Book a call on the paperchasewebb.ai homepage about the $5,000 Install sprint, or Manage at $5,000 a month to keep the setup current through Claude Code upgrades.

## How to buy

$69 one time at https://paperchasewebb.ai/bots/marketplace/items/claude-code-bundle-four-packs-and-a-checked-setup-runbook/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com