Claude Code bundle: four packs and a setup runbook a script checks before your agent touches anything risky
by PaperChaseWebb
Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install in full, tied into one checked Claude Code setup by a new Claude Code Setup Runbook. cc_check.py reads CLAUDE.md, .claude/settings.json, skills, subagents, hooks and .mcp.json and names fifteen kinds of problem: bypass mode left on, .env readable, blanket allows, git push that never asks, skills that cannot trigger, subagents with every tool, unpinned servers, keys in config, and third-party pieces nobody vetted. cc.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.
- Price
- $69
- Difficulty
- Intermediate
- Setup
- 1 hr
- Format
- .md file
claude-code-bundle-four-packs-and-a-checked-setup-runbook.md · 253 KB · instant download after checkout · $101 if bought separately
Want this built for you instead? We can build it for you.
What you end up with
A Claude Code project where you know what every skill, subagent, hook and server is and where it came from, the permissions file denies your keys and asks before a push, and no setup change goes in without your typed yes.
What you get
- Four packs in full: Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install ($101 bought separately)
- The Claude Code Setup Runbook (only in this bundle): setup files for the owner, the pinned version, every skill and server with source, version, sha256 and who vetted it, and ten gated setup changes
- cc_check.py: fifteen read-only checks across CLAUDE.md, settings, skills, subagents, hooks and .mcp.json, with a seeded test project (15 findings, then 0)
- cc.py: a gate for every action (0 go, 11 ask the owner, 12 never), requests, owner approval at a terminal tied to the request sha256, verify with expiry, one use per yes
- A starting settings.json that denies .env, allows named commands only and asks before git push
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at Claude Code skill packs, guardrail packs and vetting tools, with sources
Who it is for
Developers and small teams on Claude Code who want one place that says what the setup is, where each piece came from, and which changes wait for a person.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Built for Claude Code; a skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block. The runbook scripts were tested on Linux with Python 3.13; the agent files were not loaded inside each harness.
What is in the bundle (4 packs)
| Pack | Format | Separate price |
|---|---|---|
| AGENTS.md, CLAUDE.md and Cursor rules starter files | Prompt pack | $14 |
| Agent Skills Workshop: write, test and run SKILL.md skills for Hermes, Claude Code and Codex | Bot template | $29 |
| MCP server setup playbook: connect your agent to real tools without handing over the keys | Agent use case pack | $19 |
| Vet Before You Install: twelve checks, a sandbox recipe and a tested vetting folder for third-party agent code | Prompt pack | $39 |
| Bought separately | $101 | |
| The bundle | $69 (you save $32) |
Tools needed
Cost to run: The bundle is the only purchase. The checker and cc.py use no model tokens. Your Claude Code plan is separate.
Time to result: A checked, ratified setup in one afternoon once the packs are installed
How it works
Run the tests
Copy the claude-code-bundle folder and run sh test_all.sh.
Expected: 15 findings on the seeded project and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 47 passed, cc tests 38 passed, exit 2 on a missing folder.
Install the packs
Write CLAUDE.md from Agent Rules, set up your servers with the MCP Setup Playbook, write your own skills with the Agent Skills Workshop, and vet anything third-party with Vet Before You Install.
Expected: A short CLAUDE.md, the fewest servers, skills that trigger, and a written decision for each outside piece.
Start the runbook
Run cc.py init ., fill setup/harness.json, tighten .claude/settings.json and list every skill, subagent and server in setup/sources.csv.
Expected: One pinned Claude Code version, deny rules for your keys, and a source row for every piece.
Gate the risky changes
Add your safe daily actions as agent-ok and keep the ten risky ones owner-yes.
Expected: cc_check.py shows only C15.
Ratify and work
Run cc.py approve . --setup at your own terminal. From then on agents check cc.py gate before every action.
Expected: Safe work goes ahead, permission changes, new servers, skill installs, pushes and deploys arrive as requests you approve by hash, and any setup edit stops every gate until you ratify again.
Sample prompt from the pack
Run cc_check.py on this project. Show me the findings in order, the smallest fix for each, and the setup hash. Edit nothing until I say yes.
Prompt 2 of 10.
Run the Vet Before You Install checks on <URL> at version <v>. Give me the sha256, what it reads and writes, and anything that calls the network. Add a sources.csv row with vetted no.
Prompt 7 of 10.
Free preview of the file
# Claude Code bundle: four packs and a setup runbook that a script checks before your agent touches anything risky Version 1.0, 2026-10-29. By PaperChaseWebb. A bundle of four paid packs (Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook, Vet Before You Install) plus a new Claude Code Setup Runbook that ties them into one checked setup for one project. The runbook comes with a gate and approval script, a read-only checker with fifteen checks, templates, a seeded test project, ten prompts and the tests, all Python 3 standard library. Built for Claude Code, and it also works with Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 10: the scripts ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the checker reads your setup files without starting Claude Code. Each limit is marked where it matters. Most Claude Code kits for sale lead with a count: 50 skills, 120 agents, 198 skills. Buyers say the same things about them in reviews and threads. Half the skills never trigger because the description does not say when to use them. The kit says "tested" and shows nothing. An MCP server is installed from a bare package name, so the next run pulls whatever version is newest. A permissions file allows plain Bash because it was faster. CLAUDE.md grows to
Test record
- Date
- Oct 29, 2026
- What was run
- cc_check.py on a seeded project and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result
- 15 findings on the seeded project, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 47 checker and 38 cc.py tests passed, 0 failed.
- Not run
- The agent files inside Claude Code, Codex, Hermes or Grok Bot. Claude Code itself; the checker reads files only. Windows and macOS.
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- The checker checks that each setup decision was made and written down. It cannot tell whether a skill is good or a vetted server is safe; you and Vet Before You Install do that.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot for this release. The checker reads files and does not start Claude Code. The test project is made up. Linux only; Windows and macOS were not tested.
- The gate makes the rules plain and testable; it does not sandbox an agent. In Claude Code the permission rules in settings.json are the enforced part, which is why three checks read them.
- Claude Code changes often. The checks follow the settings, permissions, skills, subagents, hooks and MCP docs as read on 2026-10-29.
- The approval script refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13: cc_check.py gave 15 findings on the seeded project (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, any missing required file or broken JSON; checker tests 47 passed, 0 failed; cc.py tests at a pseudo-terminal 38 passed, 0 failed.
- The bundle contains the versions listed on this page on the day you buy. Each included pack keeps its own notes and limits.
Questions
Why not buy the four packs on their own?
You can, for $101. The bundle is $69 and adds the Claude Code Setup Runbook, which is only here: one checker across CLAUDE.md, settings, skills, subagents, hooks and servers, and approvals tied to one request.
Is this a skill library?
No. It has a few skills and teaches you to write and vet your own. If you want hundreds of skills, use a free list and run what you pick through Vet Before You Install and the checker.
Does it work with Codex too?
The skill file, AGENTS.md snippet and gate work in Codex, Hermes and Grok Bot. The checks read Claude Code's files. For Codex's config.toml, see the Codex bundle.
Can an agent change permissions or add a server on its own?
Not through the gate. permission-change, mcp-add and the other risky actions are owner-yes, and cc.py approve refuses piped input and the agent environments it recognizes. Your settings.json deny and ask rules are what Claude Code itself enforces.
What if I want it set up with me?
Book a call on the paperchasewebb.ai homepage about the $5,000 Install sprint, or Manage at $5,000 a month to keep the setup current through Claude Code upgrades.
Details
Version 1.0 · Updated Oct 29, 2026 · Markdown version of this page
License: Use on your own machines and on projects you build for yourself, clients and teams, including commercial work. Do not resell or republish the bundle itself. Download terms
Related
Claude Code: five settings rules and a five-check script for .claude/settings.json (free sample)
From the Claude Code bundle: five rules for .claude/settings.json (bypass stays off and switched off, deny reading .env, allow named commands not whole tools, git push asks, hooks run scripts kept in the project), and a read-only script that checks one settings file for them.
Codex bundle: spec, plan, build, test and keep the context small, with a setup runbook a script checks
Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver in full, tied into one Codex workflow by a new Codex Setup Runbook. cx_check.py reads AGENTS.md, .codex/config.toml and .agents/skills and names fifteen kinds of problem: danger-full-access, approval set to never, network left on, keys Codex ignores in a project config, an AGENTS.md past the 32 KiB limit, an unpinned model, servers at @latest, tokens in env, skills that cannot trigger, and third-party pieces nobody vetted. cx.py gates ten risky setup changes, and each waits for the owner's yes typed at their terminal and tied to that request's sha256.
AGENTS.md, CLAUDE.md and Cursor rules starter files
Six fill-in instruction files for coding agents (base, Next.js plus Supabase, FastAPI, browser game, CLAUDE.md pointer, scoped Cursor rules), an Approvals section that makes the agent stop and wait for your yes, a table of what Grok Bot, Claude Code, Codex, Hermes and Cursor each read, a read-only checker for your rule files and 9 prompts to write, trim and test your own.
Agent Skills Workshop: write, test and run SKILL.md skills for Hermes, Claude Code and Codex
A bot template and teaching guide for building your own agent skills instead of collecting other people's. A skill card template, a three-skill split for long jobs (reference lock, plan with timings, build and critique), a loop that turns your corrections into skill drafts, an intake check for skills you did not write, four action classes, a SKILLS.md register, an overnight run sheet, eight skill drills, a rules block and 14 prompts.
MCP server setup playbook: connect your agent to real tools without handing over the keys
Pick the fewest MCP servers for a job, check them before installing, scope the credentials, configure five clients, test with MCP Inspector and build a small read-only server of your own.
Vet Before You Install: twelve checks, a sandbox recipe and a tested vetting folder for third-party agent code
Decide whether a skill, plugin, mod, MCP server, connector, repo or model gets into your agent setup: sort the seat, read every file that runs, map reach and the data path, pin and vendor it, trial it in a sandbox with a planted fake key, then record a decision the owner approves at their own terminal. v1.1 adds a seat sort before any vetting, two new checks (data path and reach, approval surfaces), evidence tiers, twelve token classes including hidden text, encoded strings, startup file edits and approval hooks, a fresh-session second read, data path questions for proxies and routers, dependency and model weight pinning, a fifth decision (not vettable) with recheck dates and an approved shelf, more special cases, a vetting folder with a fifteen-check read-only checker and an owner approval helper, agent files for Grok Bot, Claude Code, Codex and Hermes, and twelve new prompts (27 in all). Price unchanged.
Agent Status Hardware: one light and one e-ink display for every agent session, driven by hooks
Wire the hooks Claude Code, Codex and Hermes already have, plus a rules block for Grok Bot, to one small bridge on your machine. It turns agent events into one state for all sessions and drives a terminal, a USB busylight, a blink(1), an ESP32 LED, a 2.13 inch e-ink panel or a Home Assistant light. Waiting for you is a red blink nothing can cover, a session with no news turns amber, and the light never approves anything.
Cross-Harness Relay: seats, handoffs and a tested Agent Run Record for Grok Bot, Claude Code, Codex and Hermes
A bot template and teaching guide for running more than one agent harness on the same work: six seat cards, a RELAY.md seat map, a relay packet for every handoff, four loop shapes, routine-or-judgment routing with a fallback, a preflight check, the front desk and night shift split with a proof footer, shared memory rules, relay drills, a rules block and prompts. v1.1 adds the Agent Run Record (the owner's ask, every step, what broke and what fixed it, the diff and each changed file with its sha256), a local redaction check for keys, tokens, emails, phone numbers and private paths before a record is shared, a rule that exactly one named seat may deploy, share and deploy approvals the owner types at their own terminal, tied to hashes and refused inside an agent or with piped input, a run record folder with a fifteen-check read-only checker and a relay helper, agent files for Grok Bot, Claude Code, Codex and Hermes, three new relay drills (eleven in all) and six new prompts (20 in all). Price unchanged.
Governed Agent Teams: subagent personas, authority maps and handoffs
A Markdown pack for running a team of coding and research agents with clear limits: 7 subagent personas for Claude Code with Codex AGENTS.md and Hermes skill versions, a Desk Authority Map, three role risk classes, a handoff packet the receiver verifies, an evidence standard, a decision ledger and a reach inventory.
Agent Cost Levers: cut cost per solved task without cutting quality
A Markdown pack that measures what your coding agent spends per finished task, then works five levers one at a time: thinking depth, context curation, direct tool routing, cache and reuse, and a verified stop. Includes a baseline sheet, a rules block and 10 prompts.