⚙️ StackForge

Spin up a new project with one command — stack-aware setup, a proven workflow, and cross-model review. Built for Claude Code, portable to Cursor · Codex · Gemini · Copilot.

🇬🇧 English • 🇷🇺 Русский • 🇫🇷 Français • 🇩🇪 Deutsch

Why • Install • Core • Safety • Sets • /init • Extend

---

📊 At a glance

Sets	Agents	Skills	Commands	Knowledge packs	Hooks
8	12	32	11	13	6

_{A thin core + 7 domain sets · every knowledge pack grounded in official docs with a verification date}

---

🎯 Why

Every new project means installing skills again, writing rules again, wiring up a process again. StackForge does it in one command: a thin core is always installed, /init asks for your stack and assembles AGENTS.md for it (cross-agent, with a CLAUDE.md import for Claude Code), and a domain set adds the specialization.

/plugin install core  →  /init (asks for the stack)  →  /plugin install <domain>
        │                        │                            │
   capability               AGENTS.md for the stack       domain
 (agents/skills/            from knowledge packs          skills/agents
  commands/hooks)           (+CLAUDE.md import)

Real benefits

• 🤖 Cross-model review. Claude writes → Codex (ChatGPT) and Gemini attack the diff → Claude arbitrates. An asymmetry of roles, not "merge N answers." A technique proven on a real project (MeetREC), wired into every task cycle.
• 📚 Knowledge packs from official docs. 13 packs (PHP/Laravel, Django, NestJS, Postgres/MySQL, Redis, ES/ClickHouse, React, Vue/Nuxt, Tailwind, Docker/K8s, GitLab/Ansible, Grafana/Sentry, Flutter/Riverpod) — rules from first-party documentation, with sources and last_verified. Low hallucination risk, not blog spam.
• 🎛 Stack-aware start. /init asks for the stack (multi-select) and assembles rules for it only; conflicting packs (React ⊥ Vue, Riverpod ⊥ Bloc) are never glued together.
• 🪙 Token economy on four fronts. Discipline for reading/generation/sessions + optional plugins for code, prose, search, and command output.
• 🧠 Memory across sessions. L1 (context) + L2 (checkpoints, auto every 10 tool calls); hooks load PROGRESS + checkpoint at startup.
• 🪶 Thin core + delegation. The core stays lean; domain- and stack-specific things live in plugins and packs, loaded lazily on trigger.

---

⚡ Install

# register the marketplace (from GitHub)
/plugin marketplace add Neznakometz/StackForge
# install the core
/plugin install core@stackforge
# set up the environment for the project (asks for the stack)
/init
# add a domain set
/plugin install saas@stackforge

Marketplace awkward in the VS Code extension? Install without it — clone and run bash scripts/install.sh /path/to/project (copies skills/agents/commands into .claude/).

Other agents (Cursor · Codex · Gemini · Copilot · Windsurf): skills are portable — npx skills add Neznakometz/StackForge. For the stack rules, bash scripts/init.sh --stack <ids> assembles a project AGENTS.md from the packs outside Claude Code; drop it where your agent reads it. Full guide + portability matrix: INSTALL.md.

---

🧠 The Core

🔄 Process (task-loop) implementer → spec-reviewer → code-reviewer (+design-reviewer for UI) → cross-model review → test-runner. End of phase — phase-check + security-auditor + adversarial review.	🤖 Cross-model review Claude writes → Codex/Gemini attacks → Claude arbitrates. An external "second brain" via CLI, mandatory on every task.
💾 Memory (L1+L2) /compact, /convolife, /checkpoint, auto-checkpoint every 10 tool calls. Hooks load context at session start.	🪙 Token economy Discipline + optional plugins ponytail-safe, ponytail-terse, codegraph-nav, bash-output-compression.

Agents (7): implementer · spec-reviewer · code-reviewer · design-reviewer · security-auditor · test-runner · scout Skills (7): task-loop · cross-model-review · tdd · contracts · token-economy · memory · prompt-audit Commands: init · next-task · phase-check · checkpoint · add-stack · update-knowledge · stackforge

---

🛡 Safety

Layered, on by default. The enforcement hooks are Claude-Code-native; the rules port to any agent via AGENTS.md.

• Safe permissions (Claude Code) — /init scaffolds .claude/settings.json with a deny-list (no .env/secret reads, no force-push, no rm -rf /, no curl/wget) plus an allow-list for the stack's build/test commands. On Cursor/Codex/Gemini use that agent's own permission system; the same intent lives in AGENTS.md.
• bash-guard (Claude Code hook) — a PreToolUse(Bash) hook that inspects every shell command before permission rules run and blocks destructive / network / arbitrary-code ones: rm of /·~, git push --force, reset --hard, clean, sudo, chown, curl|sh pipes, arbitrary npx/dlx/bunx. It expresses exceptions a deny-list can't — rm -rf dist passes, rm -rf / is blocked — and npx is allow-listed for trusted tooling (npx skills/shadcn). Exit 2 = blocked (reason surfaced to the model); fail-open on a parse error so the agent never wedges.
• Methodology (any agent) — AGENTS.md carries the "never run destructive/network/arbitrary-code commands" rules, so agents without a hook system still follow them. Reviews run a security-auditor agent + external cross-model review on every phase diff (any agent with a codex/gemini CLI).
• Vet skills before you install them (install-time, any agent) — bash-guard catches bad commands at runtime; the complementary check is screening a skill before it lands. Run SkillSpector (NVIDIA, Apache-2.0) on any third-party skill — including ours — before installing: skillspector scan <repo-or-dir> flags prompt injection, secret exfiltration, supply-chain and MCP-poisoning patterns. Referenced, not bundled; our own skills are scanned in CI (see below).

Heuristics, not a shell parser — a guard against agent mistakes and crude attacks, not an OS boundary. For hard isolation, rely on your agent's sandbox (Claude Code, Cursor, etc.).

---

📦 The Sets

Set	Purpose
core	Core: process, review, memory, token economy, /init
spec-prep	idea → SPECIFICATION / DESIGN_SPEC / IMPLEMENTATION_PLAN with acceptance criteria
saas	backend/web: api-design, background-jobs, multitenancy
ui	interface design: generative ui-designer, visual-craft, drop-in tokens, accessibility
mobile	Flutter + Riverpod 3, lint guardrails, Unity→Flutter migration, release
games	gamedev: GDD, engine choice (Godot/Unity/Unreal), game-designer
analytics	research/analytics: fusion (Claude+Codex+Gemini), report-builder
storage	storage/memory: durable memory + rolling-log, RAG, long-context strategies (incl. RLM)

---

📚 Knowledge packs (13, doc-grounded)

Category	Packs
Backend	php-laravel · python-django · node-nestjs
Data	data-sql (PG/MySQL) · data-cache (Redis/Memcached) · data-search-olap (ES/ClickHouse)
Frontend	frontend-react · frontend-vue-nuxt · frontend-styling (Tailwind/SCSS/Vite)
DevOps	devops-containers · devops-ci-infra · devops-observability
Mobile	flutter-riverpod

Each pack is rules.md (rules from the docs) + sources.md (sources + versions) + an entry in registry.json (version, last_verified). The registry is the single source of truth for /init, /add-stack, and /update-knowledge.

---

🎛 Stack-aware /init

1. Detects greenfield/brownfield (scans package.json/pubspec.yaml/…).
2. Asks (multi-select): project type + stack components. There's an "our stack" preset.
3. Assembles AGENTS.md from the chosen packs (+ a CLAUDE.md import for Claude Code); conflicting ones (React ⊥ Vue, Riverpod ⊥ Bloc) are never glued — it asks.
4. Scaffolds memory (PROGRESS.md), the constitution, the spec, safe permissions.
5. Activates the domain skills.

---

🧩 Extend & update

• New stack → /add-stack <technology>: grounds the rules in the docs, creates a pack, registers it.
• New domain → a plugin folder + an entry in marketplace.json (see CONTRIBUTING.md).
• Updating code → /plugin update (native, via the marketplace).
• Updating knowledge → /update-knowledge [id|all]: reconcile with the docs, semver, staleness at 90 days / a new target version.

Optional MCP servers are referenced, never bundled — see MCP.md. Everything degrades gracefully without them.

---

🔗 Integrations

• Graphify — an optional knowledge-graph index over a StackForge project (build once on Claude, query from any agent / MCP) for token-cheaper long-context navigation. Per-agent setup recipes (Claude Code · Cursor · Codex · Antigravity) in docs/graphify/. Referenced, not bundled.

---

🧩 IDE (VS Code)

The framework is IDE-agnostic — inside the Claude Code VS Code extension, plugins/skills/agents/commands/hooks behave identically to the terminal; nothing needs to change. The extension adds editor UX (inline diffs, sidebar, LSP diagnostics). /init can scaffold .vscode/extensions.json so Claude gets LSP diagnostics for your stack with no extra analyze runs.

---

🛠 Maintaining the framework

This repo dogfoods itself: a root CLAUDE.md holds the authoring conventions (an agent editing the framework follows them), scripts/validate.sh checks structure (JSON, frontmatter, registry, plugins, hooks), and CI runs it on every push.

---

⚖️ License & disclaimer

MIT — see LICENSE. Attribution for referenced projects, standards, and conventions is in CREDITS.md. This project references external tools (installed separately) and expresses ideas/facts in its own words — it does not bundle third-party code.

Not affiliated with, endorsed by, or sponsored by Anthropic. "Claude" and "Claude Code" are trademarks of Anthropic; this is an independent community project for use with Claude Code.

🗺 Layout

StackForge/
├── .claude-plugin/marketplace.json     # 8 plugins
├── core/        agents · skills · commands · hooks · knowledge/ · templates
├── spec-prep/ · saas/ · ui/ · mobile/ · games/ · analytics/ · storage/
├── scripts/validate.sh · .github/workflows/validate.yml
└── LICENSE · CONTRIBUTING · CHANGELOG · MCP · README

---

⚠️ Disclaimer

Not affiliated with, endorsed by, or sponsored by Anthropic. "Claude" and "Claude Code" are trademarks of Anthropic; this is an independent community project for use with Claude Code.

All other product names, logos, and brands (Cursor, OpenAI Codex, Google Gemini, GitHub Copilot, Flutter, React, Vue, and others) are the property of their respective owners; their use here is nominative and implies no affiliation or endorsement. See CREDITS.md.

---

_{MIT · built for Claude Code, portable to Cursor/Codex/Gemini · knowledge packs grounded in official docs (verified 2026-06-15)}