Explore, change, verify
Claude performs best when the task includes a pass/fail signal it can run. Make the verifier explicit in the prompt or encode it with /goal or hooks.
A pragmatic field guide for engineers who already understand agentic coding CLIs. Focus: the commands that matter, the workflows that compound, and the extensions that make Claude Code behave like a reliable teammate instead of a clever REPL.
Claude Code is not autocomplete. It is a terminal-native agent that reads files, edits code, runs commands, coordinates parallel agents, and carries memory through project configuration.
Claude performs best when the task includes a pass/fail signal it can run. Make the verifier explicit in the prompt or encode it with /goal or hooks.
Use /context, /compact, /btw, and subagents to keep the main thread clean. Long transcripts degrade judgment.
CLAUDE.md is durable repo context. Skills are reusable workflows. MCP is external data and tools. Hooks are deterministic gates. Subagents isolate focus.
Use /fork for side investigation, /background for long tasks, and /batch for large independent migrations in worktrees.
/plan as a first-class mode, not just a planning prompt./rewind when the agent takes a bad path; checkpointing is part of the workflow.CLAUDE.md. It should be short and behavioral.Memorize these first. The full command surface is large; these are the ones that change day-to-day throughput.
These are prompt-and-command patterns that keep Claude Code grounded and auditable.
Bootstrap memory, connect tools, and reduce prompt friction.
/init /memory /mcp /permissions Read the test/build commands you found. Keep CLAUDE.md short: only non-obvious commands, style rules, architecture constraints, and gotchas.
Separate discovery from edits, then insist on evidence.
/plan add GitHub SSO using the existing auth patterns Implement the approved plan. Add focused tests, run the smallest relevant test target first, then run the project typecheck. Show commands and results. /diff /code-review high --fix
Make the agent prove it can reproduce the failure before editing.
Users report login fails after session timeout. Find the auth/session flow, write or identify a failing test first, then fix the root cause. Do not suppress the symptom. Run the failing test, then the relevant suite.
Use visual verification instead of relying on static code review.
/run-skill-generator Implement the layout change. Use /run to launch the app and inspect it. Take desktop and mobile screenshots, compare them to the requested behavior, then fix any overlap, clipping, or spacing issues. /verify
Use worktree isolation when the work is truly parallelizable.
/batch migrate the src/components directory from Enzyme tests to Testing Library. Preserve behavior. Each unit should update tests and run only its package suite.
Let Claude gather the remote context, then constrain the fix scope.
Use gh to inspect this branch's PR, CI failures, and unresolved review comments. Fix only actionable failures. Run the relevant checks locally. Summarize which comments were addressed and what remains. /autofix-pr only fix lint and type errors
Most Claude Code productivity comes from putting the right information in the right place.
| Artifact | Use it for | Do not use it for | Typical scope |
|---|---|---|---|
CLAUDE.md |
Durable repo guidance: build commands, architecture decisions, style constraints, PR etiquette, gotchas. | Tutorials, generated file maps, API docs, or anything Claude can infer by reading the code. | Project, checked in. Personal overrides in CLAUDE.local.md. |
.claude/settings.json |
Shared project settings: permissions, hooks, plugins, status line, model defaults. | Secrets, machine-specific paths, experimental local preferences. | Project, checked in. |
.claude/settings.local.json |
Personal project overrides and trial settings before sharing with the team. | Team conventions or required safety gates. | Local, gitignored. |
.claude/skills/*/SKILL.md |
Repeatable workflows and domain knowledge that should load only when relevant. | Always-on instructions. Put those in CLAUDE.md. |
Project for team workflows; user for personal habits. |
.claude/agents/*.md |
Specialized read-heavy or review-heavy agents with restricted tools and focused instructions. | Simple command aliases. Use skills instead. | Project or user. |
.mcp.json |
External tool access: issue trackers, docs, design files, DBs, observability, internal APIs. | Static project facts. Avoid tool access when a short note would do. | Project for shared servers; user/local for private auth. |
| Hooks | Deterministic policy: format after edits, block sensitive files, run mandatory checks before stopping. | Soft preferences. Hooks should be rules with consequences. | Project for team gates; managed for enterprise policy. |
Use skills for on-demand procedures and plugins when you want shareable bundles of skills, agents, hooks, MCP servers, LSP servers, monitors, or defaults.
Install the language LSP plugin for your stack from the official marketplace. Symbol navigation and edit-time diagnostics reduce blind grep-driven changes.
security-guidanceRuns security guidance while Claude edits. Useful in web apps, auth code, data paths, and any repo where agent-written code may bypass human threat modeling.
commit-commandsAdds repeatable git workflows for staging, commits, pushes, and PR creation. Good for standardizing commit shape across agent sessions.
pr-review-toolkitSpecialized PR-review agents help separate correctness, cleanup, test, and security review instead of asking one saturated thread to do everything.
agent-sdk-devUse when building with the Claude Agent SDK or Managed Agents. It keeps API details and common migration pitfalls close to the work.
plugin-devInstall when turning team-specific skills, hooks, subagents, and MCP configs into a distributable plugin.
Add anthropics/claude-plugins-community, then prefer plugins with clear source, narrow tool access, recent updates, and low token cost.
/run and /verifyNot third-party, but install nothing until you use these. Generate a run skill once per project so every future session can launch and verify reliably.
Use explanatory or learning styles when onboarding to a codebase or mentoring; disable for production tasks where terse evidence matters more.
/plugin /plugin marketplace add anthropics/claude-plugins-community /plugin install <plugin-name>@claude-community /reload-plugins /skills
Before installing, inspect the plugin detail pane: context cost, last updated date, and every command, agent, skill, hook, MCP server, LSP server, and monitor it will add.
The highest-leverage prompts constrain scope, point to evidence, and define the verification loop.
/plan Read src/auth, the session middleware, and recent git history for token refresh. Explain the current flow and list the smallest safe fix. Do not edit files yet.
Implement the approved plan. Add a failing test first if one does not exist. Run only the relevant test target, then run typecheck. Iterate until both pass.
Review this diff as if you did not write it. Prioritize correctness bugs, data loss, security issues, and missing tests. Give file/line references. Do not comment on style unless it hides a bug.
/fork Investigate why the importer is slow. Read code and profiles only. Return root-cause hypotheses, evidence, and low-risk fixes. Do not edit files.
Claude Code can move quickly. The engineering move is to reduce low-value interruptions while preserving meaningful control over risky actions.
Allow known-safe commands such as lint, test, typecheck, git diff, and read-only gh calls. Keep destructive shell commands in ask or deny.
For unattended work, OS-level sandboxing is cleaner than blanket permission bypass. Restrict filesystem and network access to the task.
Use hooks for actions that must always happen: format after edits, block secrets, stop until checks pass, or prevent writes to protected directories.
Review plugin source, tool access, hooks, monitors, and MCP servers. Third-party skills can inject dynamic shell output into model context.
Use settings to exclude secrets, production dumps, credential files, and local env files unless the task explicitly needs them.
Ask for command output summaries, failing-then-passing tests, screenshots, and exact files changed. Assertions are not verification.