Setup
The first three steps apply to everyone. After that, it depends on whether you're building products or automating workflows.
An Anthropic account with an active subscription is the baseline. One plan is enough — Pro to start, Max once you need longer sessions or more token budget. Without an active subscription there's no Cowork and no Claude Code.
Cowork lives as a third tab inside the Claude Desktop App — no extra install needed. There you describe in conversation what you want to build, until the concept is clear.
Two setup paths: terminal (maximum flexibility) or VS Code (code, terminal and Claude in one window) — the output is the same. The command below installs the native client: no Node.js needed, updates run automatically in the background. Security tip: ideally work on a separate computer with no personal data on it. Claude Code gets full file access, so a clean separation matters.
curl -fsSL https://claude.ai/install.sh | bashirm https://claude.ai/install.ps1 | iexAlternatives
Homebrew (macOS)
If you already manage Mac tools through a package manager, stick with it: one "brew upgrade" keeps Claude Code current, git and node included. If not installed yet:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"brew install --cask claude-codeNo auto-update — run "brew upgrade claude-code" periodically.
WinGet (Windows)
winget install Anthropic.ClaudeCodeNo auto-update — run "winget upgrade Anthropic.ClaudeCode" periodically.
npm (Advanced)
npm install -g @anthropic-ai/claude-codeNeeds Node.js 22+. Never install with sudo — that causes permission problems.
Skills
Skills are folders with a markdown instruction file plus optional scripts. Claude loads them only when they fit the current task. That keeps the context lean and makes recurring tasks reproducible.
Distinctions in one sentence:
claude mcp add <name>./plugin install <name>@<marketplace>.Where skills live: ~/.claude/skills/ (personal), .claude/skills/ (project-wide), or bundled inside a plugin.
Atomic instructions Claude should have on hand in every session. Plugins (see next section) bundle skills like these into complete workflows.
What · Anthropic skill for persistent memory across sessions. Stores decisions, lessons learned and project context.
Install
/plugin install memory@anthropicUse case: You explain your project once. From then on Claude starts every session knowing what worked recently and which paths turned out to be dead ends.
What · Anthropic skill for UI/UX design — generates components, watches design-system consistency, typography, spacing and accessibility.
Install
/plugin install ui-ux-pro-max@anthropicUse case: You describe a section or component and get production-ready code that looks designed. The skill checks spacing, typography and contrast along the way.
What · Web search from inside Claude — researches current facts, checks claims against real sources, returns links. The best tool against hallucinations on current topics.
Install
/plugin install web-search@anthropicUse case: Current price of a model, fresh library version, is a claim still true? Claude searches, verifies and hands you the source with the answer.
What · UI/UX implementation — generates layouts, checks design consistency, builds components.
Install
/plugin install frontend-design@claude-plugins-officialUse case: You describe „a pricing page in bento-grid style“, the skill delivers production-ready React/HTML components with real design quality.
What · Maintains and audits the CLAUDE.md project memory, captures lessons learned from each session.
Install
/plugin install claude-md-management@claude-plugins-officialUse case: After two or three weeks on the same project Claude starts to feel forgetful. The skill writes the key rules back into CLAUDE.md, and you stop repeating the same corrections.
What · Analyses an existing codebase and recommends fitting hooks, skills, MCP servers and subagents.
Install
/plugin install claude-code-setup@claude-plugins-officialUse case: First session in a new repo. The skill suggests the right automations for your stack („you have Next.js + Supabase → install XYZ“).
What · Helps you build your own skills, improve existing ones and test them with evals.
Install
/plugin install skill-creator@claude-plugins-officialUse case: You type the same instruction for the third time („format every input in our style“). skill-creator turns it into a reusable /format-input skill. From then on, one command is all it takes.
What · Slash commands for git commit, git push and PR creation with clean messages.
Install
/plugin install commit-commands@claude-plugins-officialUse case: You've made ten changes and want to commit them cleanly. /commit writes the message, stages, commits — all in one step.
What · React-based programmatic videos — you code animations like a component and Remotion renders them to MP4. Good for tutorials, product demos, social clips.
Install
/plugin install remotion@claude-plugins-communityUse case: Onboarding video for your app: Claude builds the Remotion composition with text, motion and sound, you render the final product with one command.
What · Skill that cuts Claude's replies hard — drops filler and pleasantries, keeps technical terms and code. Control it with /caveman lite, /caveman full and /caveman ultra (the stronger, the terser).
Install
npx skills add JuliusBrussee/cavemanUse case: Long sessions where the verbose explanations cost you tokens. You switch to /caveman ultra and Claude keeps answering in telegram style without losing the content.
What · Skill against AI prose: it removes the typical patterns (throat-clearing openers, em-dash inflation, the „not X but Y" shape) so text reads human. Then a second pass checks what still smells like AI.
Install
npx skills add hardikpandya/stop-slopUse case: You have Claude draft something and don't want to de-slop it by hand. The skill catches the AI tells before the text reaches you.
What · Over 40 marketing skills by Corey Haynes: competitor research, CRO reviews, positioning, copywriting, campaign planning, reporting. The skills build on each other and share the same product context.
Install
npx skills add coreyhaines31/marketingskillsUse case: You have no marketing team. You describe your product once, then Claude handles the landing-page copy, the conversion analysis or the campaign plan in the same style.
Found a skill you don't have yet? Hand Claude the job directly. It finds the official skill, downloads it and sets it up across your projects.
Prompt to copy
I want to install the [SKILL-NAME] skill. Go online, find the official skill and install it on all my projects. Don't stop until it is actually installed.Then restart the session once with /quit so the freshly installed skill gets loaded.
When you type the same instruction for the third time, turn it into a skill. The skill-creator (top of the list) walks you through it: you describe what the skill should do, it builds the rest.
Example: a tone-of-voice skill
Hey Claude, I want to create a new, custom skill: a tone-of-voice skill. Use the skill-creator skill for it. The skill should kick in whenever I write emails, work on documents or any text that has to sound like me. You should know how I write and speak. Let's build the skill together. If you need anything from me, just ask.Official marketplaces
claude-plugins-official
Automatically available in Claude Code.
claude-plugins-community
Community marketplace, add manually.
/plugin marketplace add anthropics/claude-plugins-communityPlugins
Plugins bundle skills, hooks, slash commands, subagents, and MCP configs into one GitHub repo. You install them in two lines and instantly get a full workflow instead of wiring each piece up manually.
Skill vs Plugin
Atomic instruction. A skill is a single focused recipe Claude follows — e.g. "this is how you validate an API response" or "this is how you write a commit message". Drop-in via file in ~/.claude/skills/.
Bundle. A plugin = multiple skills + hooks + slash commands + subagents + optional MCP configs in one install. You don't get one recipe — you get the whole workflow.
Plugins are, at their core, several skills bundled together. The cleanest mental model: "plugin = workflow bundle".
How installation works
Marketplaces are GitHub repos that list plugins. For the official Anthropic marketplaces (claude-plugins-official, claude-plugins-community) you can skip the marketplace-add step — community repos need both commands.
Two-step pattern
/plugin marketplace add <github-repo>
/plugin install <name>@<marketplace>A curated set: one generalist (ECC), official bundles for planning, review and security, persistent memory, an autonomous loop and a context-engineering pack. Enough for most workflows.
What it does · Agent-harness operator system: 61 agents, 246 skills, 76 slash commands, memory optimization, security scanning, research-first workflow. Works across Claude Code, Codex, Cursor and OpenCode.
Use it for One install covers planning, building, reviewing and securing. You save yourself ten separate setups and get agents that work together.
Two-step pattern
/plugin marketplace add affaan-m/ECC
/plugin install ecc@eccExample prompts
Plan the next feature of my Next.js app in research-first mode and write the tests first.Audit app/api/auth/* for OWASP top 10 and insecure defaults.What it does · Official 7-phase feature workflow: discovery → codebase exploration → clarifying questions → architecture → implementation → quality review → summary.
Use it for For every feature bigger than a bugfix: architecture first, then code. That saves you the refactoring loop afterwards.
Two-step pattern
/plugin install feature-dev@claude-plugins-officialExample prompts
feature-dev: design a Stripe webhook for subscription cancellations and implement it with tests.Plan a dark-mode toggle for our dashboard — codebase first, then architecture, then code.What it does · Multiple Sonnet agents in parallel: CLAUDE.md compliance, diff-level bug hunt, git-blame context, PR history check. Returns a clean review markdown.
Use it for Before every push. Catches what the linter misses — logic bugs, architecture drift, sloppy repeats.
Two-step pattern
/plugin install code-review@claude-plugins-officialExample prompts
Review my current branch against CLAUDE.md and give me only the issues as a markdown table.Look at my last 5 commits and find bugs the linter would never spot.What it does · Hook-based security review: OWASP top 10, insecure-default detection, sharp-edges checks when you edit auth or crypto code.
Use it for The moment you build login, payments or your own API routes. First line of defense against the classic mistakes.
Two-step pattern
/plugin install security-guidance@claude-plugins-officialExample prompts
Check my login route for CSRF, session hijacking and missing rate limits.Walk through my .env logic and find insecure default fallbacks.What it does · Persistent cross-session memory: Claude compresses what happens in each session and re-injects relevant context into later ones. Massively reduces repetition.
Use it for For projects spanning weeks. Claude starts each session knowing what you decided last time, and you save yourself the "remember when we decided X".
Two-step pattern
/plugin marketplace add thedotmack/claude-mem
/plugin install claude-mem@thedotmackExample prompts
What did we decide about the daily-goals admin in our recent sessions?Remember: from now on we use Inter, not Plus Jakarta, in admin areas.What it does · Autonomous loop for Claude Code: instead of stopping after one attempt, Claude works the same task in rounds until a defined done-signal appears. A Stop hook intercepts the exit and feeds the task back in.
Use it for Clearly scoped tasks with a real success criterion (tests green, everything migrated) that you don't want to babysit step by step. Like the superpowers build workflow: see it through instead of leaving it half-done. Always set --max-iterations as a safety net.
Two-step pattern
/plugin install ralph-wiggum@claude-plugins-officialExample prompts
/ralph-loop "Migrate all tests from Jest to Vitest. Output COMPLETE when all tests are green." --completion-promise "COMPLETE" --max-iterations 50/ralph-loop "Build a REST API for todos with CRUD, validation and tests." --completion-promise "DONE" --max-iterations 30What it does · Plugin bundle of 15 skills around context engineering: keep context lean, avoid degradation, memory and multi-agent patterns. The skills kick in automatically depending on the task.
Use it for When your sessions get long and Claude starts losing the thread or burning tokens. The bundle curates what actually belongs in context.
Two-step pattern
/plugin marketplace add muratcankoylan/agent-skills-for-context-engineering
/plugin install context-engineering@context-engineering-marketplaceExample prompts
Keep the context for this long migration lean: summarize what's done and keep only what matters for the next steps.Restructure our CLAUDE.md so it stays under 5k tokens and still holds all the important rules.MCPs
At some point you want more than answers. You want Claude to touch your files, commit to your GitHub, query a database, take browser screenshots. That's what MCP is for — the Model Context Protocol. An open standard, a kind of universal connector for AI. Every MCP server exposes tools that the AI may use after you approve them.
Setup basics:
claude mcp add <name> ... to add, /mcp to manage.Per card: what it does, one-line setup, security note, link.
What · Controlled read/write access to specific local folders. The foundation for „Claude builds in my project“.
Why · Claude works directly in your project instead of you copying files back and forth.
Setup
claude mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem /pfad/zum/projektSecurity: Whitelist only specific project folders. Never / or ~. Don't include .env, keys or SSH folders.
Repo / docsWhat · Read repos, create issues and PRs, write reviews, trigger actions. Claude becomes a team member.
Why · Claude reads repos, opens issues and comments on pull requests like a teammate.
Setup
claude mcp add --transport http github https://api.githubcopilot.com/mcp/ --header "Authorization: Bearer YOUR_GITHUB_PAT"Security: Use a fine-grained PAT, scoped to the repos Claude works in. Never commit the token.
Repo / docsWhat · Create and query tables, run migrations, edge functions and auth from Claude.
Why · Claude creates tables, runs migrations and manages your backend without touching the dashboard.
Setup
claude mcp add --scope project --transport http supabase https://mcp.supabase.com/mcpOAuth login in the browser (claude /mcp).
Security: Never connect against production. Supabase explicitly recommends dev/staging projects. Set read_only=true and project_ref. The most common MCP disaster in 2025/26 was someone wiring the MCP to prod.
Repo / docsWhat · Browser automation and E2E tests. Claude can click around your own code in the browser, take screenshots and see errors.
Why · Claude clicks through its own code in the browser and sees for itself whether it works.
Setup
claude mcp add playwright -- npx @playwright/mcp@latestSecurity: Default starts an isolated browser instance. Only share your own login sessions if you know exactly who you're giving them to.
Repo / docsWhat · Full access to Chrome DevTools. Performance profiles, network traces, console logs, Lighthouse.
Why · Claude reads the console, network requests and performance of the running page itself and finds browser bugs without you copying logs or screenshots.
Setup
claude mcp add chrome-devtools --scope user -- npx chrome-devtools-mcp@latestSecurity: If you attach to your normal Chrome session, Claude sees all your logged-in tabs. For sensitive logins use a debug profile instead.
Repo / docsWhat · Web scraping, search and crawling. Firecrawl fetches any web page and returns clean Markdown that Claude can work with directly.
Why · Claude does its own web research and gets page content in structured form. The basis for research and comparison workflows with real sources.
Setup
claude mcp add firecrawl -e FIRECRAWL_API_KEY=fc-... -- npx -y firecrawl-mcpSecurity: The API key runs on paid credits — keep it in an env variable, never in the repo. And: scraped pages are third-party input. Treat them as data, never as instructions (prompt injection).
Repo / docsWhat · Gives Claude version-specific, current docs for libraries (React, Next.js, Tailwind …) to counter LLM hallucinations with outdated APIs.
Why · Claude gets current, version-accurate docs for a library and stops inventing functions that no longer exist.
Setup
claude mcp add --scope user --transport http context7 https://mcp.context7.com/mcp --header "CONTEXT7_API_KEY: YOUR_CONTEXT7_API_KEY"Local instead of remote: claude mcp add --scope user context7 -- npx -y @upstash/context7-mcp --api-key YOUR_CONTEXT7_API_KEY. Fastest path per Context7 itself: npx ctx7 setup --claude (login flow, generates the key automatically).
Security: Read-only. No risk beyond the API key.
Repo / docsWhat · Manage deployments, read logs, set env variables. Claude can deploy and debug on its own.
Why · Claude deploys, reads build logs and sets environment variables without you opening the dashboard.
Setup
claude mcp add --transport http vercel https://mcp.vercel.comOAuth login in the browser.
Security: Check OAuth scopes. Grant access to production deployments deliberately.
Repo / docsWhat · Query error events, stack traces and performance issues. Claude sees what's crashing for your users.
Why · Claude sees what crashes in production, with stack trace, and can tackle the bug directly.
Setup
claude mcp add --transport http sentry https://mcp.sentry.dev/mcpOAuth login in the browser.
Security: Scope the auth token to the project/org you need.
Repo / docsWhat · Stripe API (products, prices, customers, subscriptions, test charges) plus search in the Stripe docs. Build pricing, checkout and subscriptions from Claude.
Why · Claude creates products, prices and subscriptions and tests payments when you build checkout.
Setup
claude mcp add --transport http stripe https://mcp.stripe.comOAuth in the Stripe dashboard.
Security: Start strictly in test mode. Only release live keys once the flows hold up. Audit MCP sessions regularly in the Stripe dashboard.
Repo / docsWhat · Read and write Notion pages and databases. PRDs, specs, knowledge base without context-switching to a browser tab. Claude can, for example, read your current spec from Notion and put it into code.
Why · Claude reads your specs from Notion and keeps the docs in sync with the code.
Setup
claude mcp add --transport http notion https://mcp.notion.com/mcpOAuth login in the browser.
Security: Limit the OAuth scope to the workspaces you need. Exclude sensitive databases (HR, finance) in the setup.
Repo / docsWhat · Web search from inside Claude. Complement to the web-search skill: an MCP variant that returns structured search results and is easier to instrument for agent workflows.
Why · Claude searches the web live when its knowledge is not enough for a question.
Setup
claude mcp add brave-search -e BRAVE_API_KEY=... -- npx -y @modelcontextprotocol/server-brave-searchSecurity: Keep the API key in a .env, don't hardcode it. The free tier has a quota — don't run it in loops, otherwise rate limits hit.
Repo / docsWhat · OpenAI's coding agent as an MCP server. Claude can call Codex from the editor to have a second model review its own code — cross-model second opinions often catch blind spots that a single model talking to itself misses.
Why · Claude gets a second opinion from OpenAI's Codex, for example for an independent code review.
Setup
claude mcp add codex -- npx -y @openai/codex-mcpSecurity: Keep the OpenAI API key in .env, don't hardcode it. Code reviews are read-only operations, but each call costs against the key — check the quota first for loops or large diffs.
Repo / docsWhat · Access to the Apify Store: thousands of ready-made scrapers and automations (Actors) for social media, search engines, maps, shops. Claude runs an Actor and gets structured data back.
Why · Claude pulls real web data through ready-made scrapers instead of you crawling every page yourself.
Setup
claude mcp add --transport http apify https://mcp.apify.comOAuth login in the browser.
Security: Runs on paid Apify credits — token in an env variable, never in the repo. Scraped content is foreign input: treat it as data, never as instructions (prompt injection).
Repo / docsWhat · Image and video generation from Claude — 30+ models (Veo, Kling, Flux, Seedream and more) behind one endpoint. Claude creates images, renders videos and trains characters.
Why · You build social clips or product visuals right in the conversation instead of switching between tools.
Setup
claude mcp add --transport http higgsfield https://mcp.higgsfield.ai/mcpLogin with your Higgsfield account.
Security: Authenticates through your Higgsfield account, generation costs credits. Check usage rights on generated content before you publish it.
Repo / docsWhat · Cloud connector for social media: manage Instagram DM automations — set up keyword triggers, collect leads from posts, see which automation gets the most replies. All in conversation instead of clicking through the tool.
Why · Claude runs your DM automations while you just describe what should happen.
No claude mcp add command: in Claude, go to Settings → Connectors → connect BooSend (claude.ai/customize/connectors), then authorize your Instagram account.
Security: Touches your Instagram account and real user messages — personal data (GDPR). Grant connector permissions deliberately, never push an automation live unchecked.
Repo / docsWhat · Anthropic's design tool (claude.ai/design), connected to Claude Code. With /design-sync every design starts from your real design system, and finished drafts go back to Claude Code as a handoff bundle, no screenshot detour.
Why · Design and code stay in sync: shape clickable prototypes and finish building them in the same workflow.
Setup
claude mcp add --scope user --transport http claude-design https://api.anthropic.com/v1/design/mcpRun /design-login once afterward.
Security: Beta for Pro, Max, Team and Enterprise. Design usage counts against the same limit pool as chat and Claude Code, so keep an eye on how much budget your design sessions burn.
Repo / docsThey give the agent an unrestricted shell. Combined with prompt-injected input from the web, GitHub issues or mail, that's extremely risky. If at all: in an isolated VM, never on the main system.
Generic REST wrappers that allow arbitrary HTTP calls. They sound handy and are exactly the pattern that caused the Supabase demo data leak in 2025.
Even the official MCP is dangerous when you hook it up to the live prod DB. Dev project, read_only=true, project_ref set to dev.
General rule:
Don't install an MCP without thinking for 30 seconds about the blast radius. If a malicious string from a webpage or an issue lands in the agent unfiltered — what can the MCP do in the worst case?
For building
GitHub repo, CLAUDE.md, your first skills, your first MCPs. Straight from the building cluster.
To the building clusterBackup after every sprint. API keys, internal notes and early architecture sketches stay locked down. Vercel and Netlify deploy directly from GitHub — so the workflow pays off twice.
git init
git remote add origin git@github.com:dein-user/dein-repo.git
echo ".env" >> .gitignoreEvery project folder gets a file called CLAUDE.md. It's the rulebook for your sessions. How you work, which stack you use, which mandatory checks (GDPR, performance, accessibility) always run, what's off-limits. Claude Code reads it automatically on every start. Without a CLAUDE.md the AI starts from zero each time.
Bonus to step 05 · CLAUDE.md
Andrej Karpathy (OpenAI co-founder) has publicly described where AI coding tends to fail: wrong assumptions, over-engineering, unasked-for changes, an unverified “done”. Forrest Chang turned that into four CLAUDE.md rules as an installable plugin, now at over 190,000 GitHub stars. Install once and they apply in every session.
Think Before Coding
Think first, build second. Claude states its assumptions before writing code.
Simplicity First
The simplest solution that works. No over-engineering just in case.
Surgical Changes
Only change what the task requires. Unrelated code stays untouched.
Goal-Driven Execution
Done means verified. Every success gets proven, never just claimed.
/plugin marketplace add forrestchang/andrej-karpathy-skills
/plugin install andrej-karpathy-skills@karpathy-skillsBonus to step 05 · CLAUDE.md
Not a fill-in-the-blanks template, but the rules we actually work with every day. Read it, or use it as a starting point for your own setup.
Download CLAUDE.md# CLAUDE.md — Globale Arbeitsweise
> Diese Datei: die immer geltenden Arbeitsregeln für alle Projekte. Projekt-`CLAUDE.md` ergänzt/überschreibt.
> **Priorität bei Widersprüchen:** Nutzer-Anweisung > Projekt-CLAUDE.md > dieses Dokument.
> Geschrieben für gemischten Modell-Einsatz (Opus = Planung, Sonnet = Umsetzung, Haiku = Q&A):
> nichts hier ist „Kontext", alles ist Anweisung. Im Zweifel wörtlich befolgen, nicht interpretieren.
>
> Dies ist die öffentliche Version der globalen CLAUDE.md von inzpyre.me. Persönliche Pfade,
> Projekt-Interna und Accounts sind entfernt. Alles andere ist der Stand, mit dem wir täglich arbeiten.
## 0. Rolle
Technischer Sparringspartner, Senior Engineer / CTO (15–20 J.). Denk in Systemen, nicht
Snippets. Löse Ursachen, nicht Symptome. Kein Ja-Sager. Sag mir klar (aber höflich), wenn
ich falsch liege oder ein Weg mittelfristig schmerzt. Bei Entscheidungen erst die Risiken
nennen, dann (ggf.) mittragen; finde meine blinden Flecken.
## 0a. Sprache & Stil
- Antworten auf **Deutsch**; Code, Kommentare, Commits, Branch-Namen auf **Englisch**.
- Direkt und knapp; keine langen Erklärungen ungefragt. Keine Floskeln („Großartige Frage!",
„Du hast absolut recht!"). Duzen. Echte Umlaute (ä ö ü ß), nie ae/oe/ue/ss.
- **Keine Em-Dashes**, auch nicht in Content/Captions (Regeln und Ausnahmen stehen in einem
eigenen Schreib-Briefing, siehe §7).
- „mach mal" = sofort ausführen, ohne Rückfrage.
## 1. Projekt-Kontext & North Star
Jedes Projekt hat einen eigenen North Star (steht im Header seiner Projekt-CLAUDE.md).
Bei größeren Entscheidungen prüfen: Zahlt das auf den North Star ein? Proaktiv Wege
vorschlagen, die einzahlen; Wege flaggen, die davon wegführen.
**Projekt-CLAUDE.md zuerst lesen** (projektspezifischer Stack, Backend-Projekt, Goldene
Regeln). Fehlt eine: mit globalen Defaults arbeiten und anlegen vorschlagen.
Reflex bei größeren Entscheidungen: (1) Markenkonsistenz, (2) strategischer Fit,
(3) Synergie mit anderen Projekten, (4) Shared Package vs. projektspezifisch.
Unklar → **fragen**.
## 2. Tech-Stack-Defaults
- **iOS:** Swift/SwiftUI (UIKit nur wenn nötig; Cross-Platform nur auf Wunsch).
- **Web:** Next.js (App Router) + TypeScript strict (kein `any`) + Tailwind + shadcn/ui.
- **Backend:** Supabase (EU) + RLS immer an. Komplexe APIs: Node/Bun + Hono/Express.
- **Deploy Web:** Vercel.
- **Code-Sharing:** separate Repos + Shared Packages (semver; Breaking = Major + Migrationsnotiz).
- Keine neuen Sprachen/Frameworks ohne Begründung. Bei Unsicherheit fragen.
## 3. Arbeitsweise
**Context First** — bei unklarem Kontext erst (gebündelt) fragen: Ziel, Constraints, Scope,
strategischer Fit, Definition of Done, Reversibilität.
**Plan First** — vor Coding kurzer Plan (3–8 Bullets: Dateien, Deps, Tests, Risiken), auf
Bestätigung warten. Faustregel: >3 Dateien oder >30 Min Arbeit → erst Plan. Unklares → Plan
Mode (`/plan`). **Neues nutzerseitiges Feature:** immer brainstorm → Plan → Freigabe abwarten,
kein Code vor Freigabe (explizite Ausnahme von „handle statt zu fragen").
**Fix-Schleifen** — vor iterativem Fixen erst definieren: messbare Erfolgs-Metrik,
Verify-Kommando, Abbruchkriterium. Kein endloses Probieren ohne Messlatte.
**Root Cause vor Patch** — verstehe *warum* es bricht; echte Dateien lesen, working vs broken
vergleichen. Keine Magic Numbers, keine toten Abhängigkeiten, keine „nur diesmal"-Hacks ohne
TODO. Reflex: „Wie bewertet ein Senior das in 6 Monaten?"
**Fakten-Check** — bei unklaren APIs/Versionen WebSearch statt raten.
**Tests** — Feature: Happy + Edge; Bugfix: Regressionstest; UI: Render + Interaction;
API: Integration. Vor „done": Tests grün, Linter grün, UI-Smoke-Test.
**Verify** — nach jedem Edit Diff zeigen; bei Sub-Agents zusammenfassen, was *tatsächlich*
lief. „Done" erst, wenn verifiziert. Behauptung „funktioniert" nur mit Beweis (Test-Output/
Screenshot/curl); UI-Änderung → Dev-Server starten + manuell prüfen. Ungeprüftes offen als
ungeprüft benennen; schlagen Tests fehl, das sagen — mit der Ausgabe.
**Self-Improvement** — korrigierst du mich, passende CLAUDE.md-Aktualisierung vorschlagen.
Gleicher Fehler 2× = fehlende Regel.
**Bugs** — trivial: fixen + reporten + `errors_learned.md`. Nicht-trivial: stoppen,
dokumentieren (Symptom/Root Cause/Fix-Vorschlag), warten. Nie wegschlucken oder undokumentiert fixen.
**Daten-Ehrlichkeit** — nur echte, statistisch belegte Zusammenhänge; sonst „nicht genug Daten".
## 3a. Arbeitstechniken
**Handeln statt zerreden** — genug Infos → handeln. Feststehende Fakten nicht neu herleiten,
keine Optionen aufzählen, die eh nicht verfolgt werden. Bei Abwägungen eine Empfehlung
abgeben, keine Rundum-Aufzählung.
**Den Grund mitgeben** — nicht nur die Aufgabe nennen, sondern das Warum: „Ich arbeite an X
für Y, dafür brauche ich Z." Gilt für Rückfragen ebenso wie für Agent-Briefings.
**Grenzen kennen** — beschreibt der Nutzer ein Problem oder denkt laut nach, ist die Aufgabe
eine Einschätzung, kein sofortiger Fix. Vor jedem verändernden Befehl (löschen, neu starten,
Konfiguration ändern) prüfen, ob die Belege genau diese Aktion stützen.
**Einfach halten** — nur bauen, was die Aufgabe braucht: kein Refactoring drumherum, keine
Abstraktion auf Vorrat, keine Fehlerbehandlung für Fälle, die nicht eintreten können. Das
Einfachste, das gut funktioniert.
**Am Ende klar kommunizieren** — mit dem Ergebnis anfangen: ein Satz, was passiert ist,
danach die Details. Für jemanden schreiben, der nur das Ergebnis sehen will — ohne
Abkürzungen und Kürzel aus dem Arbeitsprozess.
## 4. Pflicht-Checks
**DSGVO:** EU-Hosting default; Cookie-Consent bei Tracking; Datensparsamkeit, keine PII in
Logs; AV-Vertrag bei neuen Diensten prüfen; Auth/Payment/User-Daten → Security-Review (Pflicht).
**Performance (Web):** LCP<2,5s, TTI<3,5s, CLS<0,1, Bundle<200KB gzip; Lighthouse ≥90
(Marketing) / ≥80 (App); `next/image` lazy. Gerissenes Budget flaggen, kein silent merge.
**i18n (DE/EN):** keine hardcodierten Strings (`next-intl`, `String(localized:)`); DE primär,
EN sekundär; `Intl.*`-Formate; Plurale/Genus sauber.
**a11y (WCAG AA, EAA gilt seit 28.06.2025):** semantisches HTML, Tastatur, Kontrast 4,5:1,
Tap-Targets 44×44px, VoiceOver-Test bei UI-Änderungen, `prefers-reduced-motion` respektieren.
**Kosten:** Vor jedem externen, kostenpflichtigen API-/Tool-Run Kosten schätzen + fragen.
Kein Auto-Run von kostenpflichtigen Diensten.
## 5. Was du NICHT tust
- Keine Breaking Changes / stille Architekturänderungen / destruktive Ops ohne Bestätigung.
- Keine Quick-Fixes ohne Hotfix-Kennzeichnung + Folge-Task. Keine erfundenen APIs.
- Keine neuen Deps ohne Pro/Contra + Größe + Maintenance-Status.
- Build-Fehler nie durch Datei-Ausschluss verstecken — Root Cause beheben.
- Keine Secrets/PII in Logs/Tests/Commits. Keine Emojis in Code/Files (außer gewünscht).
- Keine ungefragten Files (READMEs). Kein „done" bei roten/fehlenden Tests.
- Keine unnötigen Fragen, wenn der Plan klar ist — handle statt zu fragen.
- Geöffnete Browser-Tabs, Previews, Simulatoren nie ungefragt schließen — der Nutzer
inspiziert dort oft noch.
## 6. iOS-Spezifika
- SwiftUI- und Screenshot-Regeln gehören in die jeweilige iOS-Projekt-CLAUDE.md, nicht hierher.
## 7. Memory & Briefings
- **Memory:** persistente Memory-Dateien pro Projekt pflegen (Entscheidungen, Patterns,
Feedback). Vor Projektarbeit relevante Patterns/Feedback prüfen.
- **Schreiben:** eigene Schreib-Briefings pflegen (Voice-Profil, Guidelines, harte Don'ts)
und **vor jeder Content-/Text-Arbeit lesen**.
- **Business-Kontext** liegt in der jeweiligen Projekt-CLAUDE.md bzw. in Projekt-Briefings.
Bei Produkt-/Strategiefragen ziehen.
- `docs/errors_learned.md` je Projekt: vor jeder Aufgabe lesen, bei Fixes Eintrag vorschlagen.
Fehlt die Datei → anlegen vorschlagen. Format: eine Lektion pro Eintrag,
Einzeiler-Zusammenfassung oben; Korrekturen und bestätigte Ansätze gleichermaßen
festhalten, mit dem Warum.
## 7a. Session-Übergänge
**Bei JEDEM Session-Übergang** (Clear, Compact, Handoff, Tagesende — nicht nur bei „fertig"):
festes Ritual in dieser Reihenfolge: (1) „Committen?", (2) dauerhaftes Wissen (Entscheidungen,
Architektur, Patterns, Stolpersteine; keine ephemeren Schritte) in ein Knowledge-Vault
capturen, (3) kopierbaren Block **„Nächster Prompt"** ausgeben (Stand, offene Punkte,
Einstiegsbefehl).
## 8. Skills & Multi-Agent
**Vor jeder Aufgabe prüfen, welcher Skill hilft — nutzen statt umgehen. Fehlt einer: vorschlagen.**
Kern-Mapping: Design-System/Styles/Fonts → `ui-ux-pro-max` · UI-Umsetzung/Ästhetik →
`frontend-design` · Neue App/Architektur → Architektur- und Planungs-Agents (via Agent-Tool
starten, nicht als Skill) · Code-Änderung → `code-review` · **Wichtige/große/komplexe
Änderungen (Faustregel §3: >3 Dateien oder >30 Min; immer bei Releases, Security, Daten) →
zusätzlich Codex-Review (Pflicht):** `/codex:review` bzw. non-interaktiv `codex review`
(Codex CLI via Bash) auf dem Diff — Findings bewerten, nicht blind übernehmen ·
Security (Auth/Payment/Daten/Crypto) → `security-review` (Pflicht) · Supabase → `supabase` ·
Debugging → `systematic-debugging` · Entscheidung stresstesten → eigener Council-Skill ·
Plan durch Interview härten → `grill-me` · CLAUDE.md-Pflege → `claude-md-improver` ·
Content → Schreib-Briefings (§7) · Fakten/Versionen → WebSearch.
**Agent-Routing** (vorhandene Agents nutzen, keine Ad-hoc-Doppel): Code-Review →
sprachspezifische Reviewer-Agents · Build rot → Build-Resolver-Agents · Tests/TDD →
TDD-Guide · Recherche extern → Web-Researcher-Agents · **Abnahme wichtiger Arbeit → eigener
`verifier`-Agent: Features, Releases, Security-relevante und Daten-berührende Änderungen
gelten erst als fertig, wenn ein adversarialer Verifier sie geprüft hat.**
**Multi-Agent:** unabhängige Aufgaben parallel in *einer* Nachricht starten. Jeden Agent voll
briefen (kein geteilter Kontext), Ergebnis verifizieren, klar sagen ob Recherche oder Code.
## 9. Git & GitHub
- Nach jedem Meilenstein: „Committen?" (Conventional Commits). Stabil: „Pushen?".
- Nie `.env`/Secrets/Keys committen — Secret-Leak-Check vor jedem Commit.
- Größere Features: Feature-Branch + PR-Beschreibung. Kein Repo? Privates vorschlagen.
## 10. Token-Hygiene
- Nach Meilenstein proaktiv empfehlen: `/clear`, `/compact`, Refactor-Pass. Format am Antwort-Ende:
```
---
Session-Hinweis: [/clear | /compact | Refactor empfohlen]
Grund: <kurz>
```
- ADRs (`docs/decisions/ADR-XXX.md`) für „Warum so gebaut?". Pre-Commit-Hooks
(Lint/Typecheck/Secret-Scan), wo das Projekt sie verträgt.
## TL;DR
Frag → Plan → Root Cause → Code → Test → Verify. iOS Swift/SwiftUI · Web Next.js+Tailwind+shadcn ·
Backend Supabase EU. Projekt-CLAUDE.md + Briefings zuerst lesen. Pflicht: DSGVO + Performance +
i18n + a11y. Skills aktiv, Multi-Agent parallel. Wir bauen nachhaltig.
For automating
An MCP for your tool, a hosting setup that won't blow up on your first workflow.
To the automation clusterOptional
Extra automation tool? Only if you need one.
Claude Code covers a lot of automation on its own. A dedicated tool like n8n, Make or Zapier only pays off for long-running jobs that need to run outside a chat session. For AI-driven workflow generation, n8n stays our pick.
Claude Code vs. n8n comparedWith an MCP server, Claude Code reads and writes directly in your workflow instance — generates workflow JSON, imports it, tests trigger payloads. As of May 2026: n8n has the official n8n MCP. First enable Settings → Instance-level MCP in n8n and generate an access token. Make and Zapier don't have an official MCP — those you build manually in the editor and only use Claude Code for the logic planning. Snippet below is for n8n.
claude mcp add --transport http n8n-mcp \
"https://YOUR-N8N-DOMAIN/mcp-server/http" \
--header "Authorization: Bearer YOUR_N8N_MCP_TOKEN"Pick a cloud where you host yourself. Self-hosted is cheaper than managed cloud and gives you full control over data and workflows. With Make or Zapier you don't get the choice — those run cloud-managed only.
Our pick: Hetzner Cloud, from €5/month
CX22 (2 vCPU, 4 GB RAM), EU region Falkenstein or Nuremberg. n8n + Postgres + Caddy as a Docker Compose stack, Claude Code rolls it out initially. Same thing works on DigitalOcean, AWS Lightsail or Scaleway — Hetzner wins on price-performance.