Review a team's Claude Code permissions, approved integrations, and layered instruction files. Included scripts check configuration issues and summarize adoption using counts, so team members can share usage data without sharing conversation transcripts.
Use when rolling Claude Code out to a team or organization, or auditing a rollout already under way — writing or reviewing shared and managed settings.json permissions, deciding which MCP servers, plugins and marketplaces to approve, cleaning up layered CLAUDE.md files, or measuring whether the team actually uses it. Lints settings across scopes, inventories every MCP server and plugin against an approved list, resolves CLAUDE.md layers and imports, and turns local session data into privacy-safe adoption counts.
Review the instructions the agent will receive before you install.
Portability: 4 stdlib scripts, no network, no LLM calls. They read config and counts; they change nothing.
One engineer's Claude Code setup is a preference. A team's is a policy. Settings
merge from five scopes, permissions.allow arrays combine across files, and
deny beats ask beats allow wherever it is written, so nobody can read the
effective policy from a single file. This skill makes it readable, then checks it.
# 1 - Guardrails: lint shared, local and managed settings together.
python scripts/settings_linter.py --repo . --managed /etc/claude-code/managed-settings.json
# 2 - Inventory: every MCP server, plugin and marketplace, against your approved list.
python scripts/mcp_plugin_inventory.py --repo . --allowlist approved.json
# 3 - Instructions: what CLAUDE.md actually loads, layer by layer.
python scripts/claude_md_layering_audit.py --repo .
# 4 - Adoption: each member runs this locally and shares only the JSON counts.
python scripts/adoption_tracker.py --member alice --output json > alice.json
python scripts/adoption_tracker.py --merge *.json --seats 12 --weeks-since-launch 6
Start from assets/managed-settings.example.json:
bypass mode disabled, secrets denied, risky commands on ask, managed hooks
only, an MCP and marketplace allowlist. Ship it through MDM before the first
seat; policy added after habits form becomes a negotiation.
Bash, Bash(*)) and pre-approved destructive commands
(force push, rm -rf, sudo, pipe-to-shell, publish, infra apply).env block, a committed .mcp.json, or a committed CLAUDE.md..claude/settings.local.json committed to git.Warnings cover dead rules (an allow that a deny shadows, mcp__* in allow),
enableAllProjectMcpServers, unpinned npx servers, plain-http remotes,
network-calling hooks, broken or too-deep @imports, duplicated or
contradictory instructions, and resident CLAUDE.md size.
enableAllProjectMcpServers.npx/uvx servers and unpinned marketplaces change under you.| Script | Role | Exit codes |
|---|---|---|
scripts/settings_linter.py | S1-S12 across shared, local, user and managed scopes | 0 · 2 warn · 3 bad input · 4 blocker |
scripts/mcp_plugin_inventory.py | One table of servers, plugins, marketplaces; M1-M6 | 0 · 2 · 3 · 4 |
scripts/claude_md_layering_audit.py | Resident vs on-demand layers, imports (4 hops), L1-L11 | 0 · 2 · 3 · 4 |
scripts/adoption_tracker.py | Member counts; team stage PILOT / SPREADING / EMBEDDED / STALLED | 0 · 2 stalled · 3 |
All support --sample and --output json.
references/settings_and_permissions.md — scopes, precedence, rule syntax, managed-only keys (7 sources)references/mcp_and_plugin_governance.md — MCP scopes, allowlists, marketplaces, pinning (6 sources)references/memory_and_adoption.md — CLAUDE.md layering, transcripts, OpenTelemetry, adoption stages (6 sources)assets/managed-settings.example.json — baseline team policyassets/approved-components.example.json — allowlist format for step 2assets/rollout_plan.md — four-phase plan with exit criteria per phaseNo reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Audit web applications for accessibility issues against WCAG 2.2 Level A and AA, the web accessibility standards. Get framework-specific code fixes, contrast checks, verification steps, and reports, with options for automated checks in development pipelines.
Plan A/B tests that compare page variations, from headlines to pricing layouts. Define a hypothesis, choose success metrics, calculate sample size and duration, and prepare launch checks and results reports to support decisions.
Create paid ad headlines and body copy tailored to each platform's character limits. Use existing performance data to develop variations, explore new messaging angles, and check copy for length, quality, and potential rejection risks.
Review code changes from three critical perspectives: production failures, maintainability, and security. Get a consolidated report that ranks findings by severity and provides merge guidance, helping examine assumptions that an ordinary self-review may overlook.
Audit and improve content intended for citation in AI answers. Review evidence, author information, and structure, generate revised content and structured metadata, and keep a local record of observed citations across AI services.
Create signed records for consequential agent actions such as deployments, deletions, and payments. Decide which actions need evidence, record the agent, action, target, and policy, then verify the resulting certificate offline to detect later changes.