hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Claude Code plugin that turns Claude into an expert at Langfuse — instrumentation, setup, evaluation, monitoring, and self-hosting — for Langfuse Cloud and self-hosted deployments, across the Python and JS/TS SDKs and 50+ framework integrations.
It bundles 5 skills, 6 commands, 3 agents, 1 safety hook, and both Langfuse MCP servers, designed on one principle: distill durable judgment, fetch the facts live. The plugin carries the decisions and workflows (which eval method when, how to size a deployment, how to read an experiment); it fetches exact, version-sensitive code from the live Langfuse docs at runtime so it never goes stale.
| Skill | What it owns |
|---|---|
langfuse (vendored, official) | Instrumentation code, the langfuse-cli, live-docs access, prompt migration, judge calibration, CI/CD experiment gates, error analysis, SDK upgrades |
langfuse-setup | Adoption decisions (Cloud vs self-host, region), onboarding sequence, first-trace verification, production-readiness checklist |
langfuse-evaluation | Eval strategy — methods, scores model, datasets/experiments, LLM-as-a-judge, code evaluators, human annotation, RAG/agent/multi-turn/external-pipeline evals, experiment interpretation |
langfuse-monitoring | Dashboards, the Metrics API, score analytics, alerting (Spend-Alerts vs app cost) |
langfuse-deployment | Self-hosting: architecture & sizing, scaling, backups/upgrades/migrations, security & SSO |
| Command | Does |
|---|---|
/lf-setup | Guides onboarding — deployment choice, keys, first trace, prod-readiness |
/lf-eval | Designs/sets up an evaluation — method, scores, datasets/experiments, online/offline |
/lf-monitor | Builds or queries monitoring — dashboards, metrics, alerting |
/lf-deploy | Plans/operates a self-hosted deployment — sizing, scaling, backups, security |
/lf-trace-review | Reviews traces to find, classify, and quantify failure modes |
/lf-health-check | Checks a connection/project: auth, ingestion, recent activity |
| Agent | Does | Access |
|---|---|---|
eval-designer | Explores your codebase and produces a concrete, app-specific evaluation plan | read + reasoning |
setup-doctor | Diagnoses why a setup isn't working (traces missing, auth, region mismatch, flush) | read-only |
trace-reviewer | Builds a quantified failure taxonomy from your traces and proposes fixes + regression cases | read-only |
A non-blocking PostToolUse check that warns if you accidentally hardcode a Langfuse secret key (sk-lf-…) in an edited file. High-signal, never blocks your edit.
.mcp.json)observations, scores, datasets, evaluators, metrics, and getHealth. 61 tools.
cloud.langfuse.com, or self-hosted) and aproject API key pair (pk-lf-… / sk-lf-…) from Project Settings → API Keys.
Local (development / trying it out):
git clone https://github.com/jbaham2/claude-langfuse-plugin
claude --plugin-dir /path/to/claude-langfuse-pluginVia a marketplace (shareable install):
/plugin marketplace add jbaham2/claude-langfuse-plugin
/plugin install claude-langfuse-plugin(Exact marketplace commands can vary by Claude Code version — see the Claude Code plugin docs.)
Copy the template and fill it in:
cp skills/langfuse-setup/assets/.env.example .envSet in your shell or .env:
export LANGFUSE_PUBLIC_KEY="pk-lf-..."
export LANGFUSE_SECRET_KEY="sk-lf-..."
export LANGFUSE_BASE_URL="https://cloud.langfuse.com" # your region or self-host URL
export LANGFUSE_HOST="$LANGFUSE_BASE_URL" # some tools read HOST insteadThe authenticated MCP uses Basic Auth. Generate the token and export it before launching Claude Code (the value is interpolated into .mcp.json at load):
export LANGFUSE_MCP_AUTH="$(printf '%s:%s' "$LANGFUSE_PUBLIC_KEY" "$LANGFUSE_SECRET_KEY" | base64)"Set the right region endpoint in .mcp.json (the url of langfuse-data-platform):
| Region | URL |
|---|---|
| EU (default) | https://cloud.langfuse.com/api/public/mcp |
| US | https://us.cloud.langfuse.com/api/public/mcp |
| Japan | https://jp.cloud.langfuse.com/api/public/mcp |
| HIPAA | https://hipaa.cloud.langfuse.com/api/public/mcp |
| Self-hosted | https://your-domain.com/api/public/mcp |
⚠️ Read + write tools are enabled by default (it can create/delete prompts, scores, datasets, evaluators…). For read-only use, configure a client-side tool allowlist. The bundled diagnostic agents (setup-doctor,trace-reviewer) are read-only by instruction regardless.
>
The Docs MCP needs no auth — it works immediately.
In a Claude Code session inside your project:
/lf-health-checkYou should get a green report (API reachable, authenticated, traces arriving). If not, the setup-doctor agent will diagnose it.
/lf-setup trace my Python app that uses the OpenAI SDK→ walks the deployment/region/keys decisions, then hands off to the official langfuse skill for current best-practice tracing code.
/lf-health-check → verifies traces are arriving./lf-eval gate a prompt change to my support bot→ designs a dataset + experiment + the right evaluators.
Just describe the goal — the relevant skill activates automatically. Use a command when you want to drive a specific workflow, or an agent for a heavier autonomous task.
| I want to… | Do this |
|---|---|
| Add Langfuse tracing to my app | /lf-setup …, or just "add Langfuse tracing to this app" (the official skill supplies current code) |
| Decide Cloud vs self-host / pick a region | Ask — langfuse-setup covers the decision and the irreversible bits |
| Check my setup is healthy / traces aren't showing | /lf-health-check, or "my Langfuse traces aren't showing up" → setup-doctor |
| Design an evaluation strategy | /lf-eval …, or delegate to the eval-designer agent for an app-specific plan |
| Gate a prompt/model change before deploy | "evaluate this change against a dataset before shipping" → datasets + experiments |
| Set up an LLM-as-a-judge (and trust it) | Ask to set up a judge; calibration is handed to the official skill's judge-calibration workflow |
| Find what's failing in production | /lf-trace-review …, or the trace-reviewer agent for a quantified failure taxonomy |
| Monitor cost / latency / quality | /lf-monitor … (Metrics API for ad-hoc queries; specs out dashboards) |
| Set a spend alert | /lf-monitor — and note: Spend Alerts = your Langfuse bill, not app LLM cost |
| Self-host, size, scale, back up, secure | /lf-deploy … |
| Look up exact current SDK/API code | Any skill fetches it live (the Docs MCP / .md-append) rather than guessing |
These mirror Langfuse's own guides, reframed as "ask the plugin."
"Review the last 24h of traces for my support-bot and tell me what's actually going wrong."The trace-reviewer agent pulls observations via the data-platform MCP (listObservations, filtered by name/level/time), classifies failures into a taxonomy (hallucination, wrong tool call, format, retrieval miss…), quantifies how often each occurs, and proposes which failing traces to turn into regression test cases — instead of you reading traces one by one.
"I changed the system prompt. Make sure quality didn't regress before I ship."
langfuse-evaluation sets up an offline experiment: a dataset (seeded from real production traces), a task, and evaluators. After the run it walks the interpretation funnel — aggregate metrics → baseline diff → item-level regressions → annotate — so a "+4% average" can't hide a "−16% on critical cases."
"Help me evaluate my retrieval-augmented chatbot."
The plugin evaluates retrieval and generation independently — retrieval relevance / context precision & recall on the retrieval step, faithfulness / answer relevancy on the generation — so you learn which half is failing. It can use Ragas (reference-free, runs on production traces) and lets you iterate on chunking cheaply.
"How do I evaluate my tool-using agent?"
The eval-designer agent reads your code and produces a plan covering trajectory + per-step + final answer (not just final-output accuracy): tool-selection scores at the observation level, end-to-end trajectory judgment at the trace level, and a phased rollout (manual trace inspection → online evaluators → dataset-based testing).
"Is my hallucination judge actually trustworthy?"
langfuse-evaluation sets the judge up; calibration is delegated to the official skill's judge-calibration workflow — run the judge against a labeled dataset as an experiment and report accuracy (or a full confusion matrix / precision-recall) so you know whether to trust it before it gates anything.
"Give me a production health and cost view, and alert me if cost spikes."
langfuse-monitoring specs the three standard dashboards (health, cost, quality), answers ad-hoc questions via the Metrics API (queryMetrics), and sets up alerting — clarifying that app-level cost alerts are a scheduled metrics check, while Langfuse Spend Alerts cover your Langfuse bill.
"Size a Helm deployment for ~5M traces/day and plan our backups."
/lf-deploy gives the components + minimum sizing, the throughput levers (scale workers by CPU, reduce ClickHouse ingestion reads, separate ingestion/UI), the per-component backup strategy, and the security checklist — deferring exact Helm/Terraform values to the live self-hosting docs.
The repo is one plugin plus an authoring workspace. The Claude Code loader only reads the plugin parts; the rest is documentation/build material (most of it git-ignored from a published package — see .gitignore).
claude-langfuse-plugin/
├── .claude-plugin/plugin.json # manifest
├── .mcp.json # both Langfuse MCP servers
├── skills/ # 5 skills (1 vendored + 4 authored)
├── commands/ # 6 slash commands
├── agents/ # 3 subagents
├── hooks/ # non-blocking secret-key guard
├── README.md · LICENSE
└── meta/ # architecture docs (ROADMAP, DECISIONS, DISTILLATION-TRACKER)
# workbench/ — authoring scratch (git-ignored)Knowledge pipeline: fetch (live .md) → distill durable judgment → skills/<skill>/references/ (shipped) — with stale-prone facts referenced live at runtime. Rationale and full build history are in meta/DECISIONS.md and meta/ROADMAP.md.
skills/langfuse/ is the official Langfuse skill, pinned to an upstream commit.Re-sync periodically using the procedure in skills/langfuse/VENDORED.md.
than hardcoding schemas, so it tolerates upstream changes.
This plugin is built on Langfuse's open-source work and would not exist without it:
github.com/langfuse/skills(© Langfuse GmbH, MIT). It is vendored verbatim into skills/langfuse/ and provides the instrumentation, langfuse-cli, prompt-migration, judge-calibration, error-analysis, and CI/CD workflows. Our four skills are built to complement it, not replace it. Provenance and the upstream commit pin are recorded in skills/langfuse/VENDORED.md.
langfuse.com/docsand langfuse.com/guides — the source material distilled into the skills' references and the use-cases above.
Thank you to the Langfuse team and community.
MIT — see LICENSE. The vendored official Langfuse skill (skills/langfuse/) is also MIT, © Langfuse GmbH — see skills/langfuse/LICENSE.upstream and skills/langfuse/VENDORED.md.
Not affiliated with Langfuse; built on their open-source platform and docs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.