settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="https://raw.githubusercontent.com/junianwoo/claude-toad/master/media/ClaudeToad.PNG" alt="Claude Toad" width="600"/> </p>
Scans your project. Generates your entire .claude/ directory. One command.
npx claude-toad initI was getting tired of rewriting my CLAUDE.md and still never sure I was doing it right. Every new Claude Code session starts from zero, and without a solid config, I'd end up repeating myself or watching it make assumptions I'd already corrected. I've also heard from others it took them months to get their configs right. So I built Claude Toad.
Claude Toad reads your repo, figures out what you're working with, calls Claude API (your key, your tokens), and generates the whole .claude/ directory. You get a configuration built from what's actually in your project.
<p align="center"> <video src="https://github.com/user-attachments/assets/13c5a37e-537a-4fb9-a6f8-a4738673e6ef" autoplay loop muted playsinline width="600"></video> </p>
Then you open Claude Code and it just... knows.
Step 1: Scan. Reads your package.json, tsconfig, prisma schema, test configs, CI setup, README, directory structure. No AI. Pure file system reads. Fast.
Step 2: Generate. Sends the project fingerprint to Claude's API. Your key, your tokens. Four focused API calls on Opus. Each call has one job: CLAUDE.md, skills, agents, then commands and hooks. Focused calls produce better output than asking one call to do everything.
Step 3: Write. Drops everything into .claude/. Every file tagged # Generated by Claude Toad - Review before use. You're in control.
initPoint it at an existing project. It scans, generates, writes.
npx claude-toad initnewStart a fresh project with Claude Code configured from the first commit. Interactive setup: pick your stack, your services, your conventions.
npx claude-toad newpackageBundle your .claude/ directory into an installable plugin. One person configures, everyone on the team installs.
npx claude-toad package
npx claude-toad install my-team-config.zipadd-skillTurn your own material into skills. Accepts YouTube videos, PDFs, docs, URLs, audio files. Integrates with Smidge for generation.
npx claude-toad add-skill --from "https://youtube.com/watch?v=..."
npx claude-toad add-skill --from "./docs/api-guide.pdf"Requires a Smidge API key (prompted on first use).
| File | What it does |
|---|---|
CLAUDE.md | Your project in under 150 lines. Stack, architecture, commands, conventions, gotchas. |
skills/*.md | Deep knowledge for your specific framework, database, and testing setup. Loaded only when relevant. |
agents/*.md | Code reviewer and PR writer that know your language and standards. |
commands/*.md | Slash commands for test, deploy, and whatever else your project needs. |
settings.json | Permissions and hooks. Sensible defaults. No dangerously-skip-permissions. |
.mcp.json | MCP servers for the services you actually use. Nothing you don't. |
Next.js (App Router + Pages), React, Remix, SvelteKit, Astro, Nuxt, Express, Fastify, NestJS, Hono, FastAPI, Django, Flask, Go, Rails, Rust.
More coming. Adding a framework takes one PR.
All flags apply to the init command:
claude-toad init --dry-run See what would be generated without writing anything.
claude-toad init --model sonnet Use Sonnet instead of the default (Opus).
claude-toad init --force Skip confirmation prompts.
claude-toad init --verbose Show the full project scan.
claude-toad init --no-agents Skip agent generation.
claude-toad init --no-mcp Skip MCP configuration.
claude-toad init --api-key KEY Pass key directly (for CI/scripts).Run without installing:
npx claude-toad initOr install globally:
npm install -g claude-toad
claude-toad initFirst run asks for your Anthropic API key. Stored locally at ~/.claude-toad/config.json. Never sent anywhere except directly to Anthropic's API. If you already have ANTHROPIC_API_KEY set, Claude Toad picks it up automatically.
The add-skill command integrates with Smidge to generate skills from source material. YouTube videos, PDFs, documentation, audio, raw text. Smidge handles the extraction and formatting so the output works across Claude Code and other AI coding tools.
You'll need a Smidge account and API key. Generate one from your account page. The CLI prompts you the first time.
# One person configures
npx claude-toad init
# Tweak it. Then:
npx claude-toad package
# Everyone else
npx claude-toad install team-config.zipMIT License. BYOK. Runs locally. No telemetry. No analytics. No phoning home.
Your API key goes to Anthropic and nowhere else. Your code never leaves your machine.
I'd like framework detectors. If Claude Toad doesn't recognize your stack, add it. One file, one PR.
Also welcome: prompt improvements, bug fixes, documentation.
add-skill only (smdg.app/account)<p align="center"> <i>Relax. The Toad's got it.</i> </p>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.