io.github.RCOLKITT/ccboot-mcp-server

Applies a compliance template pack to the project — generates hooks for audit logging, skills for compliance-aware code review, and CLAUDE.md sections with regulatory requirements. Supported standards: • hipaa: PHI handling, audit logging, encryption requirements, data classification • soc2: Access controls, audit trails, change management, encryption • pci-dss: Card number blocking, tokenization requirements, OWASP checks • sox: Financial calculation review, audit trails, separation of duties Scope options: • full: Hooks + skills + CLAUDE.md section • hooks_only: Just audit/blocking hooks • skills_only: Just compliance review skills Examples: ccboot_apply_compliance({ project_path: '.', standard: 'hipaa', scope: 'full' }) ccboot_apply_compliance({ project_path: '.', standard: 'soc2', scope: 'hooks_only' }) Idempotent: Safe to run multiple times — won't duplicate hooks.

Analyzes how much of Claude's context window your configuration artifacts consume. Every token spent on CLAUDE.md, skills, agents, and knowledge docs is a token NOT available for your actual code and conversation. Budget guidelines: • Skills should use < 2% of context window (~4,000 tokens) • Total config should use < 5% (~10,000 tokens) • Individual skills over 500 tokens should be trimmed Examples: ccboot_audit_context({ project_path: '.' }) Returns: Token breakdown by category, budget percentage, specific warnings. Read-only: Does not modify any files.

Generates an Architecture Decision Record following the standard ADR template. ADRs are the most valuable knowledge documents for AI — they explain WHY architectural decisions were made, which prevents Claude from suggesting approaches that were already considered and rejected. Auto-numbers ADRs sequentially (0001, 0002, etc.). Examples: ccboot_create_adr({ title: 'Use PostgreSQL over MongoDB', status: 'accepted', context: 'We need ACID transactions for payment processing...', decision: 'Use PostgreSQL with Prisma ORM...', consequences: 'Must manage migrations, but get strong consistency...' }) ccboot_create_adr({ title: 'Adopt tRPC for API layer', status: 'proposed', context: 'REST endpoints lack type safety across client/server boundary...', decision: 'Replace REST with tRPC...', consequences: 'Tight coupling to TypeScript, but eliminates entire class of bugs...' }) Returns: ADR number, file path, status.

Scaffolds a subagent definition in .claude/agents/. Subagents are specialized AI workers with restricted tool access and focused system prompts. Built-in roles with smart defaults: • explore: Read-only codebase investigation (Read, Grep, Glob) • plan: Architecture planning without code changes (Read, Grep, Glob) • general: Full-capability agent • custom: Blank template for custom behavior Examples: ccboot_create_agent({ name: 'security-auditor', description: 'Scans for OWASP vulnerabilities', role: 'explore' }) ccboot_create_agent({ name: 'db-migrator', description: 'Plans and executes database migrations', role: 'general', allowed_tools: ['Read', 'Write', 'Bash'] }) Returns: Agent file path, role, next steps. Error: If agent name already exists.

Generates a GitHub Actions workflow that enables Claude Code to review pull requests. Creates a .github/workflows/claude-review.yml file that triggers on PRs and @claude mentions. Review focus options: • security: OWASP vulnerabilities, auth issues, data exposure • performance: N+1 queries, memory leaks, bundle size • style: Code conventions, naming, organization • all: Comprehensive review covering all areas Examples: ccboot_create_ci_workflow({ repo_path: '.', review_focus: 'all', branch_pattern: 'main' }) ccboot_create_ci_workflow({ repo_path: '.', review_focus: 'security', branch_pattern: 'develop' }) Requires: ANTHROPIC_API_KEY in repository secrets. Idempotent: Updates existing workflow if present.

Creates a slash command (e.g., /review, /deploy, /docs) as a skill with user invocation. Slash commands are the primary way teams standardize Claude Code workflows. When a user types /command-name, Claude receives the prompt_body as instructions. Examples: ccboot_create_command({ name: "review", description: "Review current changes", prompt_body: "Review the current git diff. Check for security issues, performance problems, and code quality. Output findings as Critical/Warning/Suggestion." }) ccboot_create_command({ name: "deploy-check", description: "Pre-deploy checklist", prompt_body: "Run through the deployment checklist: 1. All tests pass 2. No TODO/FIXME in changed files 3. No console.log statements 4. Database migrations are reversible", arguments: [{ name: "env", description: "Target environment", required: true }] }) Returns: Slash command usage, file location. Error: If command name already exists.

Adds a lifecycle hook to .claude/settings.json. Hooks run shell commands in response to Claude Code events — format code after writes, lint changes, block dangerous commands, etc. Supported events: • PreToolCall: Before a tool executes (use to block or validate) • PostToolCall: After a tool executes (use to format, lint, test) • Notification: On status notifications • Stop: When Claude stops generating • SubagentStop: When a subagent stops • PreCompact: Before context compaction • PostCompact: After context compaction • SessionStart: When a new session begins Environment variables available: $TOOL_INPUT_COMMAND, $TOOL_INPUT_FILE_PATH, etc. Examples: ccboot_create_hook({ event: "PostToolCall", matcher: "Write|Edit", command: 'npx prettier --write "$TOOL_INPUT_FILE_PATH"', exit_behavior: "notify", description: "Format on write" }) ccboot_create_hook({ event: "PreToolCall", matcher: "Bash", command: 'echo "$TOOL_INPUT_COMMAND" | grep -qE "rm -rf|DROP TABLE" && exit 1', exit_behavior: "block", description: "Block dangerous commands" }) Returns: Hook details, updated settings path. Idempotent: Re-running with same command+matcher updates the existing hook.

Adds a reference document to .claude/docs/ that Claude Code can use as context. Use this for ADRs, runbooks, API specs, data schemas, and style guides. Knowledge documents give Claude deep domain context — the kind of information that turns generic AI suggestions into expert-level guidance specific to your system. Categories: • adr: Architecture Decision Records • runbook: Operational procedures • api: API documentation and contracts • schema: Data model definitions • style: Code style guides and conventions Examples: ccboot_create_knowledge({ title: 'Payment Processing Flow', category: 'api', content: '## Overview\nPayments go through 3 stages...', tags: ['payments', 'stripe'] }) ccboot_create_knowledge({ title: 'Incident Response', category: 'runbook', content: '## When PagerDuty fires...', tags: ['ops', 'oncall'] }) Returns: Document location, category, and tags. Error: If document with same title already exists.

Generates a comprehensive security hook system that blocks dangerous commands and detects secret leaks before they happen. Creates a blocker script and hooks it into Claude Code's PreToolCall lifecycle. Strictness levels: • standard: Blocks rm -rf, force push, DROP TABLE, TRUNCATE (8 patterns) • strict: + git reset --hard, chmod 777, curl|sh, wget|sh (13 patterns) • paranoid: + eval(), exec(), sudo, su, pkill, killall (19 patterns) Also detects secret patterns: AWS keys, API keys, GitHub tokens, private keys. Examples: ccboot_create_security_hook({ project_path: '.', strictness: 'standard' }) ccboot_create_security_hook({ project_path: '.', strictness: 'paranoid' }) Idempotent: Updates existing security hook if present.

Scaffolds a production-ready skill in .claude/skills/<name>/ with SKILL.md containing valid YAML frontmatter. Skills are reusable AI capabilities — code review, test generation, documentation, security scanning, etc. The YAML frontmatter controls behavior: • invocation: 'user' (slash command), 'auto' (triggered by context), 'both' • context: 'inline' (runs in main session), 'fork' (runs in subagent) • allowed_tools: restricts which tools the skill can use Examples: ccboot_create_skill({ name: 'code-review', description: 'Reviews code changes for quality and security', invocation: 'auto', context: 'fork', allowed_tools: ['Read', 'Grep', 'Glob'] }) ccboot_create_skill({ name: 'db-migrate', description: 'Generates and applies database migrations', invocation: 'user', context: 'inline', allowed_tools: ['Read', 'Write', 'Bash'] }) Returns: Skill location, frontmatter summary, next steps. Error: If skill name already exists (suggests different name).

Creates a deeply customized CLAUDE.md by analyzing your actual project. Reads package.json, detects frameworks, finds real build/test/lint commands, identifies ORMs, CSS frameworks, state management, auth libraries, and generates architecture rules specific to your stack. The output reflects what your project actually IS — not a generic template. Examples: ccboot_generate_claudemd({ project_path: '.', scope: 'root' }) ccboot_generate_claudemd({ project_path: './apps/web', scope: 'subdir', merge_existing: true }) ccboot_generate_claudemd({ project_path: '.', tech_stack: ['nextjs', 'express'] }) Returns: Path to generated file, detected stack summary, line count. Error: Returns if no tech stack detected (suggests providing tech_stack parameter).

Creates a .mcp.json file with pre-configured MCP server entries for your services. Each entry includes the correct npx command and environment variable placeholders. Supported services: github, sentry, postgres, slack, linear, jira, datadog, pagerduty, vercel, supabase Scope: • project: Creates .mcp.json in project root (team-shared) • user: Creates in ~/.claude/.mcp.json (personal) Examples: ccboot_generate_mcp_config({ project_path: '.', services: ['github', 'slack'], scope: 'project' }) ccboot_generate_mcp_config({ project_path: '.', services: ['github', 'sentry', 'postgres'], scope: 'project' }) Returns: Config file location, list of configured services, next steps.

Full project bootstrap with deep project analysis. Reads package.json, Cargo.toml, go.mod, pom.xml, and other project manifests to generate perfectly tailored CLAUDE.md, .claude/ directory, settings.json with smart permissions, agents, .mcp.json, and .claudeignore. The generated CLAUDE.md includes real build commands, actual dependencies, framework-specific architecture rules, and detected patterns — not generic templates. Examples: ccboot_init_project({ project_path: '.', tech_stack: ['nextjs'], team_size: 5 }) ccboot_init_project({ project_path: './api', tech_stack: ['fastapi'], team_size: 12, compliance: ['hipaa'] }) ccboot_init_project({ project_path: '.', tech_stack: ['springboot'], team_size: 50, compliance: ['sox', 'soc2'] }) Returns: List of all generated files with descriptions. Error handling: Returns actionable suggestions if project_path doesn't exist or isn't writable.

Lists all Claude Code configuration artifacts in the project with type, location, validation status, and issue details. Supports filtering by artifact type. Artifact types discovered: • claudemd: CLAUDE.md files (root and subdirectory) • skill: Skills in .claude/skills/ • agent: Subagents in .claude/agents/ • hook: Hooks in .claude/settings.json • knowledge: Docs in .claude/docs/ • mcp-config: .mcp.json configuration • settings: .claude/settings.json Examples: ccboot_list_artifacts({ project_path: '.' }) ccboot_list_artifacts({ project_path: '.', type_filter: 'skill' }) ccboot_list_artifacts({ project_path: '.', type_filter: 'hook' }) Returns: Formatted list with validation status per artifact. Error: If project_path doesn't exist.

Deep validation of all Claude Code configuration files. Catches real problems before they cause confusing behavior in Claude Code sessions. Checks performed: • CLAUDE.md: Exists, not empty, starts with heading, under 500 lines • Skills: Valid YAML frontmatter, required 'name' and 'description' fields, name under 64 chars, description under 200 chars • Settings: Valid JSON, proper hook structure • .mcp.json: Valid JSON structure • Agents: Files exist and are readable auto_fix mode can repair: • Trailing commas in JSON • Missing frontmatter fields (adds placeholders) CI mode (ci_mode: true): • Forces JSON output format for machine readability • Returns isError: true when validation fails (exit code 1 in CLI) • Ideal for CI/CD pipelines and pre-commit hooks Examples: ccboot_validate_config({ project_path: '.', fix_mode: 'report' }) ccboot_validate_config({ project_path: '.', fix_mode: 'auto_fix' }) ccboot_validate_config({ project_path: '.', ci_mode: true }) Returns: Validation report with errors, warnings, and applied fixes.