~ / rigs / ngc-shj / claude-code-config

ngc-shj/claude-code-config

Safe default settings for Claude Code with agentic multi-model architecture

↗ GitHub ★ 1 MIT updated 26d ago personal setup Claude Code

share on X

ARCHETYPE

Fort Knox

Deny lists, pre-tool hooks, sandboxing. Nothing touches prod without a signature.

CONTEXT TAX · EVERY TURN

~1.9k tokens

Featherweight · median rig: 2.3k · breakdown

GUARDRAILS

4/5

Blocks destructive commands · Pre-tool screening hook · No YOLO mode · Sandbox or ask-first rules · details

Copy this rig

# review before running: this installs third-party code
$ npx degit ngc-shj/claude-code-config/skills ./rig-claude-code-config/skills
$ npx degit ngc-shj/claude-code-config/hooks ./rig-claude-code-config/hooks

MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.

Merge into .claude/settings.json (project) or ~/.claude/settings.json (user). Hook commands reference scripts in the source repo — copy those too.

{
  "permissions": {
    "deny": [
      "Bash(rm -rf /*)",
      "Bash(rm -rf ~*)",
      "Bash(rm -rf $HOME*)",
      "Bash(rm -rf ./*)",
      "Bash(rm -r *)",
      "Bash(sudo *)",
      "Bash(su *)",
      "Bash(chmod 777 *)",
      "Bash(chmod -R *)",
      "Bash(chown *)",
      "Bash(mkfs *)",
      "Bash(dd *)",
      "Bash(git push --force)",
      "Bash(git push --force *)",
      "Bash(git push -f*)",
      "Bash(git reset --hard*)",
      "Bash(git clean -fd*)",
      "Bash(git clean -fx*)",
      "Bash(git checkout -- .)",
      "Bash(git branch -D *)",
      "Bash(> *)",
      "Bash(curl * -d *)",
      "Bash(curl * --data*)",
      "Bash(curl * -X POST*)",
      "Bash(curl * -X PUT*)",
      "Bash(curl * -X DELETE*)",
      "Bash(wget * --post*)",
      "Bash(pkill *)",
      "Bash(killall *)",
      "Bash(shutdown *)",
      "Bash(reboot *)",
      "Bash(launchctl *)",
      "Bash(docker system prune*)",
      "Bash(docker volume prune*)",
      "Bash(docker network prune*)",
      "Bash(docker image prune*)",
      "Bash(docker container prune*)",
      "Bash(docker push*)",
      "Bash(docker login*)",
      "Bash(docker save*)",
      "Bash(docker load*)",
      "Bash(docker-compose down -v*)",
      "Bash(docker compose down -v*)",
      "Bash(npm publish*)",
      "Bash(npm unpublish*)",
      "Bash(npx -y *)",
      "Bash(eval *)",
      "Bash(source *)",
      "Bash(xargs *)"
    ],
    "ask": [
      "WebFetch(domain:raw.githubusercontent.com)",
      "Bash(git push*)",
      "Bash(git stash drop*)",
      "Bash(git stash clear*)",
      "Bash(gh pr merge*)",
      "Bash(gh pr close*)",
      "Bash(gh issue close*)",
      "Bash(kill *)",
      "Bash(rm *)",
      "Bash(mv *)",
      "Bash(docker stop *)",
      "Bash(docker rm *)",
      "Bash(docker rmi *)",
      "Bash(docker volume rm *)",
      "Bash(docker network rm *)",
      "Bash(docker compose down*)",
      "Bash(docker-compose down*)",
      "Bash(docker compose restart*)",
      "Bash(docker-compose restart*)",
      "Bash(docker pull *)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write|MultiEdit",
        "hooks": [
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-sensitive-files.sh"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "rtk hook claude"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-sensitive-files.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-destructive-docker.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-vcs-history-rewrite.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-audit-observability-destruction.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-recovery-path-destruction.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-secret-key-destruction.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/block-authz-state-destruction.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/commit-msg-check.sh"
          },
          {
            "type": "command",
            "command": "bash ~/.claude/hooks/check-pre-pr.sh"
          }
        ]
      }
    ]
  }
}

Skills (9)

agent-review context-budget explore pr-create retrospect security-scan simplify test-gen triangulate

Hooks (15)

event	matcher	runs
PreToolUse	Edit\|Write\|MultiEdit	bash ~/.claude/hooks/block-sensitive-files.sh
PreToolUse	Bash	rtk hook claude
PreToolUse	Bash	bash ~/.claude/hooks/block-sensitive-files.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-destructive-docker.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-vcs-history-rewrite.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-audit-observability-destruction.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-recovery-path-destruction.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-secret-key-destruction.sh
PreToolUse	Bash	bash ~/.claude/hooks/block-authz-state-destruction.sh
PreToolUse	Bash	bash ~/.claude/hooks/commit-msg-check.sh
PreToolUse	Bash	bash ~/.claude/hooks/check-pre-pr.sh
Stop	*	bash ~/.claude/hooks/stop-notify.sh
Notification	permission_prompt\|idle_prompt	bash ~/.claude/hooks/notify.sh
SessionStart	*	bash ~/.claude/hooks/session-retrospect-check.sh
SessionStart	*	bash ~/.claude/hooks/session-llm-check.sh

Permissions

deny (49)

Bash(rm -rf /*)

Bash(rm -rf ~*)

Bash(rm -rf $HOME*)

Bash(rm -rf ./*)

Bash(rm -r *)

Bash(sudo *)

Bash(su *)

Bash(chmod 777 *)

Bash(chmod -R *)

Bash(chown *)

Bash(mkfs *)

Bash(dd *)

Bash(git push --force)

Bash(git push --force *)

Bash(git push -f*)

Bash(git reset --hard*)

Bash(git clean -fd*)

Bash(git clean -fx*)

Bash(git checkout -- .)

Bash(git branch -D *)

Bash(> *)

Bash(curl * -d *)

Bash(curl * --data*)

Bash(curl * -X POST*)

Bash(curl * -X PUT*)

Bash(curl * -X DELETE*)

Bash(wget * --post*)

Bash(pkill *)

Bash(killall *)

Bash(shutdown *)

Bash(reboot *)

Bash(launchctl *)

Bash(docker system prune*)

Bash(docker volume prune*)

Bash(docker network prune*)

Bash(docker image prune*)

Bash(docker container prune*)

Bash(docker push*)

Bash(docker login*)

Bash(docker save*)

Bash(docker load*)

Bash(docker-compose down -v*)

Bash(docker compose down -v*)

Bash(npm publish*)

Bash(npm unpublish*)

Bash(npx -y *)

Bash(eval *)

Bash(source *)

Bash(xargs *)

ask (20)

WebFetch(domain:raw.githubusercontent.com)

Bash(git push*)

Bash(git stash drop*)

Bash(git stash clear*)

Bash(gh pr merge*)

Bash(gh pr close*)

Bash(gh issue close*)

Bash(kill *)

Bash(rm *)

Bash(mv *)

Bash(docker stop *)

Bash(docker rm *)

Bash(docker rmi *)

Bash(docker volume rm *)

Bash(docker network rm *)

Bash(docker compose down*)

Bash(docker-compose down*)

Bash(docker compose restart*)

Bash(docker-compose restart*)

Bash(docker pull *)

allow (120)

mcp__ollama__ollama_generate

mcp__ollama__ollama_chat

mcp__ollama__ollama_list

mcp__ollama__ollama_show

mcp__ollama__ollama_pull

mcp__ollama__ollama_embeddings

mcp__searxng__searxng_search

mcp__searxng__searxng_images

mcp__searxng__searxng_news

Bash(git status*)

Bash(git log*)

Bash(git diff*)

Bash(git show*)

Bash(git branch*)

Bash(git submodule status *)

Bash(git ls-tree *)

Bash(git stash list*)

Bash(git remote -v*)

Bash(git fetch*)

Bash(git pull*)

Bash(git add *)

Bash(git commit *)

Bash(git checkout *)

Bash(git switch *)

Bash(git merge *)

Bash(git rebase *)

Bash(git cherry-pick *)

Bash(git tag *)

Bash(gh pr *)

Bash(gh issue *)

Bash(gh repo view*)

Bash(ls *)

Bash(grep *)

Bash(find *)

Bash(head *)

Bash(tail *)

Bash(cat *)

Bash(wc *)

Bash(od *)

Bash(diff *)

Bash(sort *)

Bash(uniq *)

Bash(which *)

Bash(echo *)

Bash(pwd*)

Bash(env*)

Bash(set *)

Bash(npm list*)

Bash(npm run *)

Bash(npm test*)

Bash(npm install*)

Bash(npm ci*)

Bash(npx *)

Bash(node *)

Bash(nvidia-smi*)

Bash(lsof *)

Bash(curl -s *)

Bash(curl --silent *)

Bash(docker ps*)

Bash(docker images*)

Context tax

Instructions: 1.1kMCP tool schemas (est.): 0Skill metadata: 746Subagent metadata: 0

ALWAYS-LOADED FILES (claude-code)

≡

CLAUDE.md · 40 lines · ~380 tok

≡

global/CLAUDE.md · 59 lines · ~758 tok

Estimate: characters ÷ 4 for instruction files and skill/subagent descriptions; MCP schema sizes from typical tool counts. Harnesses with deferred tool loading pay less. Method

Guardrails 4/5

✓

Blocks destructive commands

21 deny/ask rule(s) e.g. Bash(rm -rf /*)

✗

Protects secrets

No deny rule for .env / keys / ~/.ssh

✓

Pre-tool screening hook

11 PreToolUse hook(s)

✓

No YOLO mode

Permission prompts stay on

✓

Sandbox or ask-first rules

20 ask rule(s), e.g. WebFetch(domain:raw.githubusercontent.com)

Badge

Add to your README:

[![AgentRigs](https://agentrigs.dev/badge/rig/ngc-shj/claude-code-config.svg)](https://agentrigs.dev/r/ngc-shj/claude-code-config)

Indexed from commit 793b49ce416b on 2026-10-09. Data is structure only — env values and anything secret-looking are stripped.

Similar rigs

sdsrss/code-graph-mcp

AST knowledge graph MCP server for Claude Code — semantic search, call graph traversal, HTTP route tracing, impact analysis. Auto-indexes 10 languages via Tree-sitter.

★ 84 project Claude Code 1 mcp 2 skills 3d ago

Pragmatist 2.5k tok ·

IFAKA/claude-code-dotfiles

Shareable Claude Code context optimization config — curl install

★ 0 setup Claude Code 3 skills 4mo ago

Minimalist 498 tok ·

erikstmartin/dotfiles

—

★ 17 setup Claude CodeCodex 2 skills 2 agents 5 hooks 4d ago

Automator 186 tok ·

HartBrook/staghorn

Sync Claude Code configs and skills from GitHub — for teams, communities, or across your personal projects. Run evals to verify your guidelines actually work.

★ 9 project Claude Code 4 skills 4mo ago

Minimalist 196 tok ·