Portable workflow kit for Claude Code. One install. Zero config.
Stop deploying bugs. ccnest makes Claude Code read before it writes, verify before it ships, and never hallucinate your codebase.
You ship a fix. It works locally. Claude Code wrote it in thirty seconds. Then production breaks, because the "fix" called a function that does not exist, bypassed the auth middleware your team spent a quarter hardening, or duplicated a helper that already lives three folders over. The deploy-test-fix loop eats your afternoon and your trust in the tool.
The root cause is not the model. It is the absence of a workflow. Out of the box, an AI coder has no memory of your conventions, no map of your entry points, no idea which sanitization function you prefer, and no way to verify that what it wrote actually integrates with what you already shipped. Every session starts from zero, and every session quietly hallucinates.
Generic security scanners make it worse. They flag $_POST as "unsanitized" when your project already runs every request through a central cleaner. They raise false positives faster than you can dismiss them, so you stop reading the output, and the real vulnerability slips through the noise.
- Fingerprint. On install, ccnest scans your project and builds a map: languages, frameworks, auth middleware, sanitization functions, DB access pattern, entry points.
- Project-aware agents. Security, auth, and impact-analysis agents read the map first, so they only flag code that bypasses your conventions — not generic patterns.
- Hooks that enforce quality. Every edit is tracked. Every session end runs a post-check. Intent is routed: "change" prompts get full workflow context, "query" prompts stay silent.
- Read-before-write rules. Rules are lazy-loaded and remind the agent to trace data flow, check references, and never invent function signatures.
- Compaction resilience. Session-start injection ensures that even after context compaction, the agent remembers ccnest is active and re-reads the project map.
macOS / Linux
cd your-project
curl -fsSL https://raw.githubusercontent.com/mertkilic0111/ccnest/main/bin/install.sh | bashWindows (PowerShell or CMD)
powershell -c "irm https://raw.githubusercontent.com/mertkilic0111/ccnest/main/bin/install.ps1 | iex"Windows (CMD shortcut)
curl -fsSL https://raw.githubusercontent.com/mertkilic0111/ccnest/main/bin/install.cmd -o install.cmd && install.cmdThe Windows installers run install.sh through Git Bash, so Git for Windows must be installed.
Then restart Claude Code. That is it.
- Fingerprint.
fingerprint.shdetects your language, framework, and key patterns → writes.claude/state/fingerprint.json. - Copy. Core agents, hooks, rules, commands, and templates are copied to
.claude/. - CLAUDE.md. A small project-level memo is created or appended between
<!-- ccnest:start -->/<!-- ccnest:end -->markers. - settings.json. Hooks are registered. If a settings file already exists, ccnest merges safely and preserves your existing hooks.
- Restart. Close and reopen Claude Code so the new hooks and agents load.
| Language | Status | Module |
|---|---|---|
| PHP | v0.1 | lang/php/ |
| JavaScript / TypeScript | v0.1 | lang/js/ |
| Python | v0.1 | lang/python/ |
| Go | planned v0.2 | — |
| Ruby | planned v0.2 | — |
| Java | planned v0.2 | — |
For polyglot projects in v0.1, the dominant language module is installed automatically. You can manually copy a secondary module afterwards.
┌─────────────────────────────────────────────────────────┐
│ Layer 5: Commands /check /baseline /scan ... │
├─────────────────────────────────────────────────────────┤
│ Layer 4: Agents security-scanner, auth-checker │
│ impact-analysis, link-checker │
├─────────────────────────────────────────────────────────┤
│ Layer 3: Rules read-before-write, input-sec │
├─────────────────────────────────────────────────────────┤
│ Layer 2: Hooks track-changes, enforce-postcheck│
│ intent-router, session-report │
├─────────────────────────────────────────────────────────┤
│ Layer 1: Fingerprint project-map.json (the brain) │
└─────────────────────────────────────────────────────────┘
Every layer reads the fingerprint. Nothing is hardcoded to a framework.
Q: Does ccnest work without an internet connection? After install, yes. Fingerprinting, hooks, and agents all run locally.
Q: Will it interfere with my existing CLAUDE.md or settings.json? No. ccnest wraps its content in marker comments and merges settings hooks by command-string deduplication. Your content outside the markers is never touched.
Q: How do I uninstall?
rm -rf .claude/ and revert the ccnest block in CLAUDE.md and settings.json. A proper uninstall script is planned for v0.2.
Q: My project uses two languages. What happens?
v0.1 installs the dominant language module and prints a notice about the secondary. You can manually copy the secondary module from lang/.
Q: Do I need any runtime other than bash?
No. ccnest is bash plus Claude Code. python3 is used only if present, for safe JSON merging.
Q: Why are the agents so conservative about editing? Every agent is instructed not to modify files directly. They report. The main Claude Code session does the editing. This prevents runaway multi-file changes.
Q: Can I view a /scan result without re-running the sweep?
Yes. Every /scan writes .claude/state/scan-report.html. Run /report to replay it inline, or /report pdf to export .claude/state/scan-report.pdf via wkhtmltopdf or headless Chromium. /report is read-only and never re-runs any scanner.
See CONTRIBUTING.md.
MIT — see LICENSE.