Configuration teardown · three surfaces

Claude Stack Teardown

Every instruction file, plugin, connector, skill, subagent and scheduled task in one working Claude setup — read straight off disk, credentials stripped. Built to be diffed against yours.

Audited 20 Aug 2026 CLI Claude Code 2.1.220 Host macOS · single workstation Secrets redacted
3CLAUDE.md files
all project-scoped
2plugins installed
3 marketplaces
1local MCP server
10 web connectors
5custom skills
+ subagents
0hooks defined
anywhere
3307permission rules
in one project

Orientation

How to read this

Each row is one real configuration point with the exact path it lives at. The status column is the part that matters for comparing setups:

Set configured and in use   Empty the file or directory doesn't exist   Needs auth installed but not authorized   Idle present but disabled or retired

Two surfaces are only partly inspectable. Claude Code config lives in files on disk, so all of it is verifiable. Claude.ai settings, Projects, Styles, and Cowork memory live server-side — those are marked and can only be confirmed in the web UI.

Surface one

Claude Code

Instruction files

PathContentsStatus
~/.claude/CLAUDE.md No global instruction file — nothing applies across all projects Empty
<project>/CLAUDE.md
36 lines
"Long-Running Harness v1" — three roles (planner / generator / evaluator), hard rules (state in JSON, only the evaluator marks work done, two failures trigger teardown), file map, session-boot reading order Set
sales-dashboard/CLAUDE.md
150 lines
Full project doc: stack, key files, pages, local run, environment, email / Teams / calendar sync, imports, and a "Do NOT" section Set
media-tool/CLAUDE.md
1 line
A single @AGENTS.md import pointer Set

Settings, permissions and hooks

~/.claude/settings.json is the only user-scope settings file — there is no settings.local.json at that level.

{
  "enabledPlugins": {
    "obsidian@obsidian-skills": true,
    "blotato@blotato-skills": true
  },
  "extraKnownMarketplaces": { "obsidian-skills": …, "blotato-skills": … },
  "tui": "fullscreen",
  "theme": "dark",
  "skipWorkflowUsageWarning": true,
  "inputNeededNotifEnabled": true,
  "agentPushNotifEnabled": true
}
ItemDetailStatus
Hooks No hooks key in any settings file, no ~/.claude/hooks/ directory. No automated pre/post tool behavior anywhere. Empty
Project permissions
.claude/settings.local.json
3,307 entries in permissions.allow and nothing else. Mostly one-off literal commands with hardcoded absolute paths rather than reusable patterns. Bloated
Second project
second-project/.claude/
6 allow entries — the healthy shape for comparison Set
launch.json 4 dev servers at project root (ports 8787, 5173, 5063, 8793) plus 7 subprojects carrying their own — Shopify theme :9292, Astro portal :4321, wrangler :8788, and others Set

Plugins and marketplaces

PluginSourceStatus
obsidian
v1.0.1 · user scope
Marketplace kepano/obsidian-skills — vault CLI, wikilink markdown, Bases, JSON Canvas, Defuddle web extraction Set
blotato
user scope
Marketplace Blotato-Inc/blotato-skills — brand brief, post writer, post grader, viral hooks, repurpose, scheduler Set
claude-plugins-official Marketplace anthropics/claude-plugins-official registered; supplies the inline anthropic-skills, marketing, sales, slack and cowork-plugin-management bundles Registered

MCP servers

Exactly one MCP server is configured locally, in ~/.claude.json. There are no .mcp.json files anywhere in the project tree — everything else visible in a session comes from claude.ai connectors, not local config.

ServerTransportStatus
blotato HTTP · mcp.blotato.com/mcp · authenticates with an API key passed as a request header redacted Set

Skills, commands and subagents

LocationContentsStatus
~/.claude/skills/ 11 Cloudflare skill folders: cloudflare, agents-sdk, durable-objects, sandbox-sdk, wrangler, workers-best-practices, web-perf, turnstile-spin, cloudflare-email-service, cloudflare-one, cloudflare-one-migrations Set
~/.claude/commands/ No global slash commands Empty
~/.claude/agents/ No global subagents Empty
.claude/skills/longhorizon.md Seven-step orchestrator for multi-sprint builds · tools Task, Read, Write · takes a one-line prompt Set
.claude/skills/divergence-audit.md Audits a long-horizon run transcript for harness divergence · tools Read, Write · takes a transcript path Set
.claude/agents/planner.md Breaks vague prompts into user-visible sprints · tools Read, Write · forbidden from naming files, frameworks or libraries Set
.claude/agents/generator.md Optimistic builder, cannot mark work done · tools Read, Write, Edit, Bash, Glob, Grep, mcp__playwright__* · negotiate vs build mode Set
.claude/agents/evaluator.md Adversarial critic, owns acceptance, can order teardown · tools Read, Bash, Glob, Grep, mcp__playwright__* · rubric weights design ×3 and originality ×3 Set

Scheduled tasks

Seven task folders in ~/.claude/scheduled-tasks/, each defined by a SKILL.md. Three are dead weight.

TaskCadence and jobStatus
mail-syncEvery 30 min, Mon–Fri 7a–6p — Outlook mail into JSON, then an import scriptLive
chat-syncHourly, Mon–Fri 7a–6p — Teams channels routed to vendor alerts and visitor tasksLive
content-ingestDaily — pulls a content queue and produces ready-to-post social packs; posts nothing itselfLive
notes-vault-syncDaily — memory files and project docs into an Obsidian vaultLive
morning-refreshDisabled — moved to a cron job on another machineIdle
daily-project-moverRetired — replaced by a 4 AM launchd jobIdle
widget-url-reminderOne-time reminder, almost certainly already firedIdle

Surface two

File-based memory

Twelve memory files plus a MEMORY.md index, one fact per file with typed frontmatter. Covered: role, six active projects, an Obsidian vault, a content pipeline, a hardware warning about a failing drive, and one catalog-hygiene rule.

The shape of the gap

Eleven of the twelve files are project, user or reference type. Only one is feedback — the type that stores how you want Claude to work. There is effectively nothing recorded about preferred tone, review standards, or working habits, which is exactly the category most worth comparing between two people.

Surface three

Claude.ai and Cowork

Not readable from disk

Custom instructions, Projects and their knowledge, Styles, and Cowork's saved memory are all stored server-side. Nothing on this machine reveals them — they have to be read out of the web UI directly. Everything below is what the runtime proves is connected, which is the next best evidence.

Connectors

GroupServicesStatus
Linked connectors
10 total
Gmail · Google Drive · Google Calendar · Microsoft 365 (Outlook, SharePoint, Teams) · Slack · Shopify · Canva · GoDaddy · Stripe · Resy Live
Marketing plugin
10 connectors
Ahrefs · Amplitude (×2 regions) · Canva · Figma · HubSpot · Klaviyo · Notion · Similarweb · Supermetrics — installed but never authorized Needs auth
Sales plugin
9 connectors
Apollo · Atlassian · Clay · Close · Fireflies · Monday · Outreach · Similarweb · ZoomInfo — installed but never authorized Needs auth
Slack (Salesforce) Plugin skills load; the underlying Slack MCP server is unauthorized Needs auth

Roughly twenty connectors are installed but dead. They cost nothing but they clutter every tool listing and make the setup look richer than it is.

Skills actually used

Fourteen skills show real usage: xlsx, pdf, pptx, schedule (×2 variants), deep-research, claude-api, fewer-permission-prompts, artifact-design, artifact-capabilities, marketing:campaign-plan, cloudflare-email-service, wrangler, obsidian:obsidian-markdown.

Plugin bundles loaded inline: anthropic-skills, cowork-plugin-management, slack-by-salesforce, marketing, sales, obsidian, blotato.

Findings

Gaps worth closing

  1. An API key sits in plaintext. The one local MCP server stores its credential as a literal string in ~/.claude.json. That file gets backed up, synced and screen-shared. Rotate the key and move it behind an environment variable reference.
  2. 3,307 permission rules in one project. Append-only sludge — individual image-conversion commands and specific URLs, each captured as its own literal rule. They do almost nothing, because the next command won't match. The /fewer-permission-prompts skill collapses these into patterns.
  3. No global CLAUDE.md, no hooks, no global agents or commands. The harness setup here is genuinely strong — three specialized subagents with deliberately asymmetric tool grants and an evaluator that owns acceptance — but it only applies inside one folder. Nothing carries across projects.
  4. Memory holds facts, not preferences. One feedback-type memory against eleven project-type ones. The things that make an assistant feel dialed in — how you want work reviewed, what to never do without asking, preferred output shape — aren't written down anywhere.
  5. Twenty unauthorized connectors. Either finish the OAuth for the ones you'll use or remove the plugins, so the tool surface reflects reality.

Reciprocity

Generate the same inventory

The audit above was produced by a read-only shell script. It walks the same paths, prints the same sections, and replaces any header, token, key or password value with [REDACTED] before printing. It writes nothing and modifies nothing.

bash claude-setup-inventory.sh                 # audits the current directory
bash claude-setup-inventory.sh ~/code/myapp   # or a specific project

It reports: every CLAUDE.md with its headings · all four settings files with permission counts · hooks · installed plugins and marketplaces · MCP servers at user and project scope · connectors ever linked · skill and plugin usage · global and project skills, commands and subagents · scheduled tasks · every launch.json dev server.

Run it on both machines and diff the output — that comparison is the actual point, and it's far faster than reading two of these documents side by side.