Back to directory

Trail of Bits Claude Code Config

Trail of Bits' opinionated collection of Claude Code defaults, documentation and workflows for security audits, development and research, covering sandboxing, permissions, hooks, skills and MCP server configuration.

Trail of Bits Claude Code Config

Trail of Bits Claude Code Config packages the opinionated Claude Code setup the company uses across security audits, development and research into an installable configuration repository. Cloning it and running an interactive setup command walks through installing each component, detects what is already configured, and installs its own command so future updates can be re-run from any directory.

Its documented areas include sandboxing, hooks, plugins and skills, MCP server configuration, using local models, and personalization, plus usage guidance on continuous improvement of a setup, project-level CLAUDE.md files, context management, web browsing, a faster response mode, custom commands, and writing new skills and agents, alongside a curated list of recommended skills and MCP servers.

It recommends the Ghostty terminal for its native GPU-accelerated rendering, since it handles the high-volume text output of long AI sessions without lag or the memory growth the project reports for other terminals, and its setup script is written in Shell.

More in Agent skills

See all 581
  • Provenance gate

    github.com

    A deterministic authorization gateway that sits between an AI agent and its tools, tracing where each parameter of a side-effect call came from, and blocking the call or asking a human when the source does not check out.

  • A markdown framework of system rules that restates Isaac Asimov's Four Laws of Robotics as a set of prioritized loss calculations for large-language-model agents to follow, published as a discovery file for agents and crawlers to read.

  • Vitruvius

    github.com

    An engineering research agent that runs a discover, read, synthesize, verify and review loop over technical questions, reading sources directly rather than inferring from titles, and publishing its own scored verifier benchmark, weaknesses included.