Claude-cod-top-2026

The bug that breaks AI code in production

Agent writes a test.
Runs it on synthetic data it just generated.
Reports F1=1.000 ✅ SUCCESS.
You deploy.
Real-world data crashes everything.

This is called Validation Theater.
This is the only Claude Code config that catches it automatically.

Every claim carries an evidence marker —
[VERIFIED-REAL] (real data, sources cited) vs [VERIFIED-SYNTHETIC] (mock data, never valid for production claims).
Hard rule baked into rules/integrity.md: synthetic ≠ real.

_{Backed by 57 hooks · 14 agents + 3 teams · 1306 tests · 76% coverage · MIT · Deploy in 5 min}

📋 No install? Get the rules only:
docs/anti-hallucination.md — single file, ~500 tokens, paste into your CLAUDE.md.
Catches Validation Theater on its own. Compatible with any Claude Code config.

Why This Config?

Claude Code без этого конфига — как Ferrari на ручнике: мощный, но 60% потенциала потеряно.
With this config — каждый коммит верифицирован, каждый агент помнит контекст, каждая ошибка записана и больше не повторяется.

Most configs are a single CLAUDE.md bloated to 3000+ tokens. This is different:

When to Use This vs everything-claude-code

everything-claude-code is a great alternative — bigger, multi-platform, Anthropic Hackathon Winner. Both are MIT, pick what fits.

Use everything-claude-code if:

• You want multi-language coverage (TS, Go, Java, Kotlin, Rust, C++, PHP — 12+ ecosystems)
• You work across multiple harnesses (Codex, Cursor, OpenCode, Gemini — not just Claude Code)
• You want a GUI dashboard for browsing components
• You like the paid tier path (ECC Tools GitHub App, free / pro / enterprise)

Use this config if:

• "Validation Theater" is a $$$ risk for you, not abstract — Evidence Policy is enforced as hard rule, not just a skill
• You work with sensitive data (PII, finance, healthcare) — built-in redaction hook scrubs sensitive strings before any external MCP call
• You need to read every hook before installing — only ~10 MB, plain Python, no JS dependencies, every file readable in 10 minutes
• You prefer Claude Code only with deep specialization over multi-platform breadth
• You speak Russian — README and rules have RU-first sections, useful for CIS dev teams

Comparison at a glance:

If multi-language / cross-harness matters more than anti-hallucination focus — pick ECC. If anti-hallucination on sensitive data is your job-critical risk — pick this one.

🚀 Start Here (pick your path)

New to this? Don't install everything at once. Pick the path that matches your goal:

Minimal path (recommended to start): installs just 3 files — CLAUDE.md, integrity.md, security.md. No hooks, no agents, no complexity. Add more when you need it.

Quick Start

# One-liner — Mac / Linux / WSL
git clone https://github.com/sergeeey/Claude-cod-top-2026.git && cd Claude-cod-top-2026 && bash install.sh --profile=standard --non-interactive

Windows (PowerShell): git clone https://github.com/sergeeey/Claude-cod-top-2026.git; cd Claude-cod-top-2026; bash install.sh --profile=standard --non-interactive

After install: restart Claude Code (/clear or new session) — hooks activate automatically.

Plugin Install (recommended — Claude Code v2.1.80+)

# Register this repo as a marketplace source (once per machine)
/plugin marketplace add sergeeey/Claude-cod-top-2026

# Install the plugin
/plugin install claude-cod-top-2026

Windows note: Claude Code doesn't pre-register third-party marketplaces on Windows.
Add to your ~/.claude/settings.json manually if /plugin marketplace add fails:

"extraKnownMarketplaces": {
  "claude-cod-top-2026": {
    "source": { "source": "github", "repo": "sergeeey/Claude-cod-top-2026" }
  }
}

Classic Install (all platforms)

git clone https://github.com/sergeeey/Claude-cod-top-2026.git
cd Claude-cod-top-2026

bash install.sh                                    # interactive
bash install.sh --link full                        # symlink + auto-update
bash install.sh --profile=full --non-interactive   # CI / headless

56 Hooks — 25 Events

Hooks run 100% of the time — deterministic Python guards, not probabilistic instructions.

⚡ Power Modes — Magic Keywords

Type anywhere in your prompt:

Modes are additive — ralph security audit = Persistent mode + security-audit skill.

13 Agents + 3 Teams

╔══════════════════════════════════════════════════════════╗
║  STRATEGIC — Opus          ·  20% of tasks               ║
║  navigator(memory:user)  architect  sec-auditor  teacher  ║
╠══════════════════════════════════════════════════════════╣
║  WORKHORSE — Sonnet        ·  80% of tasks               ║
║  builder(worktree)  tester(worktree)  explorer  reviewer  ║
╠══════════════════════════════════════════════════════════╣
║  TEAMS — parallel execution                              ║
║  review-squad  →  reviewer + sec-auditor (parallel)      ║
║  build-squad   →  builder  + tester     (isolated wt)    ║
║  research-squad →  explorer + verifier  (search+verify)  ║
╚══════════════════════════════════════════════════════════╝

4 agents with persistent memory · 2 agents with worktree isolation · Sonnet-first, Opus escalation only

Evidence Policy

Every factual claim is tagged:

[VERIFIED-HIGH]    ≥2 sources confirmed       → can be used as fact
[VERIFIED-MEDIUM]  1 source + inference        → careful wording
[VERIFIED-LOW]     indirect evidence           → "there are signs, but..."
[UNKNOWN]          no confirmation             → do not guess

Confidence Scoring 0.0–1.0 based on source count. Rationalization Prevention — 10 common AI excuses with countermeasures baked into rules.

Status Line

Zero token cost — always visible at the bottom of the terminal:

[claude-sonnet] ▓▓▓▓▓▓▓░░░░░░░░░░░░░ 35% | main | $0.42 | 3m5s

Security

InputGuard — 7 injection categories:

PII Redaction — 12 patterns stripped before external MCP calls:
National IDs · Bank cards · IBAN · API keys · GitHub tokens · AWS keys · JWT · Email · Phone · IPs

Testing

pip install pytest pytest-cov ruff mypy

pytest tests/ -v --cov=hooks --cov-report=term-missing   # 1306 tests
ruff check hooks/ scripts/ tests/
mypy hooks/utils.py hooks/input_guard.py
bash tests/test_all.sh   # 82 smoke tests

1306 passing · 0 failing · 76% coverage · 296/296 smoke tests

Obsidian Integration

Two automation hooks keep your Obsidian vault in sync with Claude Code activity:

Vault layout (~/.claude/memory/):

wiki/          ← processed knowledge (auto-generated)
raw/           ← quick drop → auto-converted at session end
mocs/          ← Maps of Content (6 MOCs)
_auto/wiki/    ← thematic indices (Claude-Code / Lessons / Projects)
daily/         ← session reports

graph.json colorGroups must be set while Obsidian is closed — the app overwrites on launch.

MCP Profiles

CORE (default)    SCIENCE              DEPLOY
context7          + ncbi-datasets      + vercel
basic-memory      + uniprot            + netlify
playwright        + pubmed-mcp         + supabase
ollama                                 + sentry

~/.claude/mcp-profiles/switch-profile.ps1 science

CircuitBreaker auto-fallback: context7 → WebSearch · playwright → WebFetch · ollama → cloud

Claude-cod-top-2026/
├── CLAUDE.md                      Core config (66 lines, ~500 tokens)
│
├── rules/                         8 modular rules (loaded on demand)
│   ├── coding-style.md
│   ├── security.md
│   ├── testing.md
│   ├── integrity.md
│   ├── memory-protocol.md
│   ├── context-loading.md
│   ├── permissions.md
│   └── mentor-protocol.md
│
├── hooks/                         56 Python guards (52 hooks + 4 support libs)
│   ├── utils.py                   21 shared functions (DRY)
│   ├── settings.json              Hook registry + 27 deny patterns
│   ├── input_guard.py             Prompt injection
│   ├── mcp_circuit_breaker.py     MCP resilience
│   ├── statusline.py              Terminal status bar
│   └── ...                        51 more hooks
│
├── agents/                        14 active + 3 teams
│   ├── navigator.md               Strategic (Opus, memory:user)
│   ├── builder.md                 Code (Sonnet, worktree)
│   ├── reviewer.md                Review (Sonnet, memory:project)
│   ├── sec-auditor.md             Security (Opus, memory:project)
│   └── teams/                     review-squad · build-squad · research-squad
│
├── skills/
│   ├── core/                      9 universal skills
│   └── extensions/                40 domain skills
│
├── assets/                        Visual assets
│   ├── banner.svg                 Hero banner (animated)
│   └── pipeline.svg               Hook execution pipeline diagram
│
├── tests/                         1306 tests · 39 files
├── docs/                          Architecture · guides · anti-patterns
├── mcp-profiles/                  3 profiles (core/science/deploy)
└── .github/workflows/ci.yml       pytest + ruff + mypy + secrets scan

Used in Production

This config runs on a live system (29K LOC, real users, real deploys):

• pre_commit_guard blocked accidental push to main during a hotfix
• pattern_extractor auto-logged debugging lessons from fix: commits
• memory_guard kept activeContext.md current across 3 deploy cycles

Not a demo. Real system. Real incidents.