Aurakit

Before & After  ·   Quick Start  ·   33 Modes  ·   Tiers  ·   Pipeline  ·   Security  ·   New in v6  ·   Why AuraKit  ·   FAQ

What is AuraKit?

One command. Full-stack app. Production-ready.

AuraKit is a Claude Code skill that replaces 20+ manual instructions with a single /aura command. It auto-detects what you need, scans your project, generates code with security checks on every file, and commits — all in one shot.

npx @smorky85/aurakit        # Install once (30 seconds)
/aura build: login with JWT   # That's it. AuraKit handles the rest.

[!TIP]
30-second install → npx @smorky85/aurakit or bash install.sh, then type /aura in any project.

🔄 Before & After

You: "Build a login API"
Claude: *generates code*
You: "Wait, add input validation"
Claude: *regenerates*
You: "You forgot error handling"
Claude: *patches*
You: "Check for SQL injection"
Claude: *patches again*
You: "Now write tests"
Claude: *generates tests*
You: "The types are wrong..."
(30 min later, still going)

/aura build: login with JWT

# AuraKit automatically:
# → Scans your project stack
# → Plans file-by-file build order
# → Generates with SEC-01~15 rules
# → Validates types + security + tests
# → Commits: feat(auth): add login
# Done. One command. ~3 minutes.

⚡ Quick Start

1 — Clone

git clone https://github.com/smorky850612/Aurakit.git
cd Aurakit

2 — Install (choose one)

bash install.sh                    # Full install (recommended)
# or
npx @smorky85/aurakit              # One-click npm install

Copies skills, hooks (23 handlers), and agents into your Claude Code environment. Merges hooks into settings.json without overwriting your existing configuration.

3 — Use

# Option A — Recommended for daily use (hooks handle security)
claude --dangerously-skip-permissions

/aura build: login with JWT        # BUILD mode (English)
/aura 로그인 기능 만들어줘         # BUILD mode (Korean · auto-detect)
/aura fix: TypeError in auth.ts    # FIX mode
/aura! 버튼 색상 변경               # QUICK mode · ~60% fewer tokens

[!WARNING]
What --dangerously-skip-permissions means: Claude won't ask for confirmation on each tool use. This is intentional — AuraKit's hooks (bash-guard.js, security-scan.js) replace per-action dialogs with automated enforcement. Without install.sh, security relies only on agent role isolation (L1/L2).

Option B — Safer for first-time use: Run claude without the flag. Claude will ask for permission on each Write/Edit/Bash call. Slower, but no hooks required.

[!NOTE]
AuraKit is framework-agnostic — Next.js, FastAPI, Spring, Go, Rust, or anything else. Scout auto-detects your stack.

🏆 Why AuraKit?

"I can just prompt Claude myself" — Yes, but you'll repeat the same 20 instructions every session.

🎯 Modes

AuraKit detects your intent from natural language. Use a namespace prefix (build:, fix:) when the mode is ambiguous.

Start here — 5 core modes cover 90% of daily use

📊 Quality Tiers

• QUICK — Color changes, text edits, single-file tweaks
• ECO — Feature development, most daily work (recommended)
• PRO — Auth, payments, complex business logic
• MAX — Security audits, architecture design, production-critical features

⚙️ How It Works

flowchart TD
    A(["/aura request"]) --> B["Mode Detection\n33 modes · auto from natural language"]
    B --> C["Scout Agent · Haiku\nProject scan → .aura/project-profile.md"]
    C --> D["Micro-Plan\n200-token file-by-file build order"]
    D --> E["Builder Agent\nECO: Sonnet  ·  MAX: Opus"]
    E --> F["Security Hooks\nbash-guard.js · security-scan.js"]
    F --> G{"Triple Verify\n(parallel)"}
    G --> H["V1 · Build / Type Check"]
    G --> I["V2 · Security + Review · Sonnet"]
    G --> J["V3 · TestRunner · Haiku"]
    H --> K["Snapshot Checkpoint\n.aura/snapshots/current.md"]
    I --> K
    J --> K
    K --> |"More files"| E
    K --> |"Complete"| L(["git commit + Report"])

🔐 6-Layer Security

Every generated file passes through up to 6 security gates.

[!WARNING]
L3, L4, L5 are only active after running install.sh or npx @smorky85/aurakit. Without installation, only L1 (agent role boundaries) and L2 (tool blocklist) protect you. If you skip installation, use Claude without --dangerously-skip-permissions so manual confirmation acts as your safety net.

[!IMPORTANT]
Security rules in ~/.claude/rules/aurakit-security.md are always active — applied to every Claude Code session automatically, even without running /aura.

Automatically blocked:

localStorage.setItem('token', ...)    → httpOnly Cookie required
Raw SQL string concatenation          → parameterized queries required
eval() / exec() with user input       → blocked
Hardcoded API keys / passwords        → blocked
.env not in .gitignore                → commit blocked

✨ New in v6

AuraKit v6 makes Sonnet produce Opus-quality code by forcing structured reasoning before every file:

1. I/O Contract — Define types, return values, error cases
2. Existing Code Check — Verify import/naming/style compatibility
3. Edge Case Discovery — Side effects? Concurrency? Input boundaries? External failures? State dependencies?
4. SEC/Q Rule Selection — Pick applicable security & quality rules
5. Then implement — Only after all 4 steps

This eliminates Sonnet's tendency to rush to code, producing measurably better output.

v6 loads only what's needed: 1 language reviewer (not all 10), 1 framework pattern (not all 5), keywords instead of code examples. Context load measured: v5.1 BUILD loaded 82KB → v6 loads 20KB (75.6% reduction). Per-task savings (ECO ~55%, QUICK ~60%) are model-cost estimates based on tier routing — not independently benchmarked like Aider's Polyglot numbers.

SEC-01  SQL injection          SEC-09  HTTPS only
SEC-02  Auth (httpOnly)        SEC-10  .gitignore enforcement
SEC-03  Secret management      SEC-11  NoSQL/Command/XML/LDAP injection
SEC-04  Input validation       SEC-12  Cryptography (AES-256+)
SEC-05  eval/exec blocking     SEC-13  Dependency audit
SEC-06  Error info leakage     SEC-14  Security logging
SEC-07  CORS whitelist         SEC-15  SSRF prevention
SEC-08  Secure random

Plus 13 runtime hooks enforce these at write-time — zero tokens, zero escape.

AuraKit learns your project's patterns after each BUILD/FIX and applies them automatically on the next run.

/aura instinct:show              # All learned patterns
/aura instinct:show auth         # Filter by category
/aura instinct:prune             # Remove low-score patterns
/aura instinct:evolve            # Auto-improve + integrate anti-patterns
/aura instinct:export            # Backup / share with team
/aura instinct:import team.json  # Import from another project

Patterns are stored in .aura/instincts/ and auto-loaded at the start of every /aura session. Teams can share patterns via instinct:export / instinct:import.

AuraKit auto-detects your project language and applies a specialized reviewer in the V2 step.

Force a specific reviewer:

/aura lang:python review:
/aura lang:go fix: goroutine leak

/aura mcp:setup           # Interactive setup wizard
/aura mcp:list            # Show all 14 available configs
/aura mcp:check           # Verify installed servers
/aura mcp:add playwright  # Add a specific server

Supported: Playwright · GitHub · Slack · Linear · Notion · Supabase · PostgreSQL · MongoDB · Redis · Stripe · Vercel · AWS · Sanity · and more.

After every mode completion, AuraKit shows what to do next:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📍 Done: BUILD — JWT Login (8 files)
💰 Token Report:
   Baseline (manual): ~18,200 | Actual: ~7,800 | Saved: 57%
📊 Pipeline: ████████░░░░ 4/7
🔜 Next: /aura review → /aura deploy
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

13-mode transition map guides you through the full pipeline. Session resume detects previous work on startup.

AuraKit now works across all major AI coding tools with platform-specific adapters:

See resources/cross-harness.md for detailed setup per platform.

Agents can spawn child agents when tasks are too large. Hard limits prevent runaway:

See resources/agent-spawning.md for spawn request format and tracking.

/aura batch:loop:[task] until:pass    max:5   # Repeat until tests pass
/aura batch:loop:[task] until:90%     max:3   # Repeat until gap ≥ 90%
/aura batch:loop:[task] until:no-error max:10 # Repeat until error-free

Each iteration runs in isolation. Loop stops when the condition is met or max iterations is reached.

💰 Token Optimization

v6 BUILD: ~6,700 tokens vs ~27,000 in v5.1 — 75% reduction (verified)

🌍 Multilingual Commands

Type in your language without switching input methods. 8 languages, 56+ commands.

v6.3: Multilingual commands no longer require separate skill folders.
All 56+ commands are handled by the core /aura skill via auto-detection
and hooks/korean-command.js. This frees ~83% of Claude Code's skill description budget.

IME support: Korean and Japanese IME reverse-transliteration is handled automatically by hooks/korean-command.js.

🔧 Compatibility

See resources/cross-harness.md for detailed per-platform setup.

aurakit/
├── skills/
│   ├── aura/                        # Main skill — single /aura entry point
│   │   ├── SKILL.md                 # Core instructions (AuraKit v6)
│   │   └── resources/               # 30+ mode-specific pipeline guides
│   │       ├── build-pipeline.md
│   │       ├── fix-pipeline.md
│   │       ├── security-rules.md
│   │       ├── instinct-system.md
│   │       ├── language-reviewers.md
│   │       ├── loop-pipeline.md
│   │       ├── mcp-configs.md
│   │       └── ...                  # +22 more guides
│   ├── aura-compact/                # Snapshot + /compact shortcut
│   └── aura-guard/                  # Token budget monitor
├── agents/
│   ├── scout.md                     # Read-only project scanner (Haiku)
│   ├── worker.md                    # Reviewer + TestRunner (Sonnet)
│   ├── gap-detector.md              # Design↔implementation gap (Haiku)
│   ├── security.md                  # OWASP Top 10 audit (Sonnet)
│   ├── pm-discovery.md              # OST opportunity mapping (Haiku)
│   ├── pm-strategy.md               # JTBD + Lean Canvas (Haiku)
│   └── pm-prd.md                    # PRD generation (Sonnet)
├── hooks/
│   ├── lib/
│   │   ├── common.js                # Shared: addContext, allow, block
│   │   ├── snapshot.js              # Snapshot read/write helpers
│   │   └── python.js                # Cross-platform Python executor
│   ├── security-scan.js             # Secret pattern detection (L4)
│   ├── bash-guard.js                # Dangerous command blocking (L3)
│   ├── build-verify.js              # Compile / type-check after each file
│   ├── bloat-check.js               # 250-line split warning
│   ├── migration-guard.js           # Destructive migration blocking (L5)
│   ├── injection-guard.js           # Prompt injection detection
│   ├── auto-format.js               # Prettier / gofmt / black / rustfmt
│   ├── governance-capture.js        # Architecture decision audit trail
│   ├── post-tool-failure.js         # MCP recovery + failure tracking
│   ├── session-stop.js              # Session metrics + Instinct hints
│   ├── korean-command.js            # IME reverse-transliteration
│   ├── pre-compact-snapshot.js      # Save context before compact
│   ├── post-compact-restore.js      # Restore context after compact
│   ├── token-tracker.js             # Token usage tracking
│   └── token-stats-inject.js        # Token stats context injection
├── rules/
│   └── aurakit-security.md          # Always-active security rules
├── templates/
│   ├── design-system-default.md     # CSS variable token defaults
│   └── project-profile-template.md
├── install.sh                       # One-command installer
├── README.md
└── LICENSE                          # MIT

security-scan.js checks for these patterns on every file write:

API Keys:         [A-Za-z0-9]{32,} in key/secret/token context
AWS Keys:         AKIA[0-9A-Z]{16}
Private Keys:     -----BEGIN.*PRIVATE KEY-----
Passwords:        password\s*=\s*['"][^'"]+
JWT Hardcoded:    eyJ[A-Za-z0-9]{20,}
Connection Str:   (mongodb|postgres|mysql):\/\/.*:.*@
localStorage:     localStorage\.setItem\(['"]token
SQL Concat:       query\s*\+=|query\s*=.*\+.*req\.(body|params|query)

🤝 Contributing

We welcome contributions! Add language reviewers, framework patterns, hooks, or security rules.

# Quick contribution workflow
fork → branch (feat/reviewer-csharp) → create files → node -c hooks/*.js → PR

See CONTRIBUTING.md for templates and quality requirements.

❓ FAQ

What frameworks does AuraKit support?

Any framework. Scout reads package.json, tsconfig, tailwind.config, prisma.schema, Dockerfile, go.mod, pyproject.toml, and more to adapt automatically. Next.js, React, Vue, Svelte, Express, FastAPI, Django, Spring — all work out of the box.

Does AuraKit work with existing projects?

Yes. AuraKit scans your existing codebase first, then generates code that matches your existing conventions, styling, and architecture.

What happens if I already have hooks configured?

install.sh merges AuraKit hooks into your existing settings.json without overwriting. Your current hooks stay intact.

Does AuraKit work on Windows?

Yes, no WSL required. All hooks run as Node.js scripts (cross-platform). Git Bash is recommended for running Claude Code itself.

How does compact defense work?

AuraKit sets CLAUDE_AUTOCOMPACT_PCT_OVERRIDE=65, triggering compaction at 65% token usage instead of the default 95%. A PreCompact hook saves your current work state to disk. A PostCompact hook restores it after. Zero context loss.

Is my code sent anywhere?

No. AuraKit is a local skill. Everything runs inside your Claude Code session. No external APIs, no telemetry, no data collection.

How is AuraKit different from just prompting Claude?

Manual prompting requires you to re-explain your project, conventions, and requirements every session. AuraKit pre-loads all of that automatically, enforces it through hooks, and uses specialized agents for each role — without you doing anything extra after the initial install.

npx @smorky85/aurakit