claude-code-ultimate-guide

# claude-code-ultimate-guide > Skill by [ara.so](https://ara.so) — Claude Code Skills collection. Expert guidance for the Claude Code Ultimate Guide — a 24K+ line comprehensive resource covering Claude Code from beginner to power user, including architecture deep-dives, agentic workflows, security hardening (28 CVEs tracked), methodology guides (TDD/SDD/BDD), 271-question quiz, and 181 production-ready templates. ## What This Guide Provides **Educational depth + practical templates:** - **Mental models**: How Claude Code works internally (architecture, context flow, tool orchestration) - **Decision frameworks**: When to use agents vs skills vs commands (trade-off analysis) - **Security-first**: Only guide with threat database (28 CVEs + 655 malicious skills) - **Methodology workflows**: TDD/SDD/BDD comparison + step-by-step implementation - **48 Mermaid diagrams**: Visual architecture, patterns, security flows - **271-question quiz**: Validate understanding across 7 modules - **181 templates**: Production-ready examples in TypeScript, Python, Rust, Go, etc. ## Installation & Access ### Option 1: MCP Server (Recommended — No Cloning) Add to `~/.claude.json`: ```json { "mcpServers": { "claude-code-guide": { "type": "stdio", "command": "npx", "args": ["-y", "claude-code-ultimate-guide-mcp"] } } } ``` **Usage:** ```bash # Search the guide claude "Use claude-code-guide to search for 'security threats'" # Get specific section claude "Use claude-code-guide to read the TDD methodology section" # Get cheatsheet claude "Use claude-code-guide to show me the cheatsheet" # List examples by topic claude "Use claude-code-guide to list all rust examples" ``` ### Option 2: Clone Repository ```bash git clone https://github.com/FlorianBruniaux/claude-code-ultimate-guide.git cd claude-code-ultimate-guide # Browse structure ls -la guide/ # 24K+ lines of documentation ls -la examples/ # 181 production templates ls -la quiz/ # 271 questions across 7 modules ``` ### Option 3: Interactive Onboarding (No Setup) ```bash claude "Fetch and follow the onboarding instructions from: https://raw.githubusercontent.com/FlorianBruniaux/claude-code-ultimate-guide/main/tools/onboarding-prompt.md" ``` ## Key MCP Server Tools When using the MCP server, you have access to 17 tools: ```typescript // Search across all guide content search_guide({ query: "agentic workflows", maxResults: 5 }) // Read specific sections read_section({ section: "guide/methodologies/tdd-with-ai.md" }) // Get quick reference get_cheatsheet() // Find templates search_examples({ query: "typescript react", language: "typescript" }) // Get specific example get_example({ path: "examples/typescript/react-tdd.md" }) // Security threat lookup get_threat({ cveId: "CVE-2024-1234" }) list_threats({ category: "prompt-injection" }) // Compare versions compare_versions({ from: "3.39.0", to: "3.40.0" }) ``` **13 slash commands also available:** ```bash /ccguide:search security /ccguide:read guide/security/security-hardening.md /ccguide:cheatsheet /ccguide:examples typescript /ccguide:quiz beginner ``` ## Repository Structure ``` claude-code-ultimate-guide/ ├── guide/ # 24K+ lines documentation │ ├── ultimate-guide.md # Main comprehensive guide │ ├── cheatsheet.md # 1-page daily essentials │ ├── architecture/ # Internal workings │ ├── methodologies/ # TDD/SDD/BDD workflows │ ├── security/ # Threat modeling, CVEs │ ├── diagrams/ # 48 Mermaid visualizations │ └── learning-path/ # 7-module progression ├── examples/ # 181 production templates │ ├── typescript/ │ ├── python/ │ ├── rust/ │ ├── go/ │ └── workflows/ ├── quiz/ # 271 questions │ ├── beginner/ │ ├── intermediate/ │ └── advanced/ ├── tools/ # Utilities │ ├── onboarding-prompt.md │ └── self-assessment.md └── mcp-server/ # MCP implementation ``` ## Core Concepts & Workflows ### 1. Architecture Mental Models **Claude Code's Master Loop:** ```mermaid graph LR A[User Request] --> B[Context Assembly] B --> C[Tool Selection] C --> D[Model Invocation] D --> E[Tool Execution] E --> F{More Tools?} F -->|Yes| C F -->|No| G[Response] style A fill:#3498db style G fill:#2ecc71 ``` **Key insight**: Claude Code orchestrates tools in a loop. Understanding this helps you design effective prompts and know when to split complex tasks. ### 2. Agent vs Skill vs Command Decision Framework ```typescript // AGENT — Long-running, multi-step, adaptive // Example: Refactor entire codebase following TDD { role: "tdd-refactor-agent", goal: "Refactor auth module with 100% test coverage", constraints: ["Red-Green-Refactor cycle", "No breaking changes"] } // SKILL — Domain expertise, reusable across sessions // Example: "Apply TDD workflow to new feature" { name: "tdd-workflow", triggers: ["write tests first", "tdd this feature"], knowledge: "guide/methodologies/tdd-with-ai.md" } // COMMAND — Single execution, explicit tool call // Example: "Run tests and show coverage" /test --coverage ``` **Decision tree:** - **Multi-step adaptive?** → Agent - **Reusable expertise?** → Skill - **One-shot execution?** → Command ### 3. TDD Workflow with Claude Code ```bash # 1. Start with failing test (RED) claude "Write a failing test for user registration validation" # 2. Minimal implementation (GREEN) claude "Implement just enough code to make the test pass" # 3. Refactor (REFACTOR) claude "Refactor the validation logic while keeping tests green" # 4. Repeat claude "Next test: email uniqueness constraint" ``` **Full workflow:** See `guide/methodologies/tdd-with-ai.md` ### 4. Security Threat Awareness **28 CVEs tracked in database:** ```bash # Check for prompt injection vulnerabilities claude "Use claude-code-guide to get threat info for CVE-2024-5184" # List all model-confusion attacks claude "Use claude-code-guide to list threats in category 'model-confusion'" ``` **Common threats:** - **Prompt Injection**: User input manipulating agent behavior - **Tool Misuse**: Agents accessing unauthorized resources - **Context Leakage**: Sensitive data in prompts/logs - **Supply Chain**: Malicious skills (655 tracked) **See:** `guide/security/security-hardening.md` ## Real-World Examples ### Example 1: TDD React Component (TypeScript) ```typescript // examples/typescript/react-tdd-component.md // Step 1: Write test first import { render, screen, fireEvent } from '@testing-library/react'; import { LoginForm } from './LoginForm'; describe('LoginForm', () => { it('validates email format before submission', () => { render(<LoginForm onSubmit={jest.fn()} />); const input = screen.getByLabelText('Email'); const submit = screen.getByRole('button', { name: 'Login' }); fireEvent.change(input, { target: { value: 'invalid-email' } }); fireEvent.click(submit); expect(screen.getByText('Invalid email format')).toBeInTheDocument(); }); }); // Step 2: Minimal implementation export const LoginForm: React.FC<Props> = ({ onSubmit }) => { const [email, setEmail] = useState(''); const [error, setError] = useState(''); const handleSubmit = (e: React.FormEvent) => { e.preventDefault(); if (!/\S+@\S+\.\S+/.test(email)) { setError('Invalid email format'); return; } onSubmit({ email }); }; return ( <form onSubmit={handleSubmit}> <label htmlFor="email">Email</label> <input id="email" value={email} onChange={(e) => setEmail(e.target.value)} /> {error && <span>{error}</span>} <button type="submit">Login</button> </form> ); }; ``` **Prompt to Claude Code:** ```bash claude "Follow TDD workflow from the guide: 1. I'll describe a feature 2. You write the test first (RED) 3. Then minimal implementation (GREEN) 4. Then refactor suggestions (REFACTOR) Feature: Login form with email validation and password strength meter" ``` ### Example 2: Secure Agentic Workflow (Python) ```python # examples/python/secure-agent-workflow.py from typing import List, Dict import os class SecureAgentWorkflow: """ Demonstrates security best practices from guide/security/ - Input sanitization - Tool allowlisting - Audit logging """ def __init__(self, allowed_tools: List[str]): self.allowed_tools = set(allowed_tools) self.audit_log = [] def execute_task(self, user_input: str, context: Dict) -> str: # 1. Sanitize input (prevent prompt injection) sanitized = self._sanitize_input(user_input) # 2. Log for audit trail self._log_action("task_start", { "input": sanitized, "context_keys": list(context.keys()) }) # 3. Tool allowlist enforcement requested_tools = self._extract_tools(sanitized) if not requested_tools.issubset(self.allowed_tools): forbidden = requested_tools - self.allowed_tools raise PermissionError(f"Tools not allowed: {forbidden}") # 4. Execute with minimal permissions result = self._execute_with_restrictions(sanitized, context) # 5. Audit successful execution self._log_action("task_complete", {"result_length": len(result)}) return result def _sanitize_input(self, text: str) -> str: """Remove potential prompt injection patterns""" dangerous_patterns = [ "ignore previous instructions", "you are now", "system:", "assistant:" ] sanitized = text for pattern in dangerous_patterns: sanitized = sanitized.replace(pattern, "[REDACTED]") return sanitized def _log_action(self, action: str, metadata: Dict): """Audit trail for security review""" self.audit_log.append({ "action": action, "metadata": metadata, "timestamp": datetime.now().isoformat() }) # In production: send to SIEM print(f"[AUDIT] {action}: {metadata}") # Usage with Claude Code workflow = SecureAgentWorkflow( allowed_tools=["read_file", "write_file", "execute_command"] ) # This will succeed workflow.execute_task( "Read config.json and format as YAML", context={"cwd": "/safe/path"} ) # This will raise PermissionError workflow.execute_task( "Delete all files", # Requires forbidden tool context={} ) ``` **Prompt to Claude Code:** ```bash claude "Using the secure agent workflow pattern from the guide: 1. Review my agent code for security vulnerabilities 2. Apply input sanitization from guide/security/security-hardening.md 3. Add tool allowlisting 4. Implement audit logging 5. Show before/after diff" ``` ### Example 3: Multi-Agent SDD Pattern (Rust) ```rust // examples/rust/multi-agent-sdd.rs // Spec-Driven Development with multiple specialized agents // Pattern from guide/methodologies/sdd-with-ai.md /// Agent 1: Spec Writer /// Generates formal specifications from requirements pub struct SpecAgent; impl SpecAgent { pub fn generate_spec(requirements: &str) -> ApiSpec { // Claude Code prompt: // "Write OpenAPI 3.0 spec for: {requirements}" ApiSpec { version: "3.0.0".into(), endpoints: vec![ Endpoint { path: "/users".into(), method: Method::POST, request: Schema::object(vec![ ("email", Schema::string_format("email")), ("password", Schema::string_min_length(8)) ]), response: Schema::object(vec![ ("id", Schema::uuid()), ("created_at", Schema::datetime()) ]) } ] } } } /// Agent 2: Test Generator /// Creates contract tests from spec pub struct TestAgent; impl TestAgent { pub fn generate_tests(spec: &ApiSpec) -> Vec<Test> { // Claude Code prompt: // "Generate contract tests for spec: {spec.to_json()}" spec.endpoints.iter().map(|endpoint| { Test {