coding-agent-rollout — Claude Code plugin: audits and setup
This plugin audits Claude Code settings, MCP and plugin inventories, and CLAUDE.md layers. It also tracks a team’s rollout stage from local session counts.
/plugin marketplace add alirezarezvani/claude-skills
/plugin install coding-agent-rollout@claude-code-skillsWhat coding-agent-rollout does
The plugin reads settings across scopes and checks permissions, secrets, and risky commands. A separate inventory script compares MCP servers and plugins against an allowlist; another audit follows CLAUDE.md layers and @import references. These scripts are read-only, so they report findings without changing configuration files.
The adoption tracker produces counts from local sessions and labels the team stage PILOT, SPREADING, EMBEDDED, or STALLED. The package includes the cs-claude-code-rollout agent, /cs-claude-rollout and /cs-claude-settings-lint commands, three references, a baseline managed-settings policy, and a four-phase rollout plan. Session summaries omit prompt text, file contents, and tool inputs other than a skill name. That privacy boundary is built into the tracker.
What it helps with
- combine settings from multiple scopes for review
- flag risky permissions and credentials in configuration
- check MCP servers and plugins against an allowlist
- find broken imports and contradictions across
CLAUDE.mdlayers - classify team adoption using local session counts
Example prompts for the agent
- Run
/coding-agent-rollout:cs-claude-rollout .to audit this repository. - Use
/coding-agent-rollout:cs-claude-settings-lint . /etc/claude-code/managed-settings.jsonto check the project and managed settings. - Summarize the team’s rollout stage from local session counts.
How to install coding-agent-rollout
Plugin marketplace
/plugin marketplace add alirezarezvani/claude-skills/plugin install coding-agent-rollout@claude-code-skillsStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about coding-agent-rollout
How do I install coding-agent-rollout in Claude Code?
Run these commands in order: /plugin marketplace add alirezarezvani/claude-skills, then /plugin install coding-agent-rollout@claude-code-skills.
What does coding-agent-rollout do?
It audits Claude Code settings and permissions, checks MCP servers and plugins, and reviews CLAUDE.md layers. It also summarizes team adoption using session counts.
What information does the adoption tracker include?
It produces counts from local sessions without including prompt text, file contents, or tool inputs other than a skill name.
Source text
coding-agent-rollout · MIT
# coding-agent-rollout > One engineer's Claude Code setup is a preference. A team's is a policy. Settings merge from five scopes, `permissions.allow` arrays combine across files, and deny beats ask beats allow wherever it is written. Nobody can read the effective policy from one file, so nobody notices when a permissive user file undoes a careful shared one, or when an unpinned MCP server changes overnight. This plugin makes the policy readable and then checks it. ## Install ```bash /plugin marketplace add alirezarezvani/claude-skills /plugin install coding-agent-rollout ``` ## Use ```bash /cs-claude-rollout . # full audit of this repo /cs-claude-settings-lint . /etc/claude-code/managed-settings.json ``` Or run the scripts directly. Each has `--help`, `--sample` and `--output json`: | Script | Phase | What it checks | Exit codes | |---|---|---|---| | `settings_linter.py` | Guardrails | Blanket and destructive allows, dead rules, secrets in `env`, committed local settings, MCP auto-approval, network hooks, managed bypass switch | 0 · 2 · 3 · **4** | | `mcp_plugin_inventory.py` | Inventory | Every MCP server, plugin and marketplace; allowlist, pinning, plain-http remotes, committed secrets | 0 · 2 · 3 · **4** | | `claude_md_layering_audit.py` | Instructions | Resident vs on-demand layers, @imports (4-hop limit), duplicates, contradictions, secrets, size | 0 · 2 · 3 · **4** | | `adoption_tracker.py` | Adoption | Counts-only member summaries from local transcripts; team stage PILOT / SPREADING / EMBEDDED / STALLED | 0 · **2 stalled** · 3 | ## Design decisions - **Verified, not remembered.** Every settings key, scope, path and limit was checked against the official Claude Code docs. Settings ship fast, so unknown keys are INFO, not errors. - **Read-only.** No script edits a settings file. They report; you decide. - **Privacy first for adoption.** The tracker never emits prompt text, file content, or tool inputs other than a skill name. Teams share the JSON summary, never transcripts. - **Baseline policy included.** `assets/managed-settings.example.json` lints clean and is a sane day-one policy. ## Distinct from - `claude-coach` — coaches one person. - `skill-doctor` — improves installed skills from session evidence. - `security-guidance` — a hook that warns on risky code as it is written. ## License MIT
© Alireza Rezvani · MIT · alirezarezvani/claude-skills
