Update (2026-11-09): the plugin is now called kit (it was kit-config), it is at version 1.10.0, the copy script copia-regole.bat has been replaced by skills, and the security rules are split into three files. The sections below reflect the current state of the repository.

Introduction

When I started using Claude Code on my .NET and Angular projects, I kept giving the same instructions again and again: ask one question at a time, do not commit without asking, do not use MediatR, do not run git init in a folder that is not a repository, write a plan before writing code. Instructions in a chat disappear with the session, so I moved them into files.

claude-config is the result: a template of rules for Claude Code, plus a personal plugin (kit) that turns the most important rules into hooks that block or remind. The rules are written in Italian. Code, identifiers and commit messages that come from them stay in English.

What is in the repository

  • .claude/rules/: the rule modules. You copy them into each project, and Claude Code loads them on its own.
  • .claude/rules-optional/: modules that are not loaded until you move them into rules/ (feature workflow, email, infrastructure).
  • CLAUDE.md: a template with the project fields to fill in (architecture, database, ORM, multi-tenancy, ASVS level, and so on). Each choice is asked once and recorded, never assumed.
  • _template/: the project start guide and the CI helper for kit-allow exceptions.
  • plugins/kit/: the plugin with hooks, skills and tests.
  • CHANGELOG.md: a dated log of every change to the rules, with the reason, the files and the verification.

Rules that do most of the work

The rules are split by when they apply.

Always loaded at start:

  • core.md: the shared rules. One question at a time, when in doubt. The frontend/backend contract (ProblemDetails, translation keys instead of text, UTC dates). The stack, tests (xUnit, Vitest, Playwright, 80% coverage on new code), documentation, and the delivery checklist.
  • git.md: git flow with develop mandatory. Local commits only with confirmation. Conventional Commits in English. Squash for PRs into develop, merge commits for anything that touches main.
  • security.md: the security principles. Fail closed, supply chain, threat model for sensitive features, the operational checks.

Loaded when you touch matching files (paths: in the header):

  • frontend.md and security-frontend.md (*.ts, *.html, *.css, *.scss): Angular, PrimeNG, no legacy NgModule, no any, CSP and frontend security.
  • backend.md, backend-architecture.md, backend-app.md, security-backend.md (*.cs, *.csproj, *.props): .NET 10, EF Core, the choice between vertical slice and clean architecture, authentication and authorization, uploads, rate limiting, log events.
  • docker.md (Dockerfile, compose files, docker/**): multi-stage builds, one compose file per environment, no database inside compose.

Every project imports only what it needs. A Git-only project keeps just core.md and git.md.

Some rules I care about most

  • One question at a time. When a decision is not clear, Claude asks one question, waits, and only then continues. This is the first rule in core.md, and the plugin enforces it.
  • Plan before code. For any non-trivial work, Claude writes PIANO.md in the project root with the steps and their status boxes. A step is ticked only after build and tests pass. The plan is deleted when it is finished, and the history stays in the changelog.
  • Checks the plugin cannot make. Some rules need a human review, such as the row-level security and passkey details in security-backend.md. Those are marked "verify at first use" instead of being stated as fact.

The plugin: kit

kit adds hooks that enforce the rules during a session:

  • Question limit: AskUserQuestion accepts one question per call.
  • Command guard: blocks git init, git push --force, deleting remote branches, git reset --hard, git clean -f, --no-verify, and rm -rf. Pushes and tags are always allowed. gh pr create/merge and gh release are allowed only when the project declares the GitHub CLI installed in its CLAUDE.md. Read-only commands (git status, git log, gh pr view) are always allowed.
  • Write guard: blocks real secrets in appsettings*.json, compose files and written files, and unsafe patterns.
  • Write check: after a write, checks the plan (build and test results recorded before a step is ticked), code quality, and C# practice.
  • Session start and close: reminds the one-question rule on each prompt, reports rules that changed since the last session, and reminds about the open plan at the end.

The hooks are configured in plugins/kit/hooks/hooks.json and run through four event scripts for the most part. Each check has a test under plugins/kit/tests/.

Sixteen commands run only when you ask for them:

/kit:buongiorno, /kit:buonasera, /kit:avvia-progetto, /kit:copia-regole, /kit:aggiorna-regole, /kit:consegna, /kit:review-regole, /kit:aggiorna-docs, /kit:verifica, /kit:qualita-test, /kit:dati-efcore, /kit:accessi-api, /kit:gdpr-dati, /kit:accessibilita-ui, /kit:colori-tema, /kit:localizzazione

Install it once per machine:

claude plugin marketplace add AngeloDotNet/claude-config claude plugin install kit@claude-config

If you installed the earlier kit-config name, install kit, remove kit-config, and restart Claude Code: hooks load at session start.

Using it in a project

There are three cases.

  1. New project. Copy the rules and the CLAUDE.md template, fill in the fields, then ask Claude to start the project (/kit:avvia-progetto). It asks the setup questions and records the answers in CLAUDE.md.
  2. Existing project without rules. Use /kit:copia-regole. It copies the rules you choose, one file at a time. If the project only needs branch and commit rules, choose Git only: you get core.md and git.md, and nothing else.
  3. Existing project with rules. Use /kit:aggiorna-regole to bring it to the latest template, with a confirmation for each file.

Architecture, ORM, database, multi-tenancy and ASVS level are never assumed: Claude asks, and the answer goes into CLAUDE.md.

Caveats

  • The hooks read the code line by line. A public member written across several lines, or with complex attributes, can slip past them. The review of the code is still needed.
  • Row-level security on PostgreSQL and passkey support in ASP.NET Core Identity are written in the rules as things to check at first use. They are not verified yet against the .NET 10 release.
  • The changelog marks which details are not checked against a source. Read the notes before relying on a rule.

Links