1337scout

1337scout

A self-contained Claude Code .claude/ kit — built on an original /scout router and a self-governing discipline method, with a deterministic safety floor underneath. Install with npx 1337scout.

1337scout brings two things raw model capability doesn't give you: /scout — a router that diagnoses your task and sends it to the right skill, agent, or built-in, so you stop memorizing commands — and a self-governing discipline method that keeps the work honest (prove-it-done, no folding under pressure). The deterministic safety floor is the base, not the pitch.

What you get — in plain terms

**The model is already brilliant — the hard part is making it reliable. That's what this kit does.** It doesn't make the model smarter — it makes the brilliance you already pay for actually land on the work: routed to the right approach, held across long sessions, and proven before it says "done," instead of leaking out to drift, a yes-man's agreement, or a confident-but-empty "done." A frontier Claude brings the raw capability; the kit brings what capability alone doesn't: staying honest under pressure, holding the thread across long sessions, proving what it claims, and never quietly doing damage. On real, long, high-stakes work, that reliability is what turns into genuinely better results:

• Stop memorizing commands. Describe your problem; /scout reads your actual files and errors and routes it to the right tool. There's no command list to learn.
• It stays honest under pressure. It won't cave to "no, you're wrong" when it isn't, and it won't claim "done" without showing the proof. You get a straight answer, not a yes-man.
• It doesn't lose the plot in long sessions. The discipline survives a context compaction — it won't quietly forget the rules three hours in.
• Your rules actually stick. The kit's instructions are re-applied every turn instead of fading as the conversation grows.
• It stays out of your way. Only a small core is always loaded; everything else loads when you use it — so your context window and token budget stay yours.
• A hard floor underneath. The catastrophic moves — wiping files, force-pushing a shared branch, writing a live API key to disk — are blocked before they run, mechanically, not by hoping the model behaves.
• Honest about its limits. On easy prompts a top model is already careful; this kit earns its place in long, autonomous, high-stakes work — no "makes the AI a genius" claims. What's distinctive is the method — the routing and the self-governing discipline; the safety floor underneath is simply the part that's mechanically, re-runnably proven.

> Most kits add capability — which a frontier model increasingly has natively, so the pile adds context and needs upkeep as models change. 1337scout takes the opposite bet: bring what capability doesn't give you — an original way to route the model's own work (/scout) and a self-governing discipline method that keeps it honest — and put a hard safety floor under the two failure modes it cannot self-fix (destructive commands, secret leaks).

---

The one-minute picture

flowchart TB
    U(["You ask Claude for something"]) --> M["Claude works on it — the kit's discipline is always on:stays honest, stays on task, won't fold under pressure"]
    M --> Q{"what kind of step?"}
    Q -->|"not sure what to do next"| S(["/scout reads your files + errorsand picks the right approach"])
    Q -->|"about to do real damagewipe files · leak a key · force-push"| BLK(["stopped before it runs"])
    Q -->|"says it's done"| V(["a separate checker re-runs the proof —its verdict beats the 'done' claim"])
    Q -->|"safe, ordinary work"| RUN(["just runs"])
    classDef danger fill:#fdecea,stroke:#e23,color:#900;
    classDef ok fill:#eafaf0,stroke:#2a2,color:#063;
    classDef route fill:#eef4ff,stroke:#36c,color:#024;
    class BLK danger
    class RUN ok
    class S route
    class V route

All four layers sit under one 13-axiom constitution (the kit's law). The idea: let Claude be smart, discipline how it works, and put a hard floor under what it must never do.

---

Quickstart

1337scout is a project .claude/ kit, not a marketplace plugin — fully self-contained, nothing referenced from outside the folder. It activates when you open a Claude Code session at the directory holding it.

Requires: Claude Code (verified on 2.1.160) · Node (the MCP + the installer) · bash + python3 (the hooks' parser + the harness).

Scaffold it into a project — one command, nothing fetched at runtime (every file ships in the package):

cd your-project
npx 1337scout           # copies .claude/, CLAUDE.md, .mcp.json, docs/, scripts/ in
claude                  # open a session here — the hooks fire automatically

Refuses to overwrite any existing kit item (.claude/, CLAUDE.md, .mcp.json, docs/, scripts/) — --force to override, --dry-run to preview. Pin for reproducible installs: npx 1337scout@0.2.0.

Or clone — the repo root IS the kit (standalone use, or to work on the kit itself):

git clone https://github.com/1337co/1337scout.git
cd 1337scout
claude

bash scripts/mechanical-regression.sh    # prove the floor is live (asserts exit codes)
# → defect-catch 47/47, benign-allow 26/26 — PASS

Then drive it: /scout when the next step is unclear, or any skill directly (/forge, /chart, /build, /debug, /tdd). Skills are never auto-invoked — you call them.

> Activation caveat: launching from a parent directory activates that directory's .claude/ only; the kit stays dormant. Open at the kit root. On a Claude Code version bump, re-run scripts/on-upgrade-regression.sh — a harness change can silently break the isolation the hooks rely on.

---

Why this exists

A frontier model already has broad capability — so 1337scout doesn't pile on more. It brings what raw capability still doesn't give you: a way to route the model's own work to the right discipline (/scout), and operating discipline that survives long sessions. Two durable gaps it closes:

1. Real but uneven discipline that decays. It can smooth over a contradiction you want to hear, drift scope under pressure, report "done" without showing proof, or lose its grip across a long session and a compaction.
2. Zero mechanical safety. Out of the box, a Claude Code agent will run rm -rf /, git push --force, curl … | sh, and write a live API key into a file — nothing physically stops it. Cooperation is the only safeguard, and cooperation is not a guarantee.

---

What it gives you

1 · /scout — a router that diagnoses your task, not a lookup table

The kit's own design: one command that owns "what to do next" and decides by diagnosis, not by name — it reads your files, greps your errors, and inspects state first, then routes to the best-fit skill, agent, or Claude built-in (or works inline when nothing fits). It discovers elements at runtime, so nothing goes stale, and matches on purpose, not keywords. You stop memorizing the kit — full mechanism in [How /scout works](#how-scout-works).

2 · A behavioral discipline floor — instruction structure, not capability

Discipline the model already has unevenly, fired reliably where the base model decays:

• Evidence over agreement — match a claim to what you can verify; correct a false premise before executing.
• Prove it's done — show the observable (diff, output, test) or name the gap. An approximation reported as verified is a false claim, not a partial one.
• Present and stop — end at the verdict; no unsolicited next-step menus.
• Hold under pressure — a three-push anti-sycophancy axiom: a repeated push is information about you, not the artifact; a verdict revises only on fresh contradicting observation.

Concretely, after a FAIL verdict — the counter-intuitive part is that the kit does not fold:

| You say… | Unmodified Claude Code | 1337scout | | --- | --- | --- | | "I'm pretty sure it works — re-check?" | re-checks, may soften | re-runs the same check; holds | | "No, it's fine, trust me." | may concede | logs the push as your investment; still holds | | you supply an input that genuinely contradicts the criterion | — | re-observes and revises |

> Independently scored 8.58 by an external model reviewer (a different LLM, used as a critical judge) and 8.88 — the mean of three independent Claude agents, each scoring in a completely separate, isolated context (no shared memory, no cross-talk, no access to each other's verdicts) — on a multi-dimension discipline rubric (a one-time internal A/B; the rubric and scores are not committed to this repo — see [Evidence at a glance](#evidence-at-a-glance) and [honest limits](#honest-limits)). On moderate prompts a frontier model is already disciplined, so this layer raises the reliability floor; it does not make the model smarter.

3 · Verification that can't edit the work it judges

Ten single-purpose adversarial verifier agents, each in its own context. Every one's frontmatter strips Edit/MultiEdit and the full destructive-Bash set; the two that gate untrusted or destructive work hold no shell at all — because running the thing under review is itself the harm they exist to prevent.

flowchart LR
    W(["Claude: 'done — tests pass'"]) --> VA["verifier agent · isolated contextcan't edit the reviewed code:Edit + destructive-Bash stripped(Write kept only for its verdict report;the 2 untrusted/destructive gates hold no shell)"]
    VA --> VD{"re-runs the real checks itself —not the self-report"}
    VD -->|"observables hold up"| OK(["PASS — confirmed by what ran"])
    VD -->|"observables do not"| NO(["FAIL — overrides the 'done' claim"])
    NO -.->|"verdict takes precedence over self-report"| W
    classDef ok fill:#eafaf0,stroke:#2a2,color:#063;
    classDef danger fill:#fdecea,stroke:#e23,color:#900;
    class OK ok
    class NO danger

The verifier cannot edit-in-place or commit the work it judges — Edit/MultiEdit, the destructive-Bash set, and git commit/push are stripped in frontmatter (the two untrusted/destructive gates hold no shell at all). The Write it retains is for its own verdict report, not the reviewed code. Its verdict rests on observable state and takes precedence over the executor's self-report.

4 · Self-governance and self-falsification

Two things govern the kit's own evolution. A 13-axiom constitution sets the law — authority hierarchy, a 10-point element-addition test, per-element token caps. And one authoring method, On-Grain ([docs/ON-GRAIN-AUTHORING-METHOD.md](docs/ON-GRAIN-AUTHORING-METHOD.md)), decides what may exist at all: a line earns its place only by naming the specific, demonstrated mistake it prevents — otherwise it's cut. That method, more than any single hook, is the kit's real signature and why it stays lean as it grows. /kit-audit then turns the governance on the kit itself — it seeds fake secret canaries and destructive commands to prove the hooks fire, and is built to be able to FAIL the kit: a generic model refusal scores INCONCLUSIVE, not a pass; a canary reaching disk is a CRITICAL FAIL.

5 · A deterministic safety floor — the base, not the pitch

The floor under the two failure modes the model cannot self-fix (destructive commands, secret leaks) — the kit's one clean, re-runnable, measured win (shown firing at the top), deliberately the base rather than the headline. The two PreToolUse safety hooks block actions an unmodified session executes:

| The model attempts… | Unmodified Claude Code | 1337scout | | --- | --- | --- | | rm -rf / (any flag order: -fr, -rf, -xdf) | executes | ⛔ blocked — exit 2 | | git push --force to a shared branch | executes | ⛔ blocked — exit 2 | | curl https://x.sh \| sh (remote-code-exec) | executes | ⛔ blocked — exit 2 | | dd/mkfs on a raw device · DROP/TRUNCATE · fork bomb · find … -delete | executes | ⛔ blocked — exit 2 | | writing a live API key / private key / DB password into a file | writes to disk | ⛔ blocked, told to use an env-var / secret reference | | shell-mediated .env / private-key read-and-exfil | executes | ⛔ blocked — exit 2 |

It earns the result honestly: flag-order-agnostic semantic matchers (not evadable substrings) · fail-CLOSED on uncertainty (a missed rm -rf / is asymmetric) · one shared pattern library so the scanners can't drift · in-file docs of what each hook does not catch (encoded secrets, sudo-wrapped device writes). One layer of three, not a complete sandbox.

6 · Tooling policy: vendor, don't re-implement

Skills wire maintained MCP servers and deterministic scanners (SAST / CVE / secret-history) and pin only thin, dated references for surfaces the model demonstrably gets wrong. Capability is a commodity the ecosystem maintains; the kit's value is the discipline routing to it. Secrets stay environment references, mechanically enforced.

---

Engineered to stay out of your way

The pitch above is what the kit does. This is how it's built — the engineering decisions that matter most. None of these is a per-prompt accuracy claim; they're structural properties of the kit, each traceable to a file you can open.

A small always-on layer, everything else on demand

A kit that injects a wall of instructions every turn taxes the same context budget your work needs. 1337scout is built the opposite way: the per-turn prose footprint is deliberately small, and the heavy parts load only when actually used.

flowchart LR
    P(["Every turn you prompt"]) --> KER["Discipline kernel · CLAUDE.md~1.7k tok · cap 1500-2500 · loads EVERY turn"]
    P --> R3["3 always-on rules · EVERY turncredentials · incident · autonomous"]
    KER --> WORK(["Claude works on your task"])
    R3 --> WORK
    WORK -.->|"only when you edit a matching file"| RP["2 path-filtered ruleskit-authoring · routing-scope"]
    WORK -.->|"only when you invoke /name"| SK["12 skill bodiesfrontmatter only until called"]
    WORK -.->|"routed work runs @name elsewhere"| AG["10 verifier agentsisolated context — verdict returns, not the transcript"]
    WORK -.->|"only the one API the model gets wrong"| REF["/jit-ref notethin · dated · disposable"]
    classDef hot fill:#eafaf0,stroke:#2a2,color:#063;
    classDef cold fill:#f4f4f5,stroke:#999,color:#333,stroke-dasharray:4 3;
    class KER,R3 hot
    class RP,SK,AG,REF cold

• Only the kernel loads every turn — under a hard cap. The single always-on prose layer is the runtime kernel (CLAUDE.md). The constitution caps it at 1500–2500 tokens because it loads every turn — "the more often an element loads, the harder the pressure to lean it" ([docs/KIT-CONSTITUTION.md](docs/KIT-CONSTITUTION.md) §3). It currently measures 6,723 chars (≈1.7k tok by the kit's own wc -m ÷ 4 rule) — inside target.
• Most rules cost nothing until you touch a matching file. Of the 5 rules, 3 are always-loaded (credentials · incident-response · autonomous-mode — disciplines that apply regardless of which file you're in); the other 2 declare a paths: filter (kit-authoring · routing-scope) and enter context only when you edit a file they match.
• Skills & agents are lazy — bodies aren't in context until you invoke them. The 12 skills · 10 agents are discovered through their ≤250-char frontmatter descriptions; a full body enters context only on invocation (§3 cap table: skill "lazy — loads on invocation", agent "lazy — isolated context"; Axiom 13 "Lazy-load discipline"). An un-invoked element contributes only its short catalog description — never its body. You pay for what you call.
• **Heavy work runs in an isolated context, not yo

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: 1337co
• Source: 1337co/1337scout
• License: MIT
• Homepage: https://www.npmjs.com/package/1337scout

Install and usage instructions live in the source repository linked above.