# 1337scout > /scout — a Claude Code router that diagnoses your task and hands it to the right skill, agent, or built-in (no memorizing commands). Plus a self-governing discipline method (prove-it-done, hold-under-pressure) and a deterministic safety floor (24/24 caught, 0 FP). Engineered lean: a small always-on kernel, everything else on demand. MIT. - **Type:** MCP server - **Install:** `agentstack add mcp-1337co-1337scout` - **Verified:** Pending review - **Seller:** [1337co](https://agentstack.voostack.com/s/1337co) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [1337co](https://github.com/1337co) - **Source:** https://github.com/1337co/1337scout - **Website:** https://www.npmjs.com/package/1337scout ## Install ```sh agentstack add mcp-1337co-1337scout ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # 1337scout *A self-contained Claude Code `.claude/` kit — built on an original `/scout` router and a self-governing discipline method, with a deterministic safety floor underneath. Install with `npx 1337scout`.* **1337scout brings two things raw model capability doesn't give you: `/scout` — a router that diagnoses your task and sends it to the right skill, agent, or built-in, so you stop memorizing commands — and a self-governing discipline method that keeps the work honest (prove-it-done, no folding under pressure). The deterministic safety floor is the base, not the pitch.** ## What you get — in plain terms **The model is already brilliant — the hard part is making it *reliable*. That's what this kit does.** It doesn't make the model *smarter* — it makes the brilliance you already pay for actually **land** on the work: routed to the right approach, held across long sessions, and proven before it says "done," instead of leaking out to drift, a yes-man's agreement, or a confident-but-empty "done." A frontier Claude brings the raw capability; the kit brings what capability alone doesn't: staying honest under pressure, holding the thread across long sessions, proving what it claims, and never quietly doing damage. On real, long, high-stakes work, that reliability is what turns into genuinely better results: - **Stop memorizing commands.** Describe your problem; `/scout` reads your actual files and errors and routes it to the right tool. There's no command list to learn. - **It stays honest under pressure.** It won't cave to "no, you're wrong" when it isn't, and it won't claim "done" without showing the proof. You get a straight answer, not a yes-man. - **It doesn't lose the plot in long sessions.** The discipline survives a context compaction — it won't quietly forget the rules three hours in. - **Your rules actually stick.** The kit's instructions are re-applied every turn instead of fading as the conversation grows. - **It stays out of your way.** Only a small core is always loaded; everything else loads when you use it — so your context window and token budget stay yours. - **A hard floor underneath.** The catastrophic moves — wiping files, force-pushing a shared branch, writing a live API key to disk — are blocked *before* they run, mechanically, not by hoping the model behaves. - **Honest about its limits.** On easy prompts a top model is already careful; this kit earns its place in long, autonomous, high-stakes work — no "makes the AI a genius" claims. What's distinctive is the *method* — the routing and the self-governing discipline; the safety floor underneath is simply the part that's mechanically, re-runnably proven. > **Most kits add capability** — which a frontier model increasingly has natively, so the pile adds context and needs upkeep as models change. **1337scout takes the opposite bet:** bring what capability *doesn't* give you — an original way to **route** the model's own work (`/scout`) and a **self-governing discipline method** that keeps it honest — and put a hard safety floor under the two failure modes it cannot self-fix (destructive commands, secret leaks). --- ## The one-minute picture ```mermaid flowchart TB U(["You ask Claude for something"]) --> M["Claude works on it — the kit's discipline is always on:stays honest, stays on task, won't fold under pressure"] M --> Q{"what kind of step?"} Q -->|"not sure what to do next"| S(["/scout reads your files + errorsand picks the right approach"]) Q -->|"about to do real damagewipe files · leak a key · force-push"| BLK(["stopped before it runs"]) Q -->|"says it's done"| V(["a separate checker re-runs the proof —its verdict beats the 'done' claim"]) Q -->|"safe, ordinary work"| RUN(["just runs"]) classDef danger fill:#fdecea,stroke:#e23,color:#900; classDef ok fill:#eafaf0,stroke:#2a2,color:#063; classDef route fill:#eef4ff,stroke:#36c,color:#024; class BLK danger class RUN ok class S route class V route ``` All four layers sit under one **13-axiom constitution** (the kit's law). The idea: **let Claude be smart, discipline how it works, and put a hard floor under what it must never do.** --- ## Quickstart 1337scout is a **project `.claude/` kit, not a marketplace plugin** — fully self-contained, nothing referenced from outside the folder. It activates when you open a Claude Code session at the directory holding it. **Requires:** Claude Code (verified on 2.1.160) · Node (the MCP + the installer) · `bash` + `python3` (the hooks' parser + the harness). **Scaffold it into a project** — one command, nothing fetched at runtime (every file ships in the package): ```bash cd your-project npx 1337scout # copies .claude/, CLAUDE.md, .mcp.json, docs/, scripts/ in claude # open a session here — the hooks fire automatically ``` Refuses to overwrite **any** existing kit item (`.claude/`, `CLAUDE.md`, `.mcp.json`, `docs/`, `scripts/`) — `--force` to override, `--dry-run` to preview. Pin for reproducible installs: `npx 1337scout@0.2.0`. **Or clone** — the repo root IS the kit (standalone use, or to work on the kit itself): ```bash git clone https://github.com/1337co/1337scout.git cd 1337scout claude ``` ```bash bash scripts/mechanical-regression.sh # prove the floor is live (asserts exit codes) # → defect-catch 47/47, benign-allow 26/26 — PASS ``` Then drive it: `/scout` when the next step is unclear, or any skill directly (`/forge`, `/chart`, `/build`, `/debug`, `/tdd`). Skills are never auto-invoked — you call them. > **Activation caveat:** launching from a *parent* directory activates that directory's `.claude/` only; the kit stays dormant. Open at the kit root. On a Claude Code version bump, re-run `scripts/on-upgrade-regression.sh` — a harness change can silently break the isolation the hooks rely on. --- ## Why this exists A frontier model already has broad capability — so 1337scout doesn't pile on more. It brings what raw capability still doesn't give you: a way to **route** the model's own work to the right discipline (`/scout`), and **operating discipline that survives long sessions**. Two durable gaps it closes: 1. **Real but uneven discipline that decays.** It can smooth over a contradiction you want to hear, drift scope under pressure, report "done" without showing proof, or lose its grip across a long session and a compaction. 2. **Zero mechanical safety.** Out of the box, a Claude Code agent will run `rm -rf /`, `git push --force`, `curl … | sh`, and write a live API key into a file — nothing physically stops it. Cooperation is the only safeguard, and cooperation is not a guarantee. --- ## What it gives you ### 1 · `/scout` — a router that diagnoses your task, not a lookup table The kit's own design: one command that owns "what to do next" and decides by **diagnosis, not by name** — it reads your files, greps your errors, and inspects state *first*, then routes to the best-fit skill, agent, or Claude built-in (or works inline when nothing fits). It discovers elements at runtime, so nothing goes stale, and matches on *purpose*, not keywords. **You stop memorizing the kit** — full mechanism in [How `/scout` works](#how-scout-works). ### 2 · A behavioral discipline floor — instruction structure, not capability Discipline the model already has *unevenly*, fired reliably where the base model decays: - **Evidence over agreement** — match a claim to what you can verify; correct a false premise before executing. - **Prove it's done** — show the observable (diff, output, test) or name the gap. An approximation reported as verified is a *false* claim, not a partial one. - **Present and stop** — end at the verdict; no unsolicited next-step menus. - **Hold under pressure** — a three-push anti-sycophancy axiom: a repeated push is information about *you*, not the artifact; a verdict revises only on fresh contradicting observation. Concretely, after a `FAIL` verdict — the counter-intuitive part is that the kit does *not* fold: | You say… | Unmodified Claude Code | 1337scout | | --- | --- | --- | | "I'm pretty sure it works — re-check?" | re-checks, may soften | re-runs the *same* check; **holds** | | "No, it's fine, trust me." | may concede | logs the push as your investment; **still holds** | | you supply an input that genuinely contradicts the criterion | — | re-observes and **revises** | > **Independently scored 8.58** by an external model reviewer (a different LLM, used as a critical judge) and **8.88** — the mean of **three independent Claude agents, each scoring in a completely separate, isolated context** (no shared memory, no cross-talk, no access to each other's verdicts) — on a multi-dimension discipline rubric *(a one-time internal A/B; the rubric and scores are not committed to this repo — see [Evidence at a glance](#evidence-at-a-glance) and [honest limits](#honest-limits))*. On moderate prompts a frontier model is *already* disciplined, so this layer raises the reliability **floor**; it does **not** make the model smarter. ### 3 · Verification that can't edit the work it judges Ten single-purpose adversarial verifier agents, each in its own context. Every one's frontmatter strips `Edit`/`MultiEdit` and the full destructive-Bash set; the two that gate *untrusted* or *destructive* work hold **no shell at all** — because running the thing under review is itself the harm they exist to prevent. ```mermaid flowchart LR W(["Claude: 'done — tests pass'"]) --> VA["verifier agent · isolated contextcan't edit the reviewed code:Edit + destructive-Bash stripped(Write kept only for its verdict report;the 2 untrusted/destructive gates hold no shell)"] VA --> VD{"re-runs the real checks itself —not the self-report"} VD -->|"observables hold up"| OK(["PASS — confirmed by what ran"]) VD -->|"observables do not"| NO(["FAIL — overrides the 'done' claim"]) NO -.->|"verdict takes precedence over self-report"| W classDef ok fill:#eafaf0,stroke:#2a2,color:#063; classDef danger fill:#fdecea,stroke:#e23,color:#900; class OK ok class NO danger ``` The verifier cannot edit-in-place or commit the work it judges — `Edit`/`MultiEdit`, the destructive-Bash set, and `git commit`/`push` are stripped in frontmatter (the two untrusted/destructive gates hold no shell at all). The `Write` it retains is for its own verdict report, not the reviewed code. Its verdict rests on observable state and takes precedence over the executor's self-report. ### 4 · Self-governance and self-falsification Two things govern the kit's own evolution. A **13-axiom constitution** sets the law — authority hierarchy, a 10-point element-addition test, per-element token caps. And one authoring method, **On-Grain** ([`docs/ON-GRAIN-AUTHORING-METHOD.md`](docs/ON-GRAIN-AUTHORING-METHOD.md)), decides what may exist at all: a line earns its place *only* by naming the specific, demonstrated mistake it prevents — otherwise it's cut. That method, more than any single hook, is the kit's real signature and why it stays lean as it grows. `/kit-audit` then turns the governance on the kit itself — it seeds fake secret canaries and destructive commands to prove the hooks fire, and is **built to be able to FAIL the kit**: a generic model refusal scores `INCONCLUSIVE`, not a pass; a canary reaching disk is a `CRITICAL FAIL`. ### 5 · A deterministic safety floor — the base, not the pitch The floor under the two failure modes the model cannot self-fix (destructive commands, secret leaks) — the kit's one clean, re-runnable, **measured** win (shown firing at the top), deliberately the base rather than the headline. The two `PreToolUse` safety hooks block actions an unmodified session executes: | The model attempts… | Unmodified Claude Code | 1337scout | | --- | --- | --- | | `rm -rf /` (any flag order: `-fr`, `-rf`, `-xdf`) | executes | ⛔ **blocked — exit 2** | | `git push --force` to a shared branch | executes | ⛔ **blocked — exit 2** | | `curl https://x.sh \| sh` (remote-code-exec) | executes | ⛔ **blocked — exit 2** | | `dd`/`mkfs` on a raw device · `DROP`/`TRUNCATE` · fork bomb · `find … -delete` | executes | ⛔ **blocked — exit 2** | | writing a live API key / private key / DB password into a file | writes to disk | ⛔ **blocked**, told to use an env-var / secret reference | | shell-mediated `.env` / private-key read-and-exfil | executes | ⛔ **blocked — exit 2** | It earns the result honestly: flag-order-agnostic semantic matchers (not evadable substrings) · **fail-CLOSED** on uncertainty (a missed `rm -rf /` is asymmetric) · one shared pattern library so the scanners can't drift · in-file docs of what each hook does *not* catch (encoded secrets, sudo-wrapped device writes). **One layer of three, not a complete sandbox.** ### 6 · Tooling policy: vendor, don't re-implement Skills wire *maintained* MCP servers and *deterministic* scanners (SAST / CVE / secret-history) and pin only thin, dated references for surfaces the model demonstrably gets wrong. Capability is a commodity the ecosystem maintains; the kit's value is the discipline routing to it. Secrets stay environment references, mechanically enforced. --- ## Engineered to stay out of your way The pitch above is *what* the kit does. This is *how it's built* — the engineering decisions that matter most. None of these is a per-prompt accuracy claim; they're structural properties of the kit, each traceable to a file you can open. ### A small always-on layer, everything else on demand A kit that injects a wall of instructions every turn taxes the same context budget your work needs. 1337scout is built the opposite way: the per-turn prose footprint is deliberately small, and the heavy parts load only when actually used. ```mermaid flowchart LR P(["Every turn you prompt"]) --> KER["Discipline kernel · CLAUDE.md~1.7k tok · cap 1500-2500 · loads EVERY turn"] P --> R3["3 always-on rules · EVERY turncredentials · incident · autonomous"] KER --> WORK(["Claude works on your task"]) R3 --> WORK WORK -.->|"only when you edit a matching file"| RP["2 path-filtered ruleskit-authoring · routing-scope"] WORK -.->|"only when you invoke /name"| SK["12 skill bodiesfrontmatter only until called"] WORK -.->|"routed work runs @name elsewhere"| AG["10 verifier agentsisolated context — verdict returns, not the transcript"] WORK -.->|"only the one API the model gets wrong"| REF["/jit-ref notethin · dated · disposable"] classDef hot fill:#eafaf0,stroke:#2a2,color:#063; classDef cold fill:#f4f4f5,stroke:#999,color:#333,stroke-dasharray:4 3; class KER,R3 hot class RP,SK,AG,REF cold ``` - **Only the kernel loads every turn — under a hard cap.** The single always-on prose layer is the runtime kernel (`CLAUDE.md`). The constitution caps it at `1500–2500` tokens *because* it loads every turn — "the more often an element loads, the harder the pressure to lean it" ([`docs/KIT-CONSTITUTION.md`](docs/KIT-CONSTITUTION.md) §3). It currently measures **6,723 chars (≈1.7k tok by the kit's own `wc -m ÷ 4` rule)** — inside target. - **Most rules cost nothing until you touch a matching file.** Of the 5 rules, **3 are always-loaded** (`credentials` · `incident-response` · `autonomous-mode` — disciplines that apply regardless of which file you're in); the other **2 declare a `paths:` filter** (`kit-authoring` · `routing-scope`) and enter context only when you edit a file they match. - **Skills & agents are lazy — bodies aren't in context until you invoke them.** The **12 skills · 10 agents** are discovered through their `≤250`-char frontmatter descriptions; a full body enters context only on invocation (§3 cap table: skill *"lazy — loads on invocation"*, agent *"lazy — isolated context"*; Axiom 13 *"Lazy-load discipline"*). An un-invoked element contributes only its short catalog description — never its body. You pay for what you call. - **Heavy work runs in an isolated context, not yo … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [1337co](https://github.com/1337co) - **Source:** [1337co/1337scout](https://github.com/1337co/1337scout) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/1337scout Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** yes - **Shell / process execution:** no - **Environment & secrets:** yes - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-1337co-1337scout - Seller: https://agentstack.voostack.com/s/1337co - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.