# Setupbay > Setupbay (https://setupbay.com) is a small library of cross-agent "loadouts": bundles of AGENTS.md/CLAUDE.md rules, Cursor rules, Agent Skills (SKILL.md) and MCP configs for one job each, aimed at vibe coders and indie game devs. Every file is plain text and served raw. Two separate signals: "verified install" (Level 1) means automated checks passed on the files themselves (they parse, install to each agent's documented paths, MCP config is valid, safety scan is clean, references resolve, and a starter project builds where a free fixture exists); no AI agent is run for it. Agent test status is shown per agent; "untested" means no AI agent has been run against the loadout yet. Supported agents: Claude Code (`claude-code`), Codex CLI (`codex`), Cursor (`cursor`), Gemini CLI (`gemini-cli`), Antigravity CLI (`antigravity-cli`), GitHub Copilot (`copilot`). How to use this site as an agent: - Best: connect to the MCP server at https://setupbay.com/mcp (Streamable HTTP, read-only, no auth). Tools: `search_loadouts(query?, agent?, tags?[], category?, verified_only?, has?, limit? (1–20))`, `get_loadout(id)`, `get_loadout_file(id, path)`, `get_install_instructions(id, agent)`, `list_agents()`, `list_tags()`. - Or search over HTTP: `GET https://setupbay.com/api/v1/search?q=&agent=&tags=&verified=true&limit=10` returns ranked results with URLs for the page, JSON, raw files and zips. - Pick a loadout below, then fetch its JSON (`/api/loadouts/.json`). Each file lists `install_to` per agent id: the path relative to the project root where it belongs. `null` means that agent does not use the file. - Fetch file contents from `raw_url` (immutable per version) or the `/raw//latest/` alias. - Do not overwrite an existing AGENTS.md or CLAUDE.md without asking the user; merge instead. - MCP configs may need the user's own values (e.g. a project ref) and a manual step for some agents; the JSON says which. ## Loadouts - [Claude Code hooks guard rails](https://setupbay.com/api/loadouts/claude-code-hooks-guardrails.json): Fail-closed PreToolUse, post-edit and Stop hooks that block force-pushes, .env reads and wild deletes, check each edit and run tests before done. Stacks: bash, jq. Verified install: yes (2026-10-19). Agent tests: untested. - [Discord bot (TypeScript)](https://setupbay.com/api/loadouts/discord-bot-ts.json): discord.js v14 rules and an add-a-slash-command skill for building a Discord bot that registers commands properly and never leaks its token. Stacks: discord, nodejs, typescript. Verified install: yes (2026-10-19). Agent tests: untested. - [Godot 4 game jam](https://setupbay.com/api/loadouts/godot-4-game-jam.json): GDScript conventions, jam-scope discipline and a ship-to-itch.io skill so your agent helps you finish a Godot 4 game in 48 hours. Stacks: godot, gdscript. Verified install: yes (2026-10-19). Agent tests: untested. - [MCP server (TypeScript)](https://setupbay.com/api/loadouts/mcp-server-typescript.json): Rules and an add-a-tool skill for building a Model Context Protocol server in TypeScript that agents can actually use well — clear tools, safe inputs, no stdout noise. Stacks: mcp, typescript, nodejs. Verified install: yes (2026-10-19). Agent tests: untested. - [Next.js + Supabase SaaS](https://setupbay.com/api/loadouts/nextjs-supabase-saas.json): Rules, an RLS audit skill and a read-only Supabase MCP config for vibe-coding a Next.js App Router SaaS without leaking your database. Stacks: nextjs, react, typescript, supabase, postgres. Verified install: yes (2026-10-19). Agent tests: untested. - [Secure before you ship](https://setupbay.com/api/loadouts/secure-before-you-ship.json): A launch-check skill and always-on security rules that catch leaked keys, open databases and missing auth before your vibe-coded app goes live. Stacks: any, javascript, typescript, python. Verified install: yes (2026-10-19). Agent tests: untested. - [Vibe-coding guard rails](https://setupbay.com/api/loadouts/vibe-coding-guardrails.json): A stack-agnostic working style for coding agents — plan first, small diffs, never delete tests to go green — plus handoff notes and up-to-date docs via MCP. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [AI code review rules](https://setupbay.com/api/loadouts/ai-code-review-rules.json): Review-only rule files for Claude Code Review, Cursor Bugbot and Copilot, built from one list: severity, a nit cap, what to skip and what to always check. Stacks: github. Verified install: yes (2026-10-19). Agent tests: untested. - [Astro static site](https://setupbay.com/api/loadouts/astro-static-site.json): Astro conventions for fast, zero-JS-by-default sites with content collections, plus a skill for deploying to Cloudflare Pages with headers and redirects. Stacks: astro, typescript, cloudflare. Verified install: yes (2026-10-19). Agent tests: untested. - [Author plugins for Claude Code and Antigravity](https://setupbay.com/api/loadouts/agent-plugin-authoring.json): Build one plugin for Claude Code and Antigravity from a single source tree, pin its MCP servers, and pass claude plugin validate --strict before anyone installs. Stacks: mcp, nodejs. Verified install: yes (2026-10-19). Agent tests: untested. - [Browser-verified UI changes](https://setupbay.com/api/loadouts/browser-verified-ui.json): Make the agent load every UI change in a real browser via Playwright MCP, exercise it, fail on console or network errors and attach screenshots at two widths. Stacks: playwright. Verified install: yes (2026-10-19). Agent tests: untested. - [Chrome extension (Manifest V3)](https://setupbay.com/api/loadouts/chrome-extension-mv3.json): Manifest V3 rules for service workers, messaging and minimal permissions, plus a skill that gets your extension through Chrome Web Store review. Stacks: chrome, javascript, typescript. Verified install: yes (2026-10-19). Agent tests: untested. - [Cloudflare Workers rules](https://setupbay.com/api/loadouts/cloudflare-workers.json): Workers rules for agents: bindings from env, wrangler types, prepared D1 queries, waitUntil, secrets via wrangler secret, no deploys or --remote writes unasked. Stacks: cloudflare, cloudflare-workers, typescript. Verified install: yes (2026-10-19). Agent tests: untested. - [Cursor rules that load](https://setupbay.com/api/loadouts/cursor-rules-that-load.json): How to decide between AGENTS.md, Cursor .mdc rules, skills and hooks, write front matter that loads, and check that a rule is really attached. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [Discord bot in Python (discord.py 2)](https://setupbay.com/api/loadouts/discord-bot-python.json): discord.py 2 rules for agents: slash commands in cogs, range-limited options, 3-second responses, manual syncing, default intents and offline tests of the payload. Stacks: python, discord, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [Django app rules](https://setupbay.com/api/loadouts/django-app.json): Django rules and a safe-migration skill: migrations checked in CI, two-step destructive changes, N+1 caught with query-count tests, settings from the environment. Stacks: python, django, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [Django REST Framework API rules](https://setupbay.com/api/loadouts/django-rest-api.json): DRF rules for agents: explicit serializer fields, querysets scoped to the user, owner set on the server, pagination, and six tests for every endpoint. Stacks: python, django, uv. Verified install: yes (2026-10-19). Agent tests: untested. - [Electron desktop app rules](https://setupbay.com/api/loadouts/electron-app.json): Electron rules for agents: sandboxed renderers, narrow contextBridge APIs, sender-checked IPC, deny-by-default windows, CSP and fuses, with a static security check. Stacks: electron, desktop, typescript, nodejs. Verified install: yes (2026-10-19). Agent tests: untested. - [Electron end-to-end tests with Playwright](https://setupbay.com/api/loadouts/electron-playwright-e2e.json): Playwright tests that drive the real Electron app: secure webPreferences, no Node in the renderer, IPC round trips, input validation and blocked navigation. Stacks: electron, playwright, javascript, desktop, github-actions. Verified install: yes (2026-10-19). Agent tests: untested. - [Evals from real failures](https://setupbay.com/api/loadouts/evals-from-real-failures.json): Build LLM and agent evals the practitioner way: read real traces first, tally failure categories, then turn each into code-checked regression cases. Stacks: python, pytest, uv. Verified install: yes (2026-10-19). Agent tests: untested. - [Expo and React Native with Expo MCP](https://setupbay.com/api/loadouts/expo-react-native.json): Expo rules for agents plus Expo's official MCP server: npx expo install, Expo Router, no secrets in EXPO_PUBLIC_, no production EAS releases, check on a simulator. Stacks: react-native, expo, typescript, ios, android. Verified install: yes (2026-10-19). Agent tests: untested. - [Expo EAS Update without shipping native changes over the air](https://setupbay.com/api/loadouts/expo-eas-update.json): Checks whether an Expo change can ship as an EAS Update or needs a new build, using the native fingerprint; preview by CI, production rollouts by a person. Stacks: expo, react-native, typescript, github-actions. Verified install: yes (2026-10-19). Agent tests: untested. - [FastAPI service rules](https://setupbay.com/api/loadouts/fastapi-service.json): Rules and an endpoint skill for FastAPI with uv and Pydantic v2: Annotated dependencies, typed responses, async only when awaited, lifespan, tested routes. Stacks: python, fastapi, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [FastAPI with async SQLAlchemy 2.1 and Alembic](https://setupbay.com/api/loadouts/fastapi-async-sqlalchemy.json): FastAPI on async SQLAlchemy 2.1: per-request AsyncSession, lazy="raise" with eager loads, async Alembic with alembic check, and tests that count queries. Stacks: python, fastapi, sqlalchemy, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [GitHub Actions hardening for agent workflows](https://setupbay.com/api/loadouts/github-actions-hardening.json): Rules and a zizmor skill for agents editing GitHub Actions: SHA-pinned actions, permissions: {}, no template injection, no pull_request_target, read-only agent jobs. Stacks: github-actions, github. Verified install: yes (2026-10-19). Agent tests: untested. - [Go service rules](https://setupbay.com/api/loadouts/go-service.json): Go rules for agents: wrapped errors with errors.Is, context first, owned goroutines, 1.22+ routing, timeouts, and gofmt, vet and go test -race as the gate. Stacks: go. Verified install: yes (2026-10-19). Agent tests: untested. - [Godot and Blender through MCP](https://setupbay.com/api/loadouts/godot-blender-mcp.json): Drive Godot 4 and Blender from one agent: Godot MCP to run the game and read errors, MCP for Blender in safe mode to model assets, and a glTF pipeline between them. Stacks: godot, gdscript, blender. Verified install: yes (2026-10-19). Agent tests: untested. - [Guarded Ralph loop](https://setupbay.com/api/loadouts/ralph-loop-guarded.json): Run an agent in a Ralph-style loop with guard rails: a fresh process per pass, state in files, iteration and no-progress limits, and a check it cannot fake. Stacks: any, bash, git. Verified install: yes (2026-10-19). Agent tests: untested. - [Handoff without compaction](https://setupbay.com/api/loadouts/agent-handoff.json): Write HANDOFF.md before you clear context or switch agents: goal, decisions, exact failing test, next step, commit. A checker flags stale or incomplete handoffs. Stacks: any, git. Verified install: yes (2026-10-19). Agent tests: untested. - [Headless agents in CI](https://setupbay.com/api/loadouts/headless-agents-ci.json): Rules and a GitHub Actions template for unattended claude -p or codex exec: bare mode, read-only, a spend cap, pinned versions, PR text as untrusted data. Stacks: github, github-actions. Verified install: yes (2026-10-19). Agent tests: untested. - [iOS builds with MobileBuildMCP (XcodeBuildMCP)](https://setupbay.com/api/loadouts/ios-mobilebuildmcp.json): Let the agent build, test, run and screenshot iOS and macOS apps through MobileBuildMCP, pinned with telemetry off, with Swift concurrency and pbxproj rules. Stacks: swift, ios, xcode. Verified install: yes (2026-10-19). Agent tests: untested. - [Jupyter notebooks agents can edit](https://setupbay.com/api/loadouts/jupyter-notebooks.json): Notebook rules for agents: edit Jupytext-paired .py files instead of JSON, run top to bottom in a fresh kernel, keep outputs out of git with nbstripout, check data first. Stacks: python, jupyter, uv. Verified install: yes (2026-10-19). Agent tests: untested. - [Markdown docs with markdownlint and offline link checks](https://setupbay.com/api/loadouts/docs-markdown-checks.json): Agent-written READMEs and docs checked offline: markdownlint-cli2, relative links and #anchors resolve, and every npm run command in the docs exists. Stacks: markdown, nodejs. Verified install: yes (2026-10-19). Agent tests: untested. - [MCP server in Go (official go-sdk)](https://setupbay.com/api/loadouts/mcp-server-go.json): Build MCP servers in Go with the official go-sdk: typed tools with jsonschema tags, tool errors not panics, stdout kept for the protocol, in-memory client tests. Stacks: go, mcp. Verified install: yes (2026-10-19). Agent tests: untested. - [MCP server in Python (official SDK v2)](https://setupbay.com/api/loadouts/mcp-server-python.json): Build MCP servers on the official Python SDK v2: MCPServer, Annotated schemas, structured output, ToolError for fixable failures and in-memory Client tests. Stacks: python, mcp, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [Migrate an MCP server to protocol 2026-07-28](https://setupbay.com/api/loadouts/mcp-2026-07-28-migration.json): Move an MCP server to the stateless 2026-07-28 revision on the official SDKs: no sessions or handshake, server/discover, input_required, then a raw stdio probe. Stacks: mcp, typescript, nodejs, python. Verified install: yes (2026-10-19). Agent tests: untested. - [One AGENTS.md for every agent](https://setupbay.com/api/loadouts/one-agents-md-every-agent.json): Keep one AGENTS.md as the source of truth, with thin imports and a single MCP list, so Claude Code, Codex, Cursor, Copilot and Antigravity CLI all load the same rules. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [One spend cap across Claude Code, Codex and Antigravity](https://setupbay.com/api/loadouts/agent-spend-cap.json): Run headless Claude Code, Codex and Antigravity CLI through one guard: a shared daily cap, per-run budgets, a ledger, and the provider limits that stop spend. Stacks: python, bash. Verified install: yes (2026-10-19). Agent tests: untested. - [OpenTofu modules gated by tofu test and Checkov](https://setupbay.com/api/loadouts/opentofu-module-checkov.json): Agents write OpenTofu modules that pass a local gate: fmt, a read-only lock file, tofu test with a mocked AWS provider, and Checkov with reasoned skips only. Stacks: opentofu, terraform, aws, bash. Verified install: yes (2026-10-19). Agent tests: untested. - [Parallel agents in git worktrees](https://setupbay.com/api/loadouts/parallel-agents-worktrees.json): Rules and two skills for running several coding agents at once, one task per git worktree: isolation, ports, dependencies, rebasing and clean-up. Stacks: git. Verified install: yes (2026-10-19). Agent tests: untested. - [Phaser 4 web game](https://setupbay.com/api/loadouts/phaser-web-game.json): Phaser 4 rules that send the agent to the skills Phaser ships in node_modules, not v3 tutorials: pooled objects, delta movement, play-tested changes. Stacks: phaser, typescript, vite. Verified install: yes (2026-10-19). Agent tests: untested. - [Playwright end-to-end tests agents don't make flaky](https://setupbay.com/api/loadouts/playwright-e2e-tests.json): Rules for agents writing and healing Playwright tests, including Playwright's test agents: role locators, web-first assertions, no sleeps, never weaken a test to pass. Stacks: playwright, typescript. Verified install: yes (2026-10-19). Agent tests: untested. - [PR hygiene for agents](https://setupbay.com/api/loadouts/pr-hygiene-for-agents.json): Commit and PR rules for coding agents: small PRs, a four-part body, screenshots with gh --attach and a leak check for session links and secrets before pushing. Stacks: git, github. Verified install: yes (2026-10-19). Agent tests: untested. - [Python data script](https://setupbay.com/api/loadouts/python-data-script.json): Rules for reproducible, single-file Python data scripts with uv and inline dependencies, plus a skill that sanity-checks a dataset before anyone trusts the numbers. Stacks: python, uv, polars, pandas. Verified install: yes (2026-10-19). Agent tests: untested. - [Rails app rules](https://setupbay.com/api/loadouts/rails-app.json): Rails 8 rules for agents: reversible migrations with real constraints, params.expect, N+1 checks with assert_queries_count, and rubocop and brakeman as the gate. Stacks: ruby, rails. Verified install: yes (2026-10-19). Agent tests: untested. - [Rails request specs with RSpec and FactoryBot](https://setupbay.com/api/loadouts/rails-rspec.json): RSpec request specs for Rails 8.1 JSON endpoints: happy path, 422 errors, missing params, owner scoping and mass assignment, with FactoryBot and rubocop-rspec. Stacks: ruby, rails, rspec. Verified install: yes (2026-10-19). Agent tests: untested. - [Roblox Luau (Rojo)](https://setupbay.com/api/loadouts/roblox-luau.json): Luau conventions for Rojo projects with a server-authoritative mindset, plus a skill that reviews every RemoteEvent for exploits before you publish. Stacks: roblox, luau, rojo. Verified install: yes (2026-10-19). Agent tests: untested. - [Rust crate rules](https://setupbay.com/api/loadouts/rust-crate.json): Rust rules for agents: typed errors instead of unwrap, clippy -D warnings, fmt and tests as the done-gate, no unsafe without a SAFETY note, no surprise MSRV bumps. Stacks: rust, cargo. Verified install: yes (2026-10-19). Agent tests: untested. - [Second-opinion review from another model](https://setupbay.com/api/loadouts/second-opinion-review.json): Before calling work done, the agent gets a read-only review of its diff from a different model, checks each finding and stops after two rounds. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [Spec first, then tickets](https://setupbay.com/api/loadouts/spec-first-tickets.json): Lightweight spec-driven flow: a SPEC.md with testable acceptance criteria, small tickets, test-first builds in parallel waves and a review against the spec. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [Subagent model routing](https://setupbay.com/api/loadouts/subagent-model-routing.json): Rules for when to delegate, which model and effort each subagent gets, and a brief template, with ready subagents for Claude Code and Codex. Stacks: any. Verified install: yes (2026-10-19). Agent tests: untested. - [Supabase with a safe agent](https://setupbay.com/api/loadouts/supabase-agent-safety.json): Supabase MCP scoped to one dev project, read-only, database and docs tools only; every change as a reviewed migration with RLS, policy and expand-contract rules. Stacks: supabase, postgres. Verified install: yes (2026-10-19). Agent tests: untested. - [SwiftUI with a Swift package core tested by swift test in CI](https://setupbay.com/api/loadouts/swiftui-swift-test-ci.json): SwiftUI screens as thin views over @Observable view models in a Swift package, tested with Swift Testing by swift test on Linux and macOS CI. Stacks: swift, swiftui, ios, github-actions. Verified install: yes (2026-10-19). Agent tests: untested. - [Tauri 2 desktop app, least privilege](https://setupbay.com/api/loadouts/tauri-desktop-app.json): Tauri 2 rules and a permissions skill: capabilities for named windows, scoped fs and http, no shell execute, a CSP kept, plus a checker that flags wide grants. Stacks: tauri, rust, typescript, desktop. Verified install: yes (2026-10-19). Agent tests: untested. - [Telegram bot with python-telegram-bot](https://setupbay.com/api/loadouts/telegram-bot-python.json): Rules and a command skill for Telegram bots on python-telegram-bot v22: token from the environment, async-safe handlers, testable logic, escaped output, webhook secrets. Stacks: python, telegram, uv, pytest. Verified install: yes (2026-10-19). Agent tests: untested. - [Terraform, plan only](https://setupbay.com/api/loadouts/terraform-plan-only.json): Let agents write Terraform and produce plans but never apply: a guard hook for apply, destroy and state changes, a plan summary that flags deletes, pinned providers. Stacks: terraform, opentofu, bash, jq. Verified install: yes (2026-10-19). Agent tests: untested. - [Unity 6 with the official agent plugin](https://setupbay.com/api/loadouts/unity-agent-plugin.json): Project rules for using Unity's official agent plugin safely in Claude Code or Codex: commit first, Editor-driven scene edits, .meta discipline, compile and test checks. Stacks: unity, csharp. Verified install: yes (2026-10-19). Agent tests: untested. - [Unity C# game jam](https://setupbay.com/api/loadouts/unity-game-jam.json): Unity C# conventions that respect the editor, .meta files and serialisation, plus a skill for scripted web builds ready for itch.io. Stacks: unity, csharp. Verified install: yes (2026-10-19). Agent tests: untested. - [Vet skills, plugins and MCP servers before install](https://setupbay.com/api/loadouts/agent-extension-vetting.json): Treat agent skills, plugins and MCP servers as dependencies: pin by SHA or exact version, prove HEAD matches the pin, scan every file, and get a human yes. Stacks: any, mcp, git. Verified install: yes (2026-10-19). Agent tests: untested. - [Writing rules that avoid AI-sounding prose](https://setupbay.com/api/loadouts/no-ai-voice-writing.json): Rules and a linter that stop agents writing 'seamlessly empowers', 'not just X, it's Y', fake proof and em-dash runs into your docs, PRs and release notes. Stacks: any, markdown. Verified install: yes (2026-10-19). Agent tests: untested. ## Current practice (trends, updated 2026-10-17) Dated notes on how developers configure coding agents right now, each with sources. Full text: [Trends](https://setupbay.com/trends/); JSON: [/api/trends.json](https://setupbay.com/api/trends.json). - 2026-10-16: **Review is the bottleneck, so review gets configured.** Put review-only rules in review files, cap nits, get a read-only second opinion on risky diffs, and keep PRs small. Sources: https://code.claude.com/docs/en/code-review-customize, https://cursor.com/docs/bugbot, https://github.com/cli/cli/releases/tag/v2.99.0, https://x.com/Damir_Akaza/status/2106333764548702392. - 2026-10-16: **Spend caps move from goodwill to flags and ledgers.** Cap every headless run with the agent's own flag where one exists, and keep a shared daily ledger across agents for the ones that only report tokens. Sources: https://www.404media.co/accenture-tells-employees-they-can-now-spend-only-29-on-claude-per-month/, https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md, https://x.com/dhillonpost/status/2106644976494854234, https://x.com/ekcheungAI/status/2111524159755010507. - 2026-10-15: **Expo SDK 58 ships a CLI built for coding agents.** Make the native boundary explicit to the agent, with a development build for new native modules and a fingerprint check before any EAS Update. Sources: https://expo.dev/changelog/sdk-58, https://x.com/kadikraman/status/2111140629640048700. - 2026-10-15: **Parallel agents in worktrees are the default.** One task per worktree and branch, separate ports and dependencies, and clean up only after merge. Sources: https://code.claude.com/docs/en/worktrees, https://github.com/cli/cli/releases/tag/v2.99.0. - 2026-10-14: **Antigravity CLI ships weekly: a plugin marketplace, then Auto mode.** Pin what a plugin installs and read its skills and MCP config before enabling it; use Auto mode with the terminal sandbox on, not instead of it. Sources: https://github.com/google-antigravity/antigravity-cli/releases/tag/1.3.2, https://github.com/google-antigravity/antigravity-cli/releases/tag/1.3.5, https://github.com/google-antigravity/antigravity-cli/releases/tag/1.4.0. - 2026-10-14: **Teams write rules against AI-sounding prose.** Put plain-writing rules in AGENTS.md for every file the agent writes, and lint prose for the known patterns while skipping code and quotations. Sources: https://x.com/CDGalpha/status/2110292549210620174, https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing. - 2026-10-13: **Evals start from real traces, not metric lists.** Do error analysis on real traces first; turn each recurring failure into a regression case that links to its trace and is shown to fail on the old output. Sources: https://hamel.dev/blog/posts/evals-faq/, https://x.com/Benogju/status/2104930651573240043, https://x.com/pauliusztin_/status/2109986591959626178. - 2026-10-12: **MCP servers start moving to the stateless 2026-07-28 spec.** Serve both revisions during the migration, and probe the server with an opening server/discover, an unknown version and a multi-round-trip tool call before shipping. Sources: https://modelcontextprotocol.io/specification/2026-07-28/changelog, https://x.com/mohabbuilds/status/2107485248351064089, https://x.com/McpMetrics/status/2108302356836200562, https://x.com/duggalgg/status/2109359944931885099. - 2026-10-11: **Skills and plugins get vetted like dependencies.** Install skills, plugins and MCP servers only after a pinned, reviewed scan; prove the checkout matches the pinned SHA and keep auto-update off for third-party sources. Sources: https://x.com/SarahLakzit/status/2109274745585742114, https://x.com/TheDailyViber/status/2102389962897248684, https://github.com/NVIDIA/SkillSpector/releases/tag/v2.13.0, https://code.claude.com/docs/en/plugins/marketplace-reference. - 2026-10-10: **AGENTS.md is the shared contract; per-agent files stay thin.** Keep rules in AGENTS.md. Any CLAUDE.md or GEMINI.md should only import it (@AGENTS.md) plus genuine agent quirks. Sources: https://code.claude.com/docs/en/memory, https://x.com/torfinpd/status/2108876607431553167, https://x.com/mitsuhiko/status/2088900774466105797. - 2026-10-10: **Short always-on rules plus on-demand skills.** Keep AGENTS.md short; move procedures longer than about 15 lines into .agents/skills//SKILL.md. Sources: https://cursor.com/docs/skills, https://pnpm.io/agent-skills, https://github.com/Unity-Technologies/unity-agent-plugin. - 2026-10-09: **Agent loops go mainstream; the limits move outside the agent.** Give every loop a check it cannot edit, an iteration and no-progress cap, its own branch and a human who merges; use /goal for shorter jobs. Sources: https://code.claude.com/docs/en/goal, https://github.com/openai/codex/releases/tag/rust-v0.128.0, https://x.com/DRMacIver/status/2102456718915469473, https://x.com/mitchalderson/status/2108622371829518390. - 2026-10-08: **Hard rules move from prose into hooks and permissions.** Enforce must-never rules with hooks or deny rules, test each by attempting the forbidden action, and keep a sandbox for real isolation. Sources: https://code.claude.com/docs/en/hooks, https://x.com/paulhq/status/2100933039945912672, https://x.com/coldboothq/status/2106519666885619942. - 2026-10-08: **Supply chain and injection are first-class concerns.** Pin CLIs, plugins and MCP packages, run CI agents with --bare and least privilege, and treat PR, issue and page text as data. Sources: https://code.claude.com/docs/en/headless, https://developers.openai.com/codex/noninteractive, https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html. - 2026-10-07: **SwiftUI logic moves into Swift packages tested on Linux.** Put view models and logic in a Swift package with Swift Testing, run swift test on Linux CI, and build the views on macOS. Sources: https://x.com/GameManiaSPX/status/2107449164473029109, https://x.com/muratnakmuay/status/2107796854264025581, https://developer.apple.com/documentation/testing. - 2026-10-06: **Handoff files replace compaction between sessions.** Write HANDOFF.md before /clear, compaction or a switch of agent, record the commit it describes, and re-run its checks before trusting it. Sources: https://x.com/automater_ai/status/2107481727073395054, https://x.com/calloway_dev/status/2107099970562085278, https://x.com/agentjeanclaude/status/2104989005813260667, https://x.com/PublicAI_/status/2104179567510556875. - 2026-10-02: **Official MCP SDKs settle: Python v2 and Go v1.8.** Pin the SDK version, name the current API in the agent's rules, and test every tool through the SDK's own client. Sources: https://py.sdk.modelcontextprotocol.io/whats-new/, https://pypi.org/project/mcp/2.3.0/, https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0. - 2026-10-01: **Subagent model and effort are chosen per task, in writing.** Route mechanical work to small models at low effort, keep judgement work on the strongest model, and brief every subagent fully. Sources: https://code.claude.com/docs/en/sub-agents, https://developers.openai.com/codex/subagents, https://gist.github.com/chrisbanes/dc1407ddd22d6e8d6c4d374b564eac9a. - 2026-09-23: **Frameworks ship their own agent skills and MCP servers.** Point the agent at the framework's own skills or MCP server for the installed version instead of relying on model memory and old tutorials. Sources: https://github.com/phaserjs/phaser/tree/master/skills, https://expo.dev/changelog/the-expo-mcp-server-is-now-available-on-the-free-plan, https://github.com/getsentry/XcodeBuildMCP, https://x.com/KhalidDevLog/status/2096183096697586039. - 2026-06-18: **Gemini CLI gives way to Antigravity CLI.** Move workspace skills from .gemini/skills/ to .agents/skills/ and MCP servers into .agents/mcp_config.json. Sources: https://antigravity.google/docs/cli/gcli-migration/, https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/. ## By agent - [Claude Code](https://setupbay.com/agents/claude-code/): Ready-made CLAUDE.md rules, Agent Skills for .claude/skills and project MCP configs for Claude Code, each checked to install where Claude Code looks. - [Codex CLI](https://setupbay.com/agents/codex/): AGENTS.md rules and Agent Skills for OpenAI's Codex CLI, laid out where Codex reads them, with MCP servers explained for ~/.codex/config.toml. - [Cursor](https://setupbay.com/agents/cursor/): Cursor rules (.mdc), AGENTS.md instructions, Agent Skills and .cursor/mcp.json configs for Cursor, checked to install at the paths Cursor uses. - [Gemini CLI](https://setupbay.com/agents/gemini-cli/): GEMINI.md rules that import AGENTS.md, Agent Skills and MCP server settings for Google's Gemini CLI, with exact install paths for each loadout. - [Antigravity CLI](https://setupbay.com/agents/antigravity-cli/): AGENTS.md rules, Agent Skills for .agents/skills and generated .agents/mcp_config.json files for Google's Antigravity CLI (agy), checked against its docs. - [GitHub Copilot](https://setupbay.com/agents/copilot/): AGENTS.md instructions and Agent Skills for GitHub Copilot in VS Code and the Copilot CLI, plus MCP configs for .vscode/mcp.json. ## By stack - [Bash](https://setupbay.com/stacks/bash/): 5 loadouts. Loadouts built on Bash scripts: Claude Code guard hooks, a guarded agent loop, Terraform and OpenTofu gates, and a cross-agent spend cap. - [Cloudflare](https://setupbay.com/stacks/cloudflare/): 2 loadouts. Loadouts for Cloudflare: Workers with D1 and KV bindings and no unasked deploys, and Astro static sites deployed to Cloudflare. - [C#](https://setupbay.com/stacks/csharp/): 2 loadouts. Loadouts for C# in Unity: serialised private fields, cached components, Input System code and compile checks after every change. - [Desktop apps](https://setupbay.com/stacks/desktop/): 3 loadouts. Loadouts for desktop apps: Electron with sandboxed renderers, sender-checked IPC and Playwright end-to-end tests, and Tauri 2 capabilities. - [Discord](https://setupbay.com/stacks/discord/): 2 loadouts. Loadouts for Discord bots in TypeScript (discord.js v14) and Python (discord.py 2): slash commands, 3-second replies, minimal intents. - [Django](https://setupbay.com/stacks/django/): 2 loadouts. Loadouts for Django: checked migrations and query-count tests, plus Django REST Framework APIs scoped to the requesting user. - [Electron](https://setupbay.com/stacks/electron/): 2 loadouts. Loadouts for Electron: secure defaults with sender-checked IPC and fuses, and Playwright end-to-end tests of the real app under xvfb. - [Expo](https://setupbay.com/stacks/expo/): 2 loadouts. Loadouts for Expo: SDK-matched installs with Expo's MCP server, and EAS Update releases that never ship native changes over the air. - [FastAPI](https://setupbay.com/stacks/fastapi/): 2 loadouts. Loadouts for FastAPI: Annotated dependencies and typed responses with uv, plus async SQLAlchemy 2.1 resources with Alembic and N+1 guards. - [GDScript](https://setupbay.com/stacks/gdscript/): 2 loadouts. Loadouts for GDScript: typed Godot 4 code, signals over hard references, and running the game through MCP to catch errors. - [Git](https://setupbay.com/stacks/git/): 5 loadouts. Loadouts for Git workflows: parallel agents in worktrees, reviewable pull requests, handoff files tied to a commit and pinned extensions. - [GitHub](https://setupbay.com/stacks/github/): 4 loadouts. Loadouts for GitHub: pull requests agents open well, rules for AI reviewers, headless agents in Actions and hardened workflows. - [GitHub Actions](https://setupbay.com/stacks/github-actions/): 5 loadouts. Loadouts for GitHub Actions: SHA-pinned workflows checked by zizmor, headless agents in CI, and CI jobs for Swift, Expo and Electron. - [Go](https://setupbay.com/stacks/go/): 2 loadouts. Loadouts for Go: idiomatic services with wrapped errors and race-tested handlers, and MCP servers built on the official go-sdk. - [Godot](https://setupbay.com/stacks/godot/): 2 loadouts. Loadouts for Godot 4: typed GDScript and game jam scope rules, plus Godot and Blender driven through MCP with a glTF asset pipeline. - [iOS](https://setupbay.com/stacks/ios/): 3 loadouts. Loadouts for iOS: Swift apps through MobileBuildMCP, SwiftUI with a tested Swift package core, and Expo apps shipped with EAS Update. - [JavaScript](https://setupbay.com/stacks/javascript/): 3 loadouts. Loadouts for JavaScript: Manifest V3 Chrome extensions, a pre-launch security check, and Electron apps tested end to end with Playwright. - [jq](https://setupbay.com/stacks/jq/): 2 loadouts. Loadouts that use jq: Claude Code hooks that read tool calls as JSON, and a Terraform plan summary that fails on deletes and replaces. - [Markdown](https://setupbay.com/stacks/markdown/): 2 loadouts. Loadouts for Markdown: rules and a linter against AI-sounding prose, and offline checks that links, anchors and npm run commands are real. - [MCP](https://setupbay.com/stacks/mcp/): 6 loadouts. Loadouts for MCP: servers in TypeScript, Go and Python, the 2026-07-28 stateless migration, plugin authoring and vetting before install. - [Node.js](https://setupbay.com/stacks/nodejs/): 6 loadouts. Loadouts for Node.js: Discord bots, MCP servers and their 2026 migration, Electron apps, agent plugins and Markdown docs checks. - [OpenTofu](https://setupbay.com/stacks/opentofu/): 2 loadouts. Loadouts for OpenTofu: modules tested with tofu test and Checkov, state encryption, and a hook that keeps agents to plan only. - [Playwright](https://setupbay.com/stacks/playwright/): 3 loadouts. Loadouts for Playwright: stable end-to-end suites, browser checks through Playwright MCP, and tests that drive a real Electron app. - [Postgres](https://setupbay.com/stacks/postgres/): 2 loadouts. Loadouts for Postgres on Supabase: migrations instead of ad hoc SQL, row level security policies that perform, and a review checklist. - [pytest](https://setupbay.com/stacks/pytest/): 7 loadouts. Loadouts with pytest: FastAPI routes, Django query counts, bot logic, MCP tools through an in-memory client, and evals from real failures. - [Python](https://setupbay.com/stacks/python/): 13 loadouts. Loadouts for Python: FastAPI, Django and DRF services, Telegram and Discord bots, MCP servers, notebooks, data scripts and evals. - [Rails](https://setupbay.com/stacks/rails/): 2 loadouts. Loadouts for Rails 8: reversible migrations, params.expect and query-count checks, plus RSpec request specs that cover scoping and 422s. - [React Native](https://setupbay.com/stacks/react-native/): 2 loadouts. Loadouts for React Native through Expo: SDK-matched installs and Expo Router, plus EAS Update with native fingerprint checks. - [Ruby](https://setupbay.com/stacks/ruby/): 2 loadouts. Loadouts for Ruby on Rails 8: migrations, strong params and N+1 checks, and RSpec request specs with FactoryBot and rubocop-rspec. - [Rust](https://setupbay.com/stacks/rust/): 2 loadouts. Loadouts for Rust: typed errors, clippy -D warnings and tests as the gate, and Tauri 2 desktop apps with least-privilege capabilities. - [Supabase](https://setupbay.com/stacks/supabase/): 2 loadouts. Loadouts for Supabase: a read-only, project-scoped MCP server, row level security on every table, and changes only as reviewed migrations. - [Swift](https://setupbay.com/stacks/swift/): 2 loadouts. Loadouts for Swift: build and screenshot apps through MobileBuildMCP, and SwiftUI view models in a Swift package tested on Linux CI. - [Terraform](https://setupbay.com/stacks/terraform/): 2 loadouts. Loadouts for Terraform and OpenTofu: plan-only agents with a guard hook, and modules gated by tofu test with mocked providers and Checkov. - [TypeScript](https://setupbay.com/stacks/typescript/): 14 loadouts. Loadouts for TypeScript: Cloudflare Workers, Electron and Tauri apps, Expo, Phaser 4, Discord bots, MCP servers, Playwright tests and more. - [Unity](https://setupbay.com/stacks/unity/): 2 loadouts. Loadouts for Unity: game jam rules for Unity 6 and safe use of Unity's official agent plugin, with .meta and scene-editing discipline. - [uv](https://setupbay.com/stacks/uv/): 10 loadouts. Loadouts that use uv: FastAPI, Django and DRF, Telegram and Discord bots, MCP servers, notebooks, data scripts and evals, all pinned. - [All stacks](https://setupbay.com/stacks/): every tag ## Feeds and pages - [New and updated](https://setupbay.com/new/): newest loadouts and recent version changes - [Trends](https://setupbay.com/trends/): dated, sourced notes on current agent-config practice ([JSON](https://setupbay.com/api/trends.json)) - [Atom feed](https://setupbay.com/feed.xml) and [RSS feed](https://setupbay.com/rss.xml): new and updated loadouts - [Search](https://setupbay.com/search/): ranked search page (`/search/?q=&agent=&tags=`) - [Sitemap](https://setupbay.com/sitemap.xml) ## MCP - Claude Code (terminal): `claude mcp add --transport http setupbay https://setupbay.com/mcp` - Cursor (.cursor/mcp.json (project) or ~/.cursor/mcp.json): `{ "mcpServers": { "setupbay": { "url": "https://setupbay.com/mcp" } } }` - Codex (~/.codex/config.toml, or run: codex mcp add setupbay --url https://setupbay.com/mcp): `[mcp_servers.setupbay] url = "https://setupbay.com/mcp"` - Gemini CLI (.gemini/settings.json or ~/.gemini/settings.json, or run: gemini mcp add --transport http setupbay https://setupbay.com/mcp): `{ "mcpServers": { "setupbay": { "httpUrl": "https://setupbay.com/mcp" } } }` - Antigravity CLI (.agents/mcp_config.json (workspace) or ~/.gemini/config/mcp_config.json (global); remote servers use serverUrl, then check with /mcp): `{ "mcpServers": { "setupbay": { "serverUrl": "https://setupbay.com/mcp" } } }` - VS Code (GitHub Copilot) (.vscode/mcp.json): `{ "servers": { "setupbay": { "type": "http", "url": "https://setupbay.com/mcp" } } }` - [Server card](https://setupbay.com/mcp/server-card): MCP server card (draft server-card extension) ## API - [Search](https://setupbay.com/api/v1/search?q=nextjs): `GET /api/v1/search` with q, agent, tags (or stack), category, verified, has (skills|mcp|rules), limit (1–50), offset. 60 requests/minute per IP - [Index](https://setupbay.com/api/index.json): every loadout with categories, stacks, compatibility, verification and agent test status. Each loadout JSON has `verification.checks` with every Level 1 check - [Listing schema](https://setupbay.com/api/schema.json): JSON Schema for listing.yaml - [Full catalogue as markdown](https://setupbay.com/llms-full.txt): every loadout with every file inlined ## Submit - [Submissions API](https://setupbay.com/docs/#submit): `POST https://setupbay.com/api/v1/submissions` with JSON (name, summary, category, stacks, agents, files [{path, content}] including AGENTS.md, licence, rights_confirmed: true). Agents authenticate with `Authorization: Bearer `; the browser form uses Turnstile instead. Submissions are stored as pending, pre-checked for credentials and risky shell, run through the Level 1 verifier before review, and listed as not agent-tested until an agent actually runs them. - [Submissions API summary](https://setupbay.com/api/v1/): fields and limits as JSON ## Optional - [About](https://setupbay.com/about/): who runs this, what "verified install" checks, and how agent testing will work - [Submit a loadout](https://setupbay.com/submit/): the submit form