Forem: mibii

Claude Code + Notion: Full Workflow From Zero to Automated Knowledge System

mibii — Sun, 12 Apr 2026 00:40:42 +0000

Obsidian vs Notion: If you read the Obsidian version of this guide, here's the key difference upfront. Obsidian stores plain Markdown files — Claude Code reads them directly, zero setup. Notion stores everything in a proprietary database — you need MCP to bridge them. That adds 15 minutes of setup. The payoff is real-time sync and team collaboration that Obsidian can't match.

Why Connect Them at All

When you work in Claude Code, your Notion workspace is invisible. Every time you need context from a spec, a meeting note, or a project page — you're copying and pasting between tabs.

With Notion MCP connected, Claude Code can:

Search your entire workspace from the terminal
Pull a PRD or spec directly into a coding session
Create and update pages without leaving your terminal
Sync documents you drafted locally to Notion for team review
Query databases in plain English ("show me all open tasks due this week")

The workflow becomes: draft in Claude Code → push to Notion when you need collaboration → pull feedback back when you're ready to continue.

No copy-paste. No version confusion. The two stay in sync.

Part 1: Install Everything

Step 1 — Install Claude Code

# macOS
brew install --cask claude-code

# Windows
winget install Anthropic.ClaudeCode

# Linux
curl -fsSL https://claude.ai/install.sh | bash

# Verify
claude doctor
claude auth login

Requirements: Claude Pro ($20/mo) or Max subscription.

⚠️ npm install -g @anthropic-ai/claude-code is deprecated. Use the native installer.

Step 2 — Have a Notion Account

If you don't have one: notion.so. Free plan works for personal use. For team collaboration, you'll need Plus or higher.

Part 2: Connect Notion to Claude Code

Unlike Obsidian (plain files), Notion requires an authenticated connection through MCP. Two methods — pick one.

Method A — Official Plugin (Recommended, 5 minutes)

Notion built and maintains an official Claude Code plugin that installs everything in one command: MCP server + Skills + slash commands.

claude plugin add makenotion/claude-code-notion-plugin

Then authenticate:

claude
> /mcp

Claude will prompt you to complete an OAuth flow in your browser. Log in with your Notion account, authorize access, done.

Verify the connection:

> "List a random page title from my Notion workspace"

If it returns real content — you're connected.

Method B — Manual MCP Setup (More Control)

Add Notion's hosted MCP server directly:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Start a session and complete OAuth:

cd your-project
claude

Claude will detect the server and prompt for authentication on first Notion tool use.

Verify:

claude mcp list
# Should show: notion  https://mcp.notion.com/mcp  connected

Share with Your Team

Add to .mcp.json in your project root (commit this):

{
  "mcpServers": {
    "notion": {
      "url": "https://mcp.notion.com/mcp"
    }
  }
}

Each team member authenticates with their own Notion account. Claude respects individual permissions — it can only access what each person can access.

⚠️ Important: Notion MCP uses OAuth — it acts with your full Notion permissions. Claude can access everything you can access. Be intentional about what you ask it to do.

Part 3: What Notion MCP Can Actually Do

Once connected, Claude Code gets these tools:

Tool	What it does
`notion-search`	Full-text search across your workspace
`notion-fetch`	Read a specific page by URL or ID
`notion-create-pages`	Create new pages in any location
`notion-update-page`	Edit existing page content
`notion-query-database`	Query a Notion database with filters
`notion-add-comment`	Post comments on pages
`notion-list-users`	List workspace members

Notion's hosted MCP server converts everything to Markdown before sending to Claude — optimized for AI consumption, not the raw JSON block format from the original API. This matters: it's significantly more token-efficient.

Part 4: CLAUDE.md for Notion Workflows

Tell Claude about your Notion structure so it doesn't have to guess.

# Project Context

## Notion Workspace Structure
- **Engineering** — technical specs, ADRs, runbooks
  - Specs database: [your-database-url]
  - ADR database: [your-database-url]
- **Product** — PRDs, roadmap, research
  - PRD database: [your-database-url]
- **Meetings** — all meeting notes, searchable by date and project
- **Tasks** — sprint board and backlog

## Document Conventions
- PRDs have properties: Status (Draft/Review/Approved), Owner, Sprint
- ADRs follow format: Context → Decision → Consequences
- Meeting notes always include: Date, Attendees, Decisions, Action Items

## What Claude Can Do Here
- Search Notion for context before starting any implementation task
- Pull specs into coding sessions without me copy-pasting
- Create draft docs in Notion from local files when review is needed
- Update task status in the sprint board after completing work
- Query the meetings database to find decisions on any topic

## What Claude Should NOT Do
- Never delete Notion pages — archive them instead
- Don't update pages in the Product space without checking with me
- Always show me what it plans to create before creating it

Part 5: Core Workflows

Workflow 1 — Pull Context Before Coding

You're about to implement a feature. Instead of digging through Notion manually:

> "Find the spec for the authentication refactor and summarize what I need to implement"

Claude searches your workspace, finds the PRD, reads it, and gives you a focused summary. You can then say:

> "Now implement the JWT refresh token logic based on that spec"

Claude codes with full spec context — no copy-paste required.

Workflow 2 — Push Docs for Team Review

You drafted a technical spec locally in Markdown. Time to get team feedback.

Create .claude/commands/push-to-notion.md:

---
description: Push a local document to Notion for collaboration
allowed-tools: Bash, Glob, Read, mcp__notion__notion-create-pages,
  mcp__notion__notion-search, mcp__notion__notion-fetch,
  mcp__notion__notion-update-page, AskUserQuestion
---

# Push to Notion

Push a local document to Notion. Only syncs changes — won't overwrite
if already in sync.

## Process
1. Read the file at $ARGUMENTS
2. Search Notion for an existing page with the same title
3. If found: compare content, update only changed sections
4. If not found: create new page in the Engineering/Specs database
5. Return the Notion URL

Always ask before creating or updating anything.

Usage:

> /push-to-notion docs/auth-refactor-spec.md

Workflow 3 — Pull Feedback Back

After teammates have commented in Notion:

> "Fetch the auth refactor spec from Notion, show me all comments, and apply any approved changes to docs/auth-refactor-spec.md"

Claude reads the page, extracts comments, applies changes to your local file. Your local file stays as the source of truth; Notion is the collaboration layer.

Workflow 4 — Daily Standup Prep

> "Search Notion for all tasks assigned to me that are In Progress or Blocked. Also find any meeting notes from yesterday. Summarize what I worked on and what's blocking me."

30-second standup prep from your terminal.

Workflow 5 — Create Meeting Notes

During or after a meeting, dictate or type bullet points, then:

> "Create a meeting note in Notion for today's architecture review. Attendees: Alice, Bob, Carlos. Here are my notes: [paste bullets]. Format it properly with Decisions and Action Items sections."

Claude creates a properly formatted page in your Meetings database.

Workflow 6 — Query Your Database

> "Show me all PRDs with status Draft that haven't been updated in the last two weeks"
> "List all open action items from meetings where I'm the owner"
> "Find every ADR we've made about database architecture"

Natural language queries over your Notion databases — no Notion formula syntax required.

Workflow 7 — Generate Docs from Code

You just finished building a feature:

> "Read the code in src/auth/ and generate a technical runbook for this authentication system. Create it as a new page in the Engineering/Runbooks section of Notion."

Claude reads your code, writes structured documentation, pushes it to the right place in Notion.

Part 6: Notion vs Obsidian — Honest Comparison

Since many people use both, here's the direct comparison:

	Obsidian + Claude Code	Notion + Claude Code
Setup time	30 seconds (just `cd vault && claude`)	15–20 minutes (MCP + OAuth)
Works offline	Yes — plain files	No — requires API
Team collaboration	Needs Obsidian Sync or git	Native — built in
Claude access method	Direct file read/write	MCP tools (structured)
Token efficiency	High (plain text)	High (Notion converts to Markdown)
Database queries	No (just files)	Yes — powerful
Comments/review	No	Yes
Mobile	Via Obsidian app	Via Notion app
Best for	Personal knowledge, developers	Teams, mixed technical/non-technical

Rule of thumb: solo developer or researcher → Obsidian. Team workflows or non-technical collaborators → Notion.

Part 7: Troubleshooting

OAuth flow doesn't start

# Force re-authentication
claude mcp remove notion
claude mcp add --transport http notion https://mcp.notion.com/mcp
claude  # authenticate fresh

"Page not found" errors
Notion MCP can only access pages explicitly shared with the integration. If you used Method B (manual), go to the Notion page → Share → Invite your integration.

With Method A (official plugin), OAuth grants access to your entire workspace automatically.

MCP server not showing in tool list

claude mcp list     # verify it's registered
claude doctor       # check for environment issues

Headless / CI environments
OAuth requires a browser interaction — it won't work in fully automated pipelines. For CI, use the open-source server with a bearer token instead:

export NOTION_API_KEY=secret_xxxxx
claude mcp add --transport stdio notion-local \
  -- npx -y @notionhq/notion-mcp-server

Note: the open-source server is no longer actively maintained by Notion. Use for automation only, not as your primary connection.

Part 8: Common Mistakes

Not telling Claude your workspace structure.
Claude searches by keyword. If your database is called "Q1 2026 Initiatives" but you ask for "current projects", it might not find it. Put your key database names in CLAUDE.md.

Giving Claude too broad access.
Start with one database. Add more as you verify behavior. Claude acts with your full permissions — broad access means broad possible impact.

Using it as a search engine only.
The real value is the loop: pull context → code → push back. If you're only doing read operations, you're using 20% of the capability.

Forgetting to share pages (Method B).
With manual setup, Claude can only see pages shared with your integration. New pages need to be shared individually unless you grant workspace-wide access during setup.

Quick Start Summary

# 1. Install Claude Code
brew install --cask claude-code
claude auth login

# 2. Add Notion plugin (installs MCP + Skills + commands)
claude plugin add makenotion/claude-code-notion-plugin

# 3. Start a session and authenticate
claude
> /mcp   # complete OAuth in browser

# 4. Verify
> "List a random page from my Notion workspace"

# 5. Add workspace context to CLAUDE.md
> /init
# Edit CLAUDE.md to describe your Notion structure

# 6. First real workflow
> "Find my current sprint tasks and summarize what's in progress"

Total setup time: under 20 minutes.

The Core Difference from Obsidian

With Obsidian, Claude Code is in your vault — it reads and writes files directly.

With Notion, Claude Code talks to your workspace — through structured MCP tools that Notion designed specifically for AI agents.

Both work. The Notion approach adds a connection layer but gains real-time sync, team collaboration, and database queries that file-based systems can't match.

If your work involves other people — specs that need review, meeting notes shared with a team, tasks tracked in a shared database — the Notion setup is worth the extra 15 minutes.

Based on official Notion MCP documentation (developers.notion.com), github.com/makenotion/claude-code-notion-plugin, shinzo.ai, hannahstulberg.substack.com, and code.claude.com/docs/en/mcp. April 2026.

Claude Code + Obsidian: Build a Second Brain That Actually Thinks

mibii — Fri, 10 Apr 2026 08:35:53 +0000

Who this is for: Developers, researchers, or knowledge workers who take notes in Obsidian and want Claude Code to read, write, and act on their vault — not just answer questions about it.

Why This Combination Works

Claude Code has one fundamental problem: it forgets everything between sessions. Every time you start a new session, you're starting from scratch.

Obsidian has one fundamental advantage: everything is a plain Markdown file on your local disk. No API. No proprietary format. Just files.

Put them together and the problem disappears. Claude Code can read every note you've ever written, understand your thinking patterns, and pick up exactly where you left off — because your vault is its persistent memory.

Without Obsidian:    Session 1 ──X── Session 2 ──X── Session 3
                      (context lost)   (context lost)

With Obsidian vault: Session 1 ──→── Session 2 ──→── Session 3
                      (vault grows)    (vault grows)

The setup is surprisingly simple. Obsidian stores plain text. Claude Code reads plain text. No integration layer needed — just point Claude at your vault folder.

Part 1: Install Everything

Step 1 — Install Obsidian

Download from obsidian.md for your platform (macOS, Windows, Linux, iOS, Android). It's free.

On macOS via Homebrew:

brew install --cask obsidian

Create your vault:

mkdir ~/second-brain

Open Obsidian → "Open folder as vault" → select ~/second-brain.

Step 2 — Install Claude Code

# macOS
brew install --cask claude-code

# Windows
winget install Anthropic.ClaudeCode

# Linux
curl -fsSL https://claude.ai/install.sh | bash

# Verify
claude doctor
claude auth login

Requirements: Claude Pro ($20/mo) or Max subscription.

⚠️ npm install -g @anthropic-ai/claude-code is deprecated. Use the native installer.

Step 3 — Connect Them (30 seconds)

This is the whole "integration." Navigate to your vault in the terminal and run Claude Code:

cd ~/second-brain
claude

That's it. Claude Code now has full read/write access to every note in your vault. No plugins required. No API setup. No tokens to configure.

Run /init to generate a starter CLAUDE.md from your vault:

> /init

Claude will scan your folder structure, detect any existing patterns, and create a CLAUDE.md at the vault root. This file is loaded into every future session automatically.

Part 2: Vault Structure

Structure matters a lot here. Claude Code traverses directories, but deep nesting burns tokens on path resolution and leaves less room for actual note content. Flat is better.

Recommended Structure

~/second-brain/
├── CLAUDE.md                ← Claude's persistent context (auto-loaded)
├── .claude/
│   ├── settings.json        ← hooks config
│   └── skills/              ← vault automation skills
│       ├── daily/
│       │   └── SKILL.md
│       ├── research/
│       │   └── SKILL.md
│       └── weekly-review/
│           └── SKILL.md
├── daily/                   ← daily notes (YYYY-MM-DD.md)
│   └── 2026/
├── projects/                ← one folder per active project
│   ├── project-a/
│   └── project-b/
├── areas/                   ← ongoing responsibilities
├── resources/               ← reference material, clippings
├── _inbox/                  ← unprocessed capture
├── _attachments/            ← images, PDFs (Claude ignores these)
└── templates/               ← note templates

Naming conventions that help Claude:

Name files like sentences, not IDs. CAN-bus-traffic-without-DBC.md gives Claude usable context before reading a single line. untitled-48.md gives it nothing. Obsidian's backlink system and Claude's context signals both depend on the same thing: meaningful filenames.

Hide noise from Obsidian's file explorer:

In Obsidian → Settings → Files & Links → Excluded files, add:

_attachments/, .claude/, node_modules/

Part 3: CLAUDE.md for Your Vault

This is the most important file in the entire setup. Write it for the model, not for humans.

# Second Brain — Claude Context

## Who I Am
Software developer and technical writer. Based in London.
Main interests: distributed systems, developer tools, technical writing.

## Vault Structure
- `daily/` — daily notes, format YYYY-MM-DD.md
- `projects/` — active projects, one subfolder each
- `areas/` — ongoing responsibilities (writing, health, finance)
- `resources/` — reference notes, web clips, book notes
- `_inbox/` — unprocessed capture, process weekly

## Note Format
All notes use YAML frontmatter:

yaml

title: Note Title
date: 2026-04-10
tags: [tag1, tag2]

status: draft | active | archived


## Linking Conventions
- Use [[wikilinks]] for internal connections
- Tag topics with #tag-name (lowercase, hyphenated)
- Mark open tasks with `- [ ]`, completed with `- [x]`

## What Claude Can Do Here
- Create and edit notes following the format above
- Search vault using `grep -r "query" ~/second-brain/`
- Link related notes together
- Extract tasks from daily notes into project files
- Generate weekly summaries from daily notes
- Research topics and save findings to resources/

## What Claude Should NOT Do
- Never delete notes — move to _archive/ instead
- Never change a note's filename without asking first
- Never modify templates/ files
- Don't create files in _attachments/

shell

Keep it under 100 lines. Every line that stays should answer: "Would removing this cause Claude to make a mistake?"

Part 4: Getting Claude Inside Obsidian (Without Leaving the App)

Running between terminal and Obsidian is annoying. Three solutions, pick one:

Option A — Terminal Plugin (Simplest)

Install the Terminal community plugin by polyipseity:

Obsidian → Settings → Community plugins → Browse → search "Terminal" → Install → Enable.

Click the terminal icon in the left ribbon. A real terminal opens inside Obsidian. Run claude from there. You can see your notes and talk to Claude simultaneously.

Option B — MCP Bridge (Most Powerful)

Install the Obsidian Claude Code MCP community plugin by Ian Sinnott. It runs a dual-transport MCP server that exposes 7 structured tools to Claude Code:

# After installing the plugin in Obsidian, register it with Claude Code
claude mcp add obsidian-vault --transport sse http://localhost:27123/sse

Claude now has dedicated tools for vault operations — not just raw file reads. Works even when Obsidian is closed.

Option C — Sidebar Embed

Install Claude Sidebar by Derek Larson. Embeds a full Claude Code terminal directly in Obsidian's right panel. Click the bot icon in the ribbon → Claude opens beside your notes.

Best for: people who never want to leave Obsidian.

Part 5: The Core Workflows

Workflow 1 — Daily Note

Create .claude/skills/daily/SKILL.md:

---
name: today
description: Morning planning session. Use at the start of the day to create today's daily note and plan.
---

# Daily Note Workflow

1. Check if today's note exists at `daily/2026/YYYY-MM-DD.md`
   - If not, create it using the template at `templates/daily.md`
2. Read yesterday's daily note — extract any incomplete tasks
3. Read the current week's project notes — surface active priorities
4. Create today's note with sections:
   - ## Focus (top 3 priorities)
   - ## Tasks (carried over + new)
   - ## Notes (freeform capture)
   - ## End of day (leave empty)
5. Ask me if I want to add anything before finishing

Usage: Each morning, open terminal in vault and type:

> /today

Or just: "Run the today skill" — Claude matches by description.

Workflow 2 — Research and Capture

Create .claude/skills/research/SKILL.md:

---
name: research
description: Research a topic, synthesize findings, and save to resources/ folder.
---

# Research Workflow

When asked to research a topic:
1. Search the vault first — check if notes already exist
   `grep -r "topic" ~/second-brain/resources/`
2. Search the web for current information
3. Synthesize into a structured note:
   - ## Overview (what it is)
   - ## Key Concepts (the important parts)
   - ## Connections (links to existing vault notes)
   - ## Sources (URLs)
4. Save to `resources/topic-name.md` with proper frontmatter
5. Add [[wikilinks]] to related notes already in the vault

Usage:

> "Research Raft consensus algorithm and save to my vault"
> "Find everything I have on distributed systems and create a map of content"

Workflow 3 — Meeting Notes → Action Items

> "Read my note from the team meeting on 2026-04-08 and extract all action items assigned to me. Create tasks in projects/current-sprint/tasks.md"

Claude reads the meeting note, understands context, extracts your tasks specifically, and creates structured task items — linked back to the meeting note.

Workflow 4 — Weekly Review

Create .claude/skills/weekly-review/SKILL.md:

---
name: weekly-review
description: End-of-week review. Summarize the week, close open tasks, and plan next week.
---

# Weekly Review Workflow

1. Read all daily notes from this week (Mon–Fri)
2. Extract:
   - Completed tasks (✅)
   - Incomplete tasks (still open)
   - Themes and patterns across the week
   - New notes created in projects/
3. Generate weekly summary note at `daily/2026/YYYY-WW-weekly.md`:
   - ## What got done
   - ## What didn't (and why)
   - ## Patterns this week
   - ## Next week priorities
4. Ask: "Any wins or lessons you want to add before I save?"

Usage: Every Friday:

> /weekly-review

Workflow 5 — Connect the Dots

> "Read all notes tagged #distributed-systems from the last 3 months. Find recurring themes I haven't explicitly connected yet. Create a map of content note."

This is where the setup compounds. Claude has seen every note you've written. It finds connections you missed — not because it's smarter than you, but because it remembers everything you've captured over months.

Part 6: Vault CLAUDE.md vs Project CLAUDE.md

You can run Claude Code inside a code project that's separate from your Obsidian vault, and still give it access to vault context:

# In your code project
cd ~/projects/my-app

# Give Claude access to your vault knowledge base
claude --add-dir ~/second-brain/resources

Or use a symlink in your vault to pull project docs in:

cd ~/second-brain
ln -s ~/projects/my-app/docs project-docs

Now Claude sees both your code and your vault notes in the same session.

Part 7: Useful Plugins to Install

These are optional but make the experience noticeably better:

Plugin	What it adds
Templater	Auto-create daily notes with consistent frontmatter
Dataview	Query your vault like a database — Claude can write these queries
Periodic Notes	Daily/weekly/monthly note creation on schedule
Smart Connections	Semantic search via local embeddings
Terminal	Run Claude Code inside Obsidian (see Part 4)
Web Clipper	Save web pages to vault — Claude can then read and summarize them
Calendar	Visual calendar for daily notes

Install: Obsidian → Settings → Community plugins → Turn off Safe mode → Browse.

Part 8: Common Mistakes

Using vague prompts.
"Summarize my work" → Claude guesses.
"Summarize all notes tagged #client-work from the last two weeks and list open deliverables" → Claude executes.

Forgetting to update CLAUDE.md.
As your vault evolves, your context file goes stale. Review it monthly. Add a line at the top: Last updated: YYYY-MM-DD.

Letting Claude pollute your vault.
Your vault should contain your authentic thinking. Claude's outputs — plans, summaries, memory — should go into _claude/ or projects/ folders, clearly marked. Keep generated content separate from your own notes.

Deep nesting.
Projects/Active/Q1/Research/Sources/topic.md costs more tokens to work with than research/topic.md. Flatten where possible.

No consistent note format.
If some notes have YAML frontmatter and others don't, Claude has to guess at structure. Enforce templates from the start with Templater.

Part 9: What This Looks Like Day-to-Day

Morning (2 minutes):

cd ~/second-brain
claude
> /today

Claude reads yesterday's note, surfaces unfinished tasks, creates today's note. You review, add anything, close terminal.

During the day:
You take notes in Obsidian normally. Web clips, meeting notes, ideas. Claude isn't involved.

When you need research:

> "Research WebAssembly SIMD support and save to resources/"

Claude searches the web, checks what you already have in the vault, writes a structured note, links it to related notes.

End of week:

> /weekly-review

Claude reads all week's notes, generates the summary, asks for additions.

Over time:
The vault grows. Claude gets smarter about your specific context. The more you've written, the more connections it can surface. The system compounds.

The Honest Limitations

Claude Code still has a context window. Very large vaults require targeted queries — Claude can't read 800 notes in one session.
This requires terminal comfort. If command line is unfamiliar, the setup friction is real.
Claude writes to your files. Review what it creates before treating it as your own thinking.
Local only — no mobile sync out of the box. Use Obsidian Sync or git for cross-device.

Quick Start Summary

# 1. Install
brew install --cask obsidian
brew install --cask claude-code

# 2. Create vault
mkdir ~/second-brain
# Open Obsidian → "Open folder as vault"

# 3. Connect
cd ~/second-brain
claude
> /init

# 4. Edit CLAUDE.md to describe your vault structure

# 5. First real task
> "Create a minimal folder structure for a developer's second brain"

# 6. Install Terminal plugin in Obsidian so you never leave the app

That's the full setup. Start with the daily note workflow. Get that reliable first. Then add research and weekly review. The system will tell you what it needs next.

Based on xda-developers.com, starmorph.com/blog, mauriciogomes.com, dev.to/numbpill3d, mindstudio.ai, geeky-gadgets.com, and medium.com/@martk. April 2026.

Claude Code Cheatsheet: The Terminal AI Agent That Actually Codes

mibii — Fri, 10 Apr 2026 07:31:02 +0000

TL;DR — Claude Code is Anthropic's terminal-based agentic coding tool. It reads your codebase, edits files, runs commands, and manages git — all through natural language. This is your practical reference from setup to advanced workflows.

🧠 The Mental Model: Why Not Just Use Chat?

In chat you are the middleman:

You → copy file → paste to Claude → get answer → paste back → run → error → repeat

Claude Code removes you from the loop for the mechanical parts:

You: "Add rate limiting to the auth endpoints"
Claude Code: reads files → understands architecture → edits code → runs tests → commits

The difference: Claude Code has direct access to your filesystem, terminal, and git. It acts, not just talks. You review diffs and approve — the thinking stays yours, the typing goes away.

📁 Project Structure

my-project/
├── CLAUDE.md                  ← project memory, auto-loaded every session
├── .claude/
│   ├── settings.json          ← hooks config (commit to git)
│   ├── settings.local.json    ← permissions (gitignore this)
│   ├── commands/              ← custom slash commands (.md files)
│   │   ├── review.md
│   │   └── fix-issue.md
│   ├── skills/                ← auto-activated workflow modules
│   │   ├── code-review/
│   │   │   └── SKILL.md
│   │   └── test-writer/
│   │       └── SKILL.md
│   └── agents/                ← subagent definitions (.yml files)
│       └── code-reviewer.yml
├── .mcp.json                  ← MCP server definitions
└── src/

Personal (cross-project):

~/.claude/
├── CLAUDE.md        ← global preferences, always loaded
├── commands/        ← personal slash commands
└── skills/          ← personal skills

⚙️ Installation

# macOS
brew install --cask claude-code

# Windows
winget install Anthropic.ClaudeCode

# Linux / native binary (recommended)
curl -fsSL https://claude.ai/install.sh | bash

# Verify
claude doctor

# Authenticate
claude auth login

⚠️ npm install -g @anthropic-ai/claude-code is deprecated. Use the native installer.

Requirements: Claude Pro ($20/mo) or Max subscription, or API key from Anthropic Console.

🚀 First Run In Any Project

cd your-project
claude          # starts interactive session

> /init         # generates starter CLAUDE.md from your codebase
> /status       # see loaded context and model
> /plan         # map project before touching anything

Start with: "What does this project do and how is it structured?" — let Claude orient itself first.

📝 CLAUDE.md — Project Memory

Claude reads this every session. The single most impactful thing to set up.

# Project: E-commerce API

## Build & Test Commands
- `npm run dev` — start dev server on port 3000
- `npm test` — run Jest test suite
- `npm run lint` — ESLint + Prettier check
- `npm run build` — production build

## Architecture
- Next.js 15 with App Router
- PostgreSQL with Prisma ORM
- Authentication via JWT (see src/auth/)
- All API routes in src/app/api/

## Code Conventions
- TypeScript strict mode — no `any`
- Server components by default; `"use client"` only when needed
- Write tests for all new utility functions
- Conventional commits: feat:, fix:, chore:, docs:

## What NOT to Do
- Never modify db/migrations/ manually
- Never commit .env files
- Don't use `console.log` — use logger.ts

Rules for a good CLAUDE.md:

Target 50–100 lines. Every line should earn its place.
Ask: "Would removing this cause Claude to make a mistake?" If no → cut it.
500+ lines = context bloat = Claude ignores rules buried inside.
Use # text shortcut inside a session to instantly append a note.
Run /memory to open and edit it mid-session.

⌨️ CLI Flags

Flag	What it does
`claude "prompt"`	Start with a prompt
`claude -p "prompt"`	One-shot, non-interactive
`claude -c`	Continue last session
`claude --resume`	Resume by ID or name
`claude -n "name"`	Name the session
`claude --worktree`	Run in isolated git worktree
`claude --effort high`	Max reasoning effort
`claude --model opus`	Override model
`claude --add-dir ../lib`	Grant access to additional directory
`claude --debug`	Enable debug logging
`claude --allowedTools "Bash(git:*)"`	Restrict tool access

⚡ Slash Commands

Session

Command	What it does
`/clear`	Delete all conversation history
`/compact`	Compress context into summary (keeps thread)
`/context`	View token usage
`/rewind`	Undo last turn
`/cost`	Show token costs

Model & Config

Command	What it does
`/model`	Switch model (sonnet / opus / haiku)
`/model opusplan`	Plan with Opus, execute with Sonnet
`/effort low\	med\
{% raw %}`"ultrathink"` keyword	Trigger deep reasoning on next turn
`/config`	Open settings UI

Workflow

Command	What it does
`/plan`	Toggle plan mode — propose before acting
`/review`	Multi-agent code review pipeline
`/simplify`	3-agent architecture review before PR
`/batch`	Parallel changes across isolated worktrees
`/loop`	Schedule recurring tasks (cron-like)
`/debug`	Automatic debugging workflow
`/voice`	Voice input mode

Memory

Command	What it does
`/memory`	Edit CLAUDE.md files
`/init`	Generate CLAUDE.md from codebase
`# text`	Quick-add note to memory
`@path`	File autocomplete in prompt
`!command`	Run shell command inline

⌨️ Keyboard Shortcuts

Shortcut	Action
`Shift+Tab`	Cycle permission modes (normal → auto-accept → plan)
`Shift+Tab × 2`	Enter plan mode directly
`Option+T`	Toggle extended thinking
`Option+P`	Open model picker
`Ctrl+G`	Open current file/diff in editor
`Esc+Esc`	Open rewind/undo
`Ctrl+C`	Cancel current operation
`Tab`	Toggle thinking

🧩 Skills — Auto-Activated Workflows

Skills are Markdown modules Claude loads on demand when context matches — not stuffed into every prompt.

.claude/skills/my-skill/
├── SKILL.md       ← instructions + YAML frontmatter
├── scripts/       ← executable automation
└── references/    ← docs loaded on demand

Example skill:

---
name: generate-commit-messages
description: Generates clear commit messages from git diffs. Use when
  writing commit messages or reviewing staged changes.
---

# Generating Commit Messages

1. Run `git diff --staged` to see staged changes
2. Write a commit message:
   - Summary under 50 chars, imperative mood
   - Blank line, then detailed description
3. Follow conventional commits: feat:, fix:, docs:, chore:

Skills vs Commands:

Skills = comprehensive workflows, auto-invoked by context match
Commands = quick prompts, invoked explicitly with /

🪝 Hooks — Deterministic Event Scripts

Hooks run shell scripts at lifecycle points. Use for behavior Claude can't reliably self-enforce.

In .claude/settings.json:

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Write(*.py)",
      "hooks": [{ "type": "command", "command": "python -m black \"$file\"" }]
    }],
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "echo 'Running: $TOOL_INPUT'" }]
    }],
    "Stop": [{ "command": "notify-send 'Claude finished'" }]
  }
}

Key hook events:

Event	Blockable	When
`PreToolUse`	Yes	Before any tool executes
`PostToolUse`	No	After tool completes
`PreCompact`	No	Before context compaction
`PermissionRequest`	Yes	Permission dialog shown
`WorktreeCreate`	Yes	Before new worktree
`TaskCompleted`	No	Task marked complete
`Stop`	No	Claude finished turn

Common patterns: auto-format on write, block dangerous commands, secret detection pre-commit, notify on completion.

🤖 Subagents — Parallel Isolated Workers

Subagents are specialized Claude instances with their own context windows.

Define in .claude/agents/:

---
name: code-reviewer
description: Use for thorough code reviews. Focus on security, performance, maintainability.
model: claude-sonnet-4-6
color: orange
---
You are an expert code reviewer.
Structure all feedback as: Summary → Critical Issues → Suggestions → Positives.

Agent team patterns:

Pattern	When to use
Orchestrator	Central dispatcher routes tasks to specialists
Pipeline	Sequential handoff (research → draft → review)
Map-Reduce	Parallel then merge (review 10 files at once)
Supervisor	Monitor and retry failed agents
Swarm	Dynamic peer delegation

Boris Cherny (Claude Code creator) runs 10–15 sessions simultaneously with separate git worktrees. Each session gets its own plan. Competing implementations are then compared.

🔌 MCP Servers — External Tool Connections

# Add via CLI
claude mcp add github -- npx -y @modelcontextprotocol/server-github
claude mcp add playwright -- npx -y @playwright/mcp

# Or in .mcp.json (committed, shared with team)

{
  "mcpServers": {
    "github": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"] },
    "postgres": { "command": "npx", "args": ["-y", "@mcp/postgres"],
      "env": { "DB_URL": "${DATABASE_URL}" } }
  }
}

Popular MCP servers:

Server	What it unlocks
GitHub	PRs, issues, repos, actions
JIRA / Linear	Ticket workflows
Slack	Notifications, search
Postgres / Supabase	Direct DB queries
Playwright	Browser automation
Notion	Knowledge base

📊 Context Management

Usage	Status	Action
0–50%	🟢	Work freely
50–70%	🟡	Monitor with `/context`
70–90%	🟠	Run `/compact`
90%+	🔴	`/clear` — mandatory

/clear vs /compact:

/compact — summarizes history, preserves thread. Use between sub-tasks.
/clear — deletes all history. Use when switching to a different task entirely.

File edits persist after both. Only the conversation is affected.

💸 Cost Tips

/effort low for quick iteration — saves thinking tokens
/model haiku for mechanical repetitive tasks (renaming, formatting)
/compact proactively — larger context = higher cost per token
Batch API: 60% off for non-urgent async work
Prompt Caching: 30% savings on repetitive sessions with same CLAUDE.md
Per-skill effort: add effort: low to commit/scaffold skills, effort: high to security-audit skills

⚡ The Core Workflow

1. cd project && claude

2. "What does this project do?"    ← orient Claude first

3. Shift+Tab → Plan Mode
   "Implement OAuth2 with PKCE"    ← Claude proposes, you review

4. Approve the plan

5. Shift+Tab → Normal Mode         ← Claude executes
   (review diffs, accept/reject)

6. /review                         ← multi-agent review

7. git diff                        ← your final check

8. /compact (if context > 70%)

9. Repeat

Rule of thumb: Plan Mode for anything touching 3+ files. Direct ask for obvious single-line fixes.

🧭 Who Is This For

✅ Use Claude Code if:

You work in the terminal and are comfortable reading diffs
Your tasks involve multiple files or whole-codebase understanding
You want to keep your existing tools and just add AI to the loop
You have repetitive mechanical work (tests, docs, refactoring) eating time

❌ Skip Claude Code if:

You want inline autocomplete in an IDE → use Cursor or Copilot
You're doing a quick one-off question → chat is faster and free
You need enterprise audit trails and compliance → look at Amp
You don't yet read diffs comfortably → build that skill first

🆚 Claude Code vs Other Tools

Tool	Best for
Claude Code	Terminal-native, agentic, whole-codebase tasks
Cursor	IDE-integrated autocomplete + chat panel
GitHub Copilot	Inline autocomplete, tight GitHub integration
Aider	Lightweight CLI alternative, supports local models
Gemini CLI	Visual assets, free tier to experiment
Claude chat	One-off questions, no file access needed

📚 Key Resources

Resource	Where
Official docs	`code.claude.com/docs`
Skills docs	`code.claude.com/docs/en/skills`
Hooks docs	`code.claude.com/docs/en/hooks`
MCP servers	`code.claude.com/docs/en/mcp`
Awesome Claude Code	`github.com/hesreallyhim/awesome-claude-code`
Community skills	`skillsplayground.com`
Ultimate guide	`github.com/FlorianBruniaux/claude-code-ultimate-guide`

Based on official Claude Code documentation (code.claude.com), shipyard.build/blog, blakecrosley.com, FlorianBruniaux/claude-code-ultimate-guide, mindwiredai.com. April 2026.

OpenClaw Cheatsheet: The Autonomous AI Agent That Runs on Your Machine

mibii — Fri, 10 Apr 2026 07:27:15 +0000

TL;DR — OpenClaw is an open-source autonomous AI agent runtime. It connects an LLM of your choice to your machine, your files, and your messaging apps. It has 247k+ GitHub stars. It is powerful and genuinely dangerous if misconfigured. This article is your map.

🧠 The Mental Model

You (Telegram / iMessage / Discord)
        ↓
   Gateway — always-on router, never reasons
        ↓
  Agent Runtime — calls LLM, executes tools, loops
        ↓
   LLM (Claude / GPT / Ollama / DeepSeek — your choice)
        ↓
 Files · Browser · Email · Shell · APIs

LLM = the brain. OpenClaw = the hands, legs, and dispatcher.

It is not a chatbot. It takes actions, not just generates text. It can read your email while you sleep, process files on a schedule, and reply to your Telegram messages on your behalf — adaptively, not from a rigid script.

📁 Workspace File Structure

~/.openclaw/
├── openclaw.json          ← main config (models, channels, agents)
└── workspace/
    ├── SOUL.md            ← agent's personality and boundaries
    ├── AGENTS.md          ← operating instructions
    ├── MEMORY.md          ← what the agent remembers (auto-updated)
    ├── USER.md            ← your profile (name, timezone, accounts)
    ├── TOOLS.md           ← tool notes and conventions
    ├── BOOTSTRAP.md       ← first-run setup ritual (deleted after)
    ├── HEARTBEAT.md       ← background check-in schedule
    ├── IDENTITY.md        ← agent name, avatar, emoji
    └── skills/
        └── my-skill/
            ├── SKILL.md   ← instructions + YAML frontmatter
            └── scripts/   ← executable automation

Pro tip: Think of SOUL.md as your CLAUDE.md — but for your always-on agent. Start here before anything else.

⚙️ Installation

# macOS
brew install openclaw

# Windows
winget install OpenClaw.OpenClaw

# Linux
curl -fsSL https://openclaw.ai/install.sh | sh

# Verify
openclaw --version
openclaw doctor   # checks your environment

Requirements: Node 22+, one messaging app connected, an LLM API key (or local Ollama)

🚀 First Run

openclaw start              # starts the Gateway daemon
openclaw channels list      # see available channels
openclaw channels add telegram
openclaw agents add main --model anthropic:claude-opus-4-6
openclaw agents set-identity --from-identity

Then message your bot: Hey, let's get you set up. Read BOOTSTRAP.md and walk me through it.

⚠️ If your first message is a real question, BOOTSTRAP never runs. Send the setup message first.

🔧 Core CLI Commands

Command	What it does
`openclaw start`	Start the Gateway daemon
`openclaw stop`	Stop the Gateway
`openclaw status`	Health check
`openclaw doctor`	Full environment diagnostics
`openclaw agents list`	List configured agents
`openclaw agents add <name>`	Create a new agent
`openclaw channels list`	Show connected channels
`openclaw channels status --probe`	Test channel connectivity
`openclaw skills list`	List installed skills
`openclaw skills add <skill>`	Install from ClawHub
`openclaw memory search <query>`	Semantic search your memory
`openclaw logs --tail 50`	Stream recent logs

📝 Workspace Files — What Goes Where

SOUL.md — Agent Constitution

Persona, tone, hard limits. Injected every session.

# Identity
You are Alex, a personal assistant who is direct and never verbose.

# Hard limits
- Never send emails without explicit confirmation
- Never delete files without showing what will be deleted first
- Always ask before executing shell commands in production directories

USER.md — Your Profile

# User Profile
- Name: Your Name
- Timezone: Europe/London
- Key accounts: electricity (British Gas), broadband (BT)
- Morning briefing: 8:00 AM
- Preferred reminder: evening before deadline

AGENTS.md — Operating Instructions

Build commands, code conventions, what NOT to do. Same concept as CLAUDE.md in Claude Code.

MEMORY.md — Persistent Memory

Auto-updated by the agent. Uses vector + BM25 search. Lives in SQLite. Do not edit manually.

🧩 Skills — Modular Capabilities

Skills are Markdown files that tell the agent how to handle a domain. The agent reads them on demand — not injected into every prompt.

---
name: github-pr-reviewer
description: Review GitHub pull requests and post structured feedback
---

# GitHub PR Reviewer

When asked to review a pull request:
1. Use web_fetch to retrieve the PR diff
2. Analyze for correctness, security issues, code style
3. Structure as: Summary → Issues → Suggestions
4. Post via GitHub API only if explicitly asked

Install from ClawHub:

openclaw skills add github-pr-reviewer
openclaw skills add email-triage
openclaw skills add daily-briefing

⚠️ ClawHub has 5,700+ skills. Cisco researchers found silent data exfiltration in a community skill. Treat every SKILL.md like an npm package from an unknown author — read the code first.

🪝 Hooks — Event-Driven Automation

Hooks are TypeScript handlers that fire on lifecycle events. Deterministic logic that runs before/after the LLM.

Event	When it fires
`command:new`	New session starts
`agent:bootstrap`	Before system prompt is finalized
`before_tool_call`	Before any tool executes
`after_tool_call`	After tool completes
`before_compaction`	Before context is compressed
`session_start / session_end`	Session lifecycle
`gateway_start / gateway_stop`	Daemon lifecycle
`PreCommit`	Before git commit (secret detection)

Example use cases: auto-format on file write, block dangerous shell commands, log all tool calls, inject environment context at session start.

🤖 Multi-Agent Setup

openclaw agents add main --model anthropic:claude-opus-4-6
openclaw agents add code-reviewer --model anthropic:claude-opus-4-6 \
  --workspace ./src --tools file,shell,git
openclaw agents add researcher --model openai:gpt-4.1 \
  --tools web_fetch,file

Agent team patterns:

Pattern	When to use
Orchestrator	Central task dispatcher routes to specialists
Pipeline	Sequential handoff (research → draft → review)
Map-Reduce	Parallel then merge (multiple files at once)
Supervisor	Monitor and retry failed tasks
Swarm	Dynamic peer delegation

📊 Context Management

Usage	Action
0–50%	Work freely
50–70%	Monitor token usage
70–90%	Run `/compact`
90%+	`/clear` — mandatory

Memory compaction: older turns are summarized, not dropped. Semantic content preserved.

🔐 Security — Read This Before You Start

CVE-2026-25253 (CVSS 8.8): Patched RCE — a malicious web page could leak the Gateway auth token and execute arbitrary commands. Update immediately.

Prompt injection is real. If your agent reads emails or web pages, malicious instructions in that content can hijack it. A researcher demonstrated an agent leaking its full config (including API keys) via a spoofed email.

Minimum security checklist:

# Run before connecting to any external network
openclaw audit

# Never hardcode keys — use env vars
export ANTHROPIC_API_KEY=sk-...
export OPENCLAW_GATEWAY_TOKEN=...

# Add to .gitignore
echo "openclaw.local.json" >> .gitignore
echo ".env" >> .gitignore

# Enable DM pairing (default — don't disable)
# Only approve known users via pairing codes

Before installing any skill:

Who made it? Check GitHub stars, last commit, issues
What permissions does it request?
Does it make outbound network calls?
Read every line of SKILL.md

🧭 Who Is This For — Honestly

✅ Use OpenClaw if:

You're comfortable in a terminal and understand environment variables
You need adaptive automation where logic can't be reduced to if-else
You want a personal agent on your own infrastructure, data stays local
You're a developer who wants to study how production AI agents actually work

❌ Skip OpenClaw if:

You don't know how to read a command-line error
You need compliance, audit trails, or enterprise governance
Your task has deterministic logic — a scheduler will be safer and cheaper
You want a quick setup with no maintenance overhead

⚡ OpenClaw vs Other Tools

Tool	Best for
OpenClaw	Adaptive personal agent, agentic workflows, LLM-driven decisions
Jenkins / GitHub Actions	CI/CD, reproducible pipelines, audit logs — no LLM needed
xStarter / Task Scheduler	Simple scheduled scripts, deterministic triggers
n8n / Make / Zapier	Visual workflow builder, SaaS integrations, no-code
LangChain / custom code	Full architectural control, enterprise integrations
Claude chat	One-off tasks where you want to stay in the loop

The right tool is not the smartest one. It's the one that solves your problem with the least risk.

💡 Pro Tips

Start minimal. Add SOUL.md + USER.md first. Add skills only when you feel the need.
Keep AGENTS.md under 500 lines. Longer = context bloat = ignored rules.
Use --dev flag to isolate state while experimenting: openclaw --dev start
Back up your workspace directory. It's plain Markdown — git-track it.
Test skills in isolation before connecting them to live channels.
Run openclaw audit regularly, especially after adding new skills.
MEMORY.md is auto-updated — the agent writes what it learns. Review it occasionally.
openclaw doctor is your first stop for any issue.

📚 Key Resources

Resource	Link
Official docs	`docs.openclaw.ai`
GitHub	`github.com/openclaw/openclaw`
ClawHub (skills)	`clawhub.ai`
Security audit tool	`openclaw audit`
Community	Discord via official docs

Based on OpenClaw documentation, freecodecamp.org, bibek-poudel.medium.com, arxiv.org (ClawSafety), digitalocean.com, and vallettasoftware.com. April 2026.

OpenClaw: автономный агент для тех, кто знает что делает

mibii — Fri, 10 Apr 2026 00:25:01 +0000

В конце января 2026 года open-source проект с незамысловатым названием буквально взорвал GitHub. За несколько недель — почти 250 тысяч звёзд, форки от китайских корпораций, интерес от Tencent. Что же такое OpenClaw на самом деле?

Коротко: это не ещё один чат-бот. Это агентская оболочка, которая берёт LLM (Claude, GPT, Gemini, локальные модели — на ваш выбор) и превращает её в автономного исполнителя, живущего на вашей машине или сервере.

LLM — это мозг. OpenClaw — руки, ноги и диспетчер. Он не думает сам, но решает что сделать, когда вызвать модель, что запомнить и какой инструмент задействовать.

Как это устроено

Архитектура OpenClaw состоит из трёх слоёв:

Gateway — постоянно работающий процесс, который принимает сообщения из мессенджеров (Telegram, WhatsApp, iMessage, Discord, Slack) и маршрутизирует их. Сам он не думает — только роутит.

Agent Runtime — слой, который вызывает LLM, получает ответ, исполняет инструменты (файлы, браузер, почта, скрипты) и снова идёт к модели, пока задача не выполнена.

AGENTS.md — текстовый файл, аналог CLAUDE.md, где описана личность агента, его инструменты и правила поведения.

Агент работает непрерывно. Он может проверять почту пока вы спите, обрабатывать входящие файлы по расписанию, отвечать на сообщения в Telegram от вашего имени — и всё это адаптивно, не по жёсткому скрипту.

Для каких задач OpenClaw подходит

Обработка входящих — мониторинг почты, сортировка, черновики ответов, уведомления в Telegram по критериям
Работа с файлами — обработка документов, извлечение данных, конвертация форматов по триггеру или расписанию
Исследования — автоматический сбор информации, поиск, суммаризация с сохранением в локальные файлы
Персональный ассистент — агент в вашем мессенджере, который знает ваши предпочтения и действует от вашего имени

Ключевое отличие от обычной автоматизации: OpenClaw справляется с задачами, где нет жёсткого алгоритма. "Если письмо про счёт — ответь, что обработаем за 2 дня" — это не условие в if-else, это смысловое суждение, которое делает LLM.

Кому это нужно, а кому нет

Подходит:

✅ Разработчик или технический специалист, который комфортно работает с терминалом, понимает как работают API и знает что такое переменные окружения

✅ Тот, кому нужна адаптивная автоматизация — когда логика задачи не укладывается в жёсткий скрипт и требует "понимания" контекста

✅ Исследователь или indie-разработчик, который хочет персонального агента с полным контролем над данными на своей инфраструктуре

Не подходит:

❌ Тот, кто не понимает как запустить командную строку. Один из мейнтейнеров проекта прямо написал: "Если вы не понимаете как запустить командную строку — этот проект слишком опасен для вас"

❌ Команды с жёсткими требованиями к compliance и аудиту. Агент с доступом к файлам, почте и API — это широкая поверхность атаки

❌ Задачи с детерминированной логикой — здесь LLM только добавляет непредсказуемость туда, где она не нужна

Когда лучше выбрать другой инструмент

Инструмент	Когда выбирать
Jenkins / GitHub Actions	CI/CD, деплой, тесты. Жёсткие пайплайны где важна воспроизводимость и аудит. LLM здесь лишний.
xStarter / Task Scheduler	Запуск скриптов по расписанию или триггеру. Если логика простая и детерминированная — xStarter проще, предсказуемее и не требует API-ключей.
n8n / Make / Zapier	Интеграции между сервисами с визуальным редактором. Если нужно соединить CRM с почтой — не нужен агент с LLM.
LangChain / собственный код	Если нужен полный контроль над архитектурой агента, специфические инструменты или enterprise-интеграции.
Просто чат с Claude	Если задача разовая, требует вашего участия и контроля — зачем городить агента? Чат быстрее и понятнее.

Критика: что реально стоит знать

⚠️ Безопасность. Исследователи из Cisco протестировали сторонний скилл для OpenClaw и обнаружили в нём эксфильтрацию данных и prompt injection — без каких-либо предупреждений. Репозиторий скиллов не имеет достаточной проверки. Устанавливайте только то, что понимаете.

Агент работает с реальными данными в реальном времени. Он может отправить письмо, удалить файл, создать профиль на датинг-платформе — был реальный случай, когда агент завёл аккаунт на MoltMatch без явного указания пользователя. Широкие права + автономность = непредсказуемые побочные эффекты.

Prompt injection — отдельная история. Если агент читает письма или веб-страницы, вредоносные инструкции в этих данных могут перехватить управление. Это не баг OpenClaw конкретно — это системная проблема всех агентских систем с широким доступом.

В марте 2026 года Китай запретил государственным структурам использовать OpenClaw по соображениям безопасности. Это показательно.

Вывод

OpenClaw — это мощный инструмент для конкретного профиля пользователя. Если вы технический специалист, хотите реального автономного агента на своей инфраструктуре, понимаете риски и готовы аккуратно управлять правами доступа — это интересный эксперимент с реальной практической ценностью.

Если вы хотите просто "автоматизировать рутину" и не готовы разбираться в том, что именно агент делает с вашими данными — возьмите xStarter, n8n или Make. Они скучнее, но предсказуемее. А предсказуемость в автоматизации часто важнее интеллекта.

Хороший инструмент — не самый умный, а тот, который решает вашу задачу с минимальными рисками. OpenClaw умный. Но риски у него настоящие.

Материал основан на открытых источниках: Wikipedia, freecodecamp.org, arxiv.org, официальная документация openclaw.ai. Апрель 2026.

Hunting Vulnerable axios Versions Across Your Node.js Monorepo

mibii — Thu, 02 Apr 2026 10:08:20 +0000

When a dependency ships a bad version, your node_modules tree doesn't warn you. Here's a small PowerShell script that does.

The problem

Large Node.js projects accumulate dependencies fast. A monorepo with dozens of services can have hundreds of nested package.json and package-lock.json files, each potentially pinning a different version of a shared library.

When a specific version of a popular library — say, axios — turns out to carry a bug or a security regression, you need to know exactly where it's referenced, across every file, at a glance. Grepping by hand doesn't scale, and most dependency auditing tools only look at the top-level lockfile.

⚠️ Why these versions?
Versions 1.14.1 and 0.30.4 are the target of this scanner — known problematic releases that should be identified and upgraded as soon as possible.

The approach

The script is a two-phase scanner written in PowerShell. It's designed to be dropped anywhere in your repo and run with a single command — no dependencies, no config files.

Phase 1 recursively walks the directory tree from wherever the script lives, collecting all package.json and package-lock.json files:

$foundFiles = Get-ChildItem -Path $startPath -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $targetFiles -contains $_.Name }

Phase 2 reads each file line by line, looking for the keyword axios. Every matching line is printed to the console with its line number, and the keyword is highlighted in red so you can spot it instantly.

for ($i = 0; $i -lt $lines.Count; $i++) {
    if ($lines[$i] -match [regex]::Escape($keyword)) {
        $hitList.Add([PSCustomObject]@{
            Line    = $i + 1
            Content = $lines[$i]
        })
    }
}

💡 Gotcha — reserved variable name
PowerShell's automatic variable $matches is populated by the -match operator itself. Using it as a collection causes a cryptic runtime error: "A hash table can only be added to another hash table."
The fix: name your collection $hitList and use List[PSCustomObject] instead of a plain array.

# WRONG — $matches is reserved by PowerShell
$matches = @()
$matches += [PSCustomObject]@{ ... }  # runtime error!

# CORRECT
$hitList = [System.Collections.Generic.List[PSCustomObject]]::new()
$hitList.Add([PSCustomObject]@{ ... })

The alarm system

Beyond general search, the script maintains a second collection — $alarmList — that fires only when a line contains one of the flagged version strings. This runs in the same loop, so there's zero extra I/O cost.

$dangerVersions = @("1.14.1", "0.30.4")

foreach ($ver in $dangerVersions) {
    if ($lines[$i] -match [regex]::Escape($ver)) {
        $alarmList.Add([PSCustomObject]@{
            Version   = $ver
            File      = $file.Name
            Directory = $file.DirectoryName  # full path to folder
            LineNum   = $i + 1
            Content   = $lines[$i].Trim()
        })
    }
}

After all files are scanned, the alarm block prints a consolidated summary at the very bottom — version found, filename, directory path, and the exact line — so there's no ambiguity about what needs updating:

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!                                              !
!   ⚠️  ALARM — VULNERABLE VERSIONS DETECTED  ⚠️  !
!                                              !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

  ▶ Version    : 0.30.4
  ▶ File       : package-lock.json
  ▶ Directory  : C:\projects\my-app\services\api
  ▶ Line #     : 1042
  ▶ Content    : "version": "0.30.4",
  ───────────────────────────────────────────────────

The console output also uses color: axios keyword in red, dangerous version numbers in yellow, file headers in magenta — making it easy to scan hundreds of lines at a glance.

Running the script

Save the file as axios-finder.ps1, place it anywhere inside your project root, then run:

.\axios-finder.ps1

If your execution policy blocks unsigned scripts:

powershell -ExecutionPolicy Bypass -File .\axios-finder.ps1

No Node.js, no npm, no extra modules required. It runs on any machine with PowerShell 5.1 or later — which means any modern Windows box, out of the box.

Full script

The complete script with colored output, per-file hit counts, version highlighting, and the alarm block is available on GitHub:

👉 https://github.com/mibii/axios-bad-version-finder

Found this useful? Buy me a coffee , Drop a ❤️ or leave a comment — happy to extend the script to support other libraries or output formats.

Prop Trading 2.0 (Trade-to-Earn)

mibii — Wed, 11 Mar 2026 23:20:15 +0000

Q-big-One trading core is an alternative to MetaTrader 4/5.

I developed my own trading core and called it Q-big-One.

Event Sourcing + WAL: Full audit trail. Instant crash recovery via event replay.
Full Source Control: Every line is yours. Customise risk, commissions, execution.
Cloud Native: Docker/Kubernetes ready. AWS, GCP, bare metal.
Multi-Asset: Crypto, Forex, CFD — all in one engine with per-symbol config.

Use Cases:

The Ultimate Sandbox

Every broker platform is just a sandbox until orders hit the LP. This engine gives you the exact same technology brokers use to "play" against traders. Understand the mechanics of B-Book, slippage, and stop-hunts by being the one who controls them.

Master the Game by Owning the Board

A-Book / Real Market Bridge

Connect the "Tick Feeder" module to your real Binance/Bybit account via API keys. The core now acts as a massive router. You trade on 100 internal accounts inside the core, and the core aggregates net exposure and hedges it on the real market.

Internal Virtual Volume → Real Liquidity

Self-Hosted "Personal Prop Firm"

Stop paying fees to prop firms for challenges. Spin up your own environment. Create unlimited accounts, run different bots, and act as the Liquidity Provider for your own strategies. Test execution, slippage, and spread widening in a controlled "Matrix" where you control the laws of physics.

Infinite AccountsCustom Risk RulesZero Fees

Sample use case Prop Trading 2.0 (Trade-to-Earn: (https://qbig.one/)

No loss money, No registration, No charge money. You enter the terminal, see a pool of funded accounts, and hit CLAIM.
The backend mints an anonymous JWT, binds it to your device, and hands you the keys. Strategy flopped? Hit RELEASE, return the account, grab another. Zero friction, zero commitment. Earn your first grade.

Аккаунт эволюционирует: 🔘 Bronze ➔ 🥈 Silver ➔ 👑 Proven Alpha.

Prop Firm offers no-charge options. Prop Firm provides capital (virtual) to everyone; if a trader is successful, they receive PROVEN_ALPHA status, A-Book Bridge begins mirroring it to the real market, and Prop Firm shares the profit with the trader.

Building Your Own PowerShell Security Auditor!

mibii — Sun, 01 Jun 2025 13:19:35 +0000

From Novice to Cyber Helper: Building Your Own PowerShell Security Auditor!

Hey fellow coding enthusiasts!

We all started our programming journey somewhere, and one of the best ways to learn is by building something practical that solves a real (even if small) problem. Today, I want to share the experience of developing a simple yet useful tool in PowerShell: a local system security auditor. This project perfectly demonstrates how you can combine system commands, process manipulation, and even create a graphical user interface (GUI) – all using PowerShell!
We'll go from an idea to an interactive application that not only highlights suspicious activity but also offers to take action.

Let's dive in!

Step 1: The Idea and First Drafts – What Do We Want to Check?
Initially, the task was simple: write a script to quickly assess certain security aspects of a local system. The key areas we decided to focus on were:
Network Activity: Which ports is our system listening on? Are there any non-standard ones or processes with suspiciously high PIDs (Process Identifiers)?
Process Integrity: Are all running processes digitally signed? Unsigned binaries can be a sign of trouble.
The first thought for network analysis was the good old netstat -ano. For checking signatures, the built-in Windows mechanism Get-AuthenticodeSignature.

Initial (simplified) idea

$netstatOutput = netstat -ano | findstr LISTENING

... some text parsing here ...

$processes = Get-Process
foreach ($proc in $processes) {
# ... signature check ...
}

This is a starting point. But we want to do it cooler and more "PowerShell-idiomatically"!
Step 2: The PowerShell Way – Objects Instead of Plain Text
Parsing the text output of netstat is a thankless and fragile task. PowerShell loves objects! And for network connections, there's a wonderful cmdlet: Get-NetTCPConnection.

✅ Key Insight: Instead of parsing strings, Get-NetTCPConnection -State Listen immediately gives us objects with convenient properties like LocalPort and OwningProcess (that very PID). This makes the code cleaner and more reliable.

A more "correct" approach

$listeningConnections = Get-NetTCPConnection -State Listen
foreach ($conn in $listeningConnections) {
$pid = $conn.OwningProcess
$port = $conn.LocalPort
# ... further analysis ...
}

Additionally, we decided it would be useful to see not just the PID for each listening port, but also the path to the process's executable. This is done using Get-Process -Id $pid | Select-Object Path, ProcessName.

Step 3: Graphical User Interface – Making It Pretty and Understandable

Outputting results to the console is fine, but a popup window with a report looks much more professional and user-friendly. This is where the magic of the .NET Framework, accessible directly from PowerShell, comes in!
✅ Key Insight: Add-Type -AssemblyName System.Windows.Forms opens up the entire world of Windows Forms to us. We can create forms, text boxes, buttons – everything needed for a simple GUI.
Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing # For sizes, colors, etc.

function Show-ResultPopup {
    param ($text)
    $popup = New-Object Windows.Forms.Form
    $popup.Text = "System Audit Result"
    # ... configure sizes, controls (TextBox) ...
    $popup.ShowDialog() # Show the window modally
    $popup.Dispose()    # IMPORTANT: Release resources!
}

Don't forget .Dispose() for forms! This releases the resources used by GUI elements when they are no longer needed.

Step 4: Signature Check – Trust, but Verify

For checking the digital signatures of executable files, Get-AuthenticodeSignature -FilePath $path is our best friend. If the Status property of the result is not Valid, it's a reason for concern (or, as we found out, sometimes a peculiarity of UWP apps).

$signature = Get-AuthenticodeSignature -FilePath "C:\Path\To\File.exe"
if ($signature.Status -ne [System.Management.Automation.SignatureStatus]::Valid) {
    # Suspicious!
}

Step 5: Interactivity – Giving the User a Choice!

Simply showing a list of "suspicious" unsigned processes is half the battle. What if we gave the user the option to try and "kill" (terminate) them right there?
✅ Key Insight: Here we combine System.Windows.Forms.MessageBox to request confirmation from the user and Stop-Process to terminate the process.
Request Admin Rights: Terminating processes often requires administrator privileges. The script should check for this and, if possible, offer to restart with elevated rights.
Confirmation Dialog: For each "problematic" process, display a MessageBox with details (name, PID, path) and the question: "Terminate?".

$userChoice = [System.Windows.Forms.MessageBox]::Show($ownerForm, "Terminate process X?", "Confirmation", [System.Windows.Forms.MessageBoxButtons]::YesNo)
if ($userChoice -eq [System.Windows.Forms.DialogResult]::Yes) {
    Stop-Process -Id $processId -Force -ErrorAction SilentlyContinue
    # Log the result
}

Note the -Force for Stop-Process and error handling (at least -ErrorAction SilentlyContinue or a full try-catch).

Step 6: A Beginner's Headache – Encodings! 😵

During development, especially when we added non-English messages (Cyrillic in our original case) to MessageBox, we ran into a problem: instead of proper characters, we saw "mojibake" (Ð”Ð»Ñ etc.).
✅ Key Insight (and a common beginner mistake): This is an encoding issue with the .ps1 file. PowerShell expects a certain encoding (often UTF-8 with BOM), but the file might be saved in another (e.g., ANSI).
Solution: Always save your .ps1 files containing non-ASCII characters in UTF-8 with BOM (Byte Order Mark) encoding. Most code editors (VS Code, PowerShell ISE, Notepad++) allow you to do this.

What Did We End Up With?

We created a small but functional PowerShell script that:
Analyzes network listeners.
Checks the digital signatures of running processes.
Displays results in a user-friendly GUI.
Interactively offers the user to terminate processes with invalid signatures.

Considers the need for administrator privileges.

Lessons and Takeaways for Beginners:

Use PowerShell's Native Tools: Cmdlets that work with objects (Get-NetTCPConnection, Get-Process) are preferable to parsing text from external utilities.
Don't Be Afraid of .NET: PowerShell integrates beautifully with .NET, opening up vast possibilities (e.g., for GUI creation).
Handle Errors: try-catch blocks and proper use of -ErrorAction will make your script more robust.
Manage Resources: For GUI objects, don't forget Dispose().
Encodings – Your Friend (or Foe): Remember UTF-8 with BOM for files with international characters.
Iterative Development: Start small and gradually add functionality. Our script also went through several stages of improvement!

This project is an excellent example of how you can combine system administration, a bit of programming, and user interface creation with a powerful tool like PowerShell.
I hope this experience inspires you to create your own useful utilities! Experiment, learn, and share your successes.
Happy coding! 💻✨

Uber Taxi Idea for everything

mibii — Thu, 17 Apr 2025 12:48:59 +0000

Uber Taxi Idea for everything.
Do you have something to offer others, but still don't have your own website? Or you have a website or a page on a social network, but you need to increase the visibility of your offers.
The service https://infometka.com let your offers become more and more visible.
The idea of the service is to grow together, and not to create separate, disparate websites that each one has to promote separately to achieve visibility. Infometka on the map - it looks like your mini website on the Globe map. It will connect you with your customers (using a feedback form, links to your social networks, direct chat or bot)

Бесплатный стартовый веб-сайт, для потенциальных клиетов

mibii — Mon, 10 Mar 2025 07:48:10 +0000

В конкурентном мире фриланса, чтобы выделиться и создать лояльную клиентскую базу, требуется больше, чем просто качественное выполнение работы — это предложение реальной ценности с самого начала. Одна из эффективных стратегий — предоставить потенциальным клиентам бесплатный стартовый веб-сайт. Такой подход не только демонстрирует вашу приверженность их успеху, но и закладывает основу для будущего сотрудничества.

Вот как можно преподнести эту идею, чтобы привлечь клиентов, которым нужен сайт, но которые не знают, с чего начать:

Пример аргумента, который следует использовать, когда фрилансер обращается к потенциальным клиентам:

Возможно, вам нужен сайт, но вы не уверены, каким он должен быть. Это нормально, поэтому я сделаю для вас сайт — бесплатно — который просто станет отправной точкой, основой для дальнейшего совершенствования. Сайт, который вы сможете дальше развивать, с моей помощью или с помощью любого другого фрилансера, или даже самостоятельно.
Представьте, что вы получаете свой собственный сайт, который станет вашим собственным путем к новым знаниям и возможностям. Все начинается с желания что-то улучшить, с попыток узнать и понять — как это можно сделать? С помощью чего? Так вы узнаете новое, расширяете свой кругозор. К вам приходят новые идеи, открываются неожиданные перспективы.
Мы живем в то время, когда вопросы становятся важнее ответов. Возникновение вопросов порождает желание найти ответы, а это ведет к росту и развитию. Ваш сайт может стать катализатором этого процесса, помогая вам:

Лучше понять свой бизнес или проект
Найти новых клиентов и партнеров
Экспериментировать с новыми идеями
Учиться и развиваться в мире современных технологий.

Получив бесплатно первую версию сайта, вы, скорее всего, вернетесь ко мне за дальнейшими улучшениями или консультациями по мере развития ваших потребностей. В этот момент мы можем обсудить небольшое вознаграждение за мои постоянные услуги.
Не упустите шанс начать это захватывающее путешествие. Давайте создадим для вас базовый сайт, который станет основой вашего присутствия в Интернете. А затем вместе мы улучшим его, адаптируем к вашим растущим потребностям и целям. Помните, каждый великий проект начинается с маленького шага. Сделайте этот шаг сегодня — свяжитесь со мной, и давайте воплотим ваши идеи в реальность!"

Помогаю своим клиентам продвигать их новый веб-сайт

Вы работаете над веб-сайтом для своих клиентов? Вот дополнительный способ добавить ценность: как только сайт будет готов, предложите своему клиенту возможность разместить информацию о нем на https://infometka.com/. (это совершенно бесплатно). К этому моменту клиент начнет продвигать свой новый сайт и свой бизнес. (это веская причина — клиент не просто получает свой собственный новый сайт, но и начинает бесплатное продвижение)
Эта услуга позволяет любому человеку — будь то стационарный бизнес, например кафе, или предлагающий мобильные услуги, например такси или ремонт дома, — оказаться на карте. Таким образом, ваши клиенты начнут продвигать свой новый веб-сайт и бизнес, что даст им преимущество в охвате своей аудитории. Это беспроигрышный вариант, который может сделать ваше предложение еще более привлекательным.

Приняв этот подход, ориентированный на ценность, вы не только создаете доверие и взаимопонимание со своими клиентами, но и позиционируете себя как партнера в их долгосрочном успехе. Предложение бесплатного стартового сайта может привести к постоянной работе и рекомендациям, что делает его разумной стратегией на сегодняшнем рынке фриланса.

Удачи и счастливого фриланса!

The Most Honest Smart Contract: A Necessary Shift in Tokenization Draft

mibii — Tue, 11 Feb 2025 11:39:45 +0000

Why We Need a Truly Fair Smart Contract

Blockchain technology was meant to free financial systems from centralized control, but today’s token landscape tells a different story. Instead of decentralization, we see projects with hidden privileges, presales benefiting insiders, and distribution schemes designed to enrich a few at the expense of many.

We don’t need another blockchain—we need a smart contract that enforces fairness at the protocol level. A contract that ensures tokens are distributed openly, over time, and without any centralized control.

OpenZeppelin, the go-to library for smart contract templates, provides useful building blocks—but not moral safeguards. No existing template guarantees a fair, time-based distribution with no backdoors for the creator. That’s why this contract is necessary. It ensures that the token's value emerges from its broadest possible adoption, not from manipulation.

The Core Principles of the Most Honest Smart Contract

For a smart contract to be truly fair, it must adhere to the following principles:

Fixed Supply: The total number of tokens must be immutable from the moment of deployment.
Fair Distribution: should provide mechanisms to ensure broad and time-based token distribution.
No Special Preferences: The creator must have no special privileges, no reserved tokens, and no way to manipulate distribution.
No Post-Deployment Control: Once deployed, the contract must be self-executing, requiring no administrative intervention.
Time-Based Distribution: Tokens should be issued gradually over time to prevent early hoarding.
Open Access: Anyone should be able to claim tokens, ensuring the broadest possible distribution.

Why OpenZeppelin Falls Short

OpenZeppelin’s templates are designed for flexibility, not for enforcing fairness. Here’s why they don’t solve the problem:

No Built-in Fair Distribution: OpenZeppelin does not provide mechanisms to ensure broad and time-based token distribution.
These features reflect the industry’s priorities—control, not fairness. That’s why this contract is different. It isn’t just code; it’s a commitment to the principles that blockchain was meant to uphold.

Lessons from Bitcoin: Why Fairness Creates Value

Bitcoin is the ultimate proof that fairness leads to resilience. Its success was not driven by insider allocations or liquidity tricks—it thrived because its creator disappeared, leaving behind an immutable system.

This contract follows the same logic:

No Founder Control: The creator has no special privileges or allocation rights.
No Presale or Private Investors: Everyone starts on equal footing.
Automated, Transparent Distribution: Tokens are allocated based on a predictable and open mechanism, not hidden deals.
This is not just a technical challenge but a moral imperative. Let us build systems that future generations will recognize as fair—systems written not in ink, but in code.

The most honest token should be distributed freely, ensuring equitable access for all. Only through wide-reaching, fair distribution can a token acquire intrinsic value.

In essence, the ideal model resembles testnet faucets—dispensing tokens for testing and development—but with two critical distinctions: a strict cap on total supply and a carefully designed issuance mechanism. This approach ensures fairness, decentralization, and grassroots adoption.

Lets start this journey !

Let's return the words "decentralization" and "blockchain" to their true high meaning. And let's start creating something that, after its creation, works independently even from its creator. Fairest and Most Honest Token Smart Contract Project

Fairest and Most Honest Token Smart Contract

mibii — Wed, 05 Feb 2025 11:02:06 +0000

Lets start this journey !

Let's return the words decentralization and blockchain to their true high meaning.
And let's start creating something that, after its creation, works independently even from its creator.

https://most-honest-token.gitbook.io/honest-token

Develop THE MOST HONEST TOKEN, founded on fixed token emission and the fairest distribution algorithm imaginable.

Token Principles:

No presale, ICO, IDO, or private sale.

No allocations for the creator, developers, or investors.

No hidden reserves or special privileges for any address.

Distribution should be free, requiring only network gas fees.

No post-deployment control: contract is immutable once deployed.

Open-source and verifiable by anyone.

https://explorer.gitcoin.co/#/projects/0xc6ba6f3ab8448f15ba06aeec26fa65abef21f6356c940164f9d7b7673702e524