Trail of Bits Claude Code Config

Trail of Bits Claude Code Config

Opinionated defaults, documentation, and workflows for Claude Code at Trail of Bits. Covers sandboxing, permissions, hooks, skills, MCP servers, and usage patterns we've found effective across security audits, development, and research.
Also see: skills · skills-curated · claude-code-devcontainer · dropkit

First-time setup:

Then inside the session, run /trailofbits:config. It walks you through installing each component, detects what you already have, and self-installs the command so future runs work from any directory. Run /trailofbits:config again after updates.

Contents

Getting Started
- Read These First
- Prerequisites
- Shell Setup
- Settings
- Global CLAUDE.md

Configuration
- Sandboxing
- Hooks
- Plugins and Skills
- MCP Servers
- Local Models
- Personalization

Usage
- Continuous Improvement
- Project-level CLAUDE.md
- Context Management
- Web Browsing
- Fast Mode
- Commands
- Writing Skills and Agents
- Recommended Skills
- Recommended MCP Servers

Getting Started

Read These First

Before configuring anything, read these to understand the context for why this setup works the way it does:

- Best practices for Claude Code -- Anthropic's official guide to working effectively with Claude Code
- Here's how I use LLMs to help me write code -- Simon Willison on practical LLM-assisted coding techniques
- AI-assisted coding for teams that can't get away with vibes -- Nilenso's playbook for teams integrating AI tools with high standards
- My AI Skeptic Friends Are All Nuts -- Thomas Ptacek on why dismissing LLMs for coding is a mistake
- Harness engineering -- OpenAI on building a product with zero manually-written code

Prerequisites

Terminal: Ghostty

Use Ghostty. It's the best terminal for Claude Code because it uses native…