Claude Code: cheat sheet

All commands, flags, files and configs on a single page. Bookmark it.

Install

# macOS / Linux / WSL
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# macOS - Homebrew
brew install --cask claude-code

# Windows - WinGet
winget install Anthropic.ClaudeCode

The old npm install -g @anthropic/claude-code is deprecated.

CLI flags

Slash commands (in-session)

Bundled skills

Hotkeys

Files and folders

project/
├── CLAUDE.md                       # project context (stack, commands, rules)
├── .claude/
│   ├── settings.json               # permissions, hooks (project-scoped)
│   ├── settings.local.json         # personal settings (gitignored)
│   ├── skills/<name>/SKILL.md      # your own /commands
│   ├── commands/<name>.md          # old skill format (backward compat)
│   └── agents/<name>.md            # your own subagents
├── .mcp.json                       # MCP servers (project scope)
└── .env                            # MCP secrets (gitignored)

~/.claude/
├── settings.json                   # global settings
├── skills/<name>/SKILL.md          # global skills
├── agents/<name>.md                # global subagents
└── .claude.json                    # MCP local/user scope

CLAUDE.md - minimum

# Project

One-liner description.

## Stack
- Next.js 15, TypeScript, Prisma, Tailwind

## Commands
- `npm run dev` - dev server
- `npm run test` - tests
- `npm run lint` - linter

## Rules
- No `any` in TS
- Conventional Commits
- Don't touch `src/generated/`

.claude/settings.json - permissions

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git diff *)",
      "Bash(git status)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push *)",
      "WebFetch(*)"
    ]
  }
}

Rule shape: Tool(specifier) - Bash(npm run *), Read(./.env), Edit(./src/**), WebFetch(domain:example.com), Skill(my-skill). deny wins over allow.

SKILL.md - frontmatter

---
name: review
description: Code review of changes against project standards   # ≤1024 chars, model decides
allowed-tools: Read, Bash                                       # restrict tools
argument-hint: "[path or empty]"                                 # hint for $ARGUMENTS
effort: medium                                                   # low / medium / high / xhigh / max
context: fork                                                    # run in a subagent
user-invocable: true                                             # available via /name
disable-model-invocation: false                                  # model auto-invocation allowed
model: opus                                                      # model for this skill
agent: Explore                                                   # subagent type (if context: fork)
paths: ["src/**/*.ts"]                                           # activate by paths
shell: bash                                                      # bash / powershell
when_to_use: "when editing TS files"                              # hint for the model
hooks: { ... }                                                   # skill-local hooks
---

Body - instructions for the agent in plain Markdown.
$ARGUMENTS - substituted from /name <args>

Subagent - .claude/agents/<name>.md

---
name: security-reviewer
description: Audit for vulnerabilities - injection, leaks, unsafe deps
model: opus
tools: Read, Grep, Bash
---

Review the changes for vulnerabilities. Return findings with file and line.

Invoke manually via /agents or let Claude auto-delegate by description.

MCP - claude mcp add

# Local (stdio) - options come BEFORE the name, the command is separated by `--`
claude mcp add --transport stdio <name> -- npx -y <package> [args]

# Remote (HTTP)
claude mcp add --transport http <name> <url>

# Scope: local (default), project (→ .mcp.json), user (shared)
claude mcp add --scope project --transport stdio postgres -- npx -y @modelcontextprotocol/server-postgres

# HTTP auth
claude mcp add --transport http github https://api.githubcopilot.com/mcp/ \
  --header "Authorization: Bearer ${GITHUB_TOKEN}"

claude mcp list             # all servers
claude mcp get <name>       # details
claude mcp remove <name>    # remove
claude mcp logs <name>      # logs (if something's broken)

In session: /mcp - list of available tools.

.mcp.json - example

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": { "Authorization": "Bearer ${GITHUB_TOKEN}" }
    },
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": { "POSTGRES_CONNECTION_STRING": "${DATABASE_URL}" }
    }
  }
}

Hooks - events

In .claude/settings.json:

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "npm run lint -- --fix" }]
    }]
  }
}

Plugins and marketplaces

# Add a marketplace
/plugin marketplace add owner/repo

# Install a plugin
/plugin install <name>@<marketplace>

Skills from a plugin are invoked with a prefix: /plugin-name:skill-name. The official marketplace claude-plugins-official is available out of the box.

SDK for your own workflows

# TypeScript / JS
npm install @anthropic-ai/claude-agent-sdk

# Python
pip install claude-agent-sdk

import { query } from "@anthropic-ai/claude-agent-sdk";

const result = await query({
  prompt: "Find all TODOs",
  options: { maxTurns: 10, cwd: "/path/to/project" },
});
for await (const m of result) console.log(m);

Deeper dives

• Install and basic setup
• Skills - your own /commands
• Agents and SDK
• MCP - external tools
• Build your own MCP server