title: "Claude Code Ultimate Guide — For Developers" description: "The complete developer guide to Claude Code: mental models, security, methodologies, and production patterns, distilled into a learning path." section: "roles" readTime: "20 min"

Claude Code Ultimate Guide

6 months of daily practice distilled into a guide that teaches you the WHY, not just the what. From core concepts to production security, you learn to design your own agentic workflows instead of copy-pasting configs.

Choose Your Path

🎯 What You'll Learn

This guide teaches you to think differently about AI-assisted development:

• ✅ Understand trade-offs — When to use subagents vs skills vs hooks (not just how to configure them). Custom commands are now part of skills
• ✅ Build mental models — How Claude Code works internally (architecture, context flow, tool orchestration)
• ✅ Visualize concepts — Mermaid diagrams in the companion repo covering model selection, master loop, memory hierarchy, multi-agent patterns, security threats, AI fluency paths
• ✅ Master methodologies — TDD, SDD, BDD with AI collaboration (not just templates)
• ✅ Security mindset — Threat modeling for AI systems (prompt injection, MCP and skill supply chain, permission design)
• ✅ Test your knowledge — a companion quiz to validate understanding

Outcome: Go from copy-pasting configs to designing your own agentic workflows with confidence.

⚡ Quick Start

Quickest path: Cheat Sheet — 1 printable page with daily essentials

Interactive onboarding (no setup needed):

claude "Fetch and follow the onboarding instructions from:
https://raw.githubusercontent.com/FlorianBruniaux/claude-code-ultimate-guide/main/tools/onboarding-prompt.md"

Browse directly: Full Guide | Visual Diagrams | Examples | Quiz

🔑 Golden Rules

1. Verify Trust Before Use

AI-generated code can contain subtle logic errors, wrong assumptions, and invented APIs. Every output must be verified. Give Claude a way to check its own work (tests, a linter, expected output), then review the diff yourself. /insights is not a verification tool: it writes a report about how you use Claude Code.

Strategy: Solo dev (verify logic + edge cases). Team (systematic peer review). Production (mandatory gating tests in CI).

2. Never Approve MCPs from Unknown Sources

MCP servers, plugins, and skills run with your permissions and can read or write your codebase. Anthropic reviews directory connectors against listing criteria but does not security-audit or manage any MCP server.

Strategy: Systematic audit (5-min checklist). Review .mcp.json changes in PRs. Restrict servers with managed MCP configuration. Vetting workflow documented in guide.

3. Context Pressure Changes Behavior

Claude Code sends the whole conversation with each request, and long sessions get less precise and cost more. Watch context with /context or your status line. Exact degradation thresholds vary by model and task, so treat any fixed percentage as a rule of thumb.

Strategy: Run /clear between unrelated tasks, /compact [focus] to summarize long ones, delegate verbose work to subagents, and let auto-compaction handle the rest.

4. Start Simple, Scale Smart

Start with a basic CLAUDE.md (draft it with /init) and a few skills. Test in production for 2 weeks. Add subagents, hooks, and MCP servers only if the need is proven.

Strategy: Phase 1 (basic CLAUDE.md). Phase 2 (skills + hooks if needed). Phase 3 (subagents if multi-context). Phase 4 (MCP servers if truly required). Remember: CLAUDE.md is guidance. Enforce rules with permissions, hooks, or managed settings.

5. Methodologies Matter More with AI

TDD/SDD/BDD are not optional with Claude Code. AI accelerates bad code as much as good code.

Strategy: TDD (critical logic). SDD (architecture upfront). BDD (PM/dev collaboration). GSD (throwaway prototypes).

Quick Reference

🎯 Learning Paths

Junior Developer — Foundation (7 steps)

1. Quick Start — Install & first workflow
2. Essential Commands — The 7 commands
3. Context Management — Critical concept
4. Memory Files — Your first CLAUDE.md
5. Learning with AI — Use AI without becoming dependent ⭐
6. TDD Workflow — Test-first development
7. Cheat Sheet — Print this

Senior Developer — Intermediate (6 steps)

1. Core Concepts — Mental model
2. Plan Mode — Safe exploration (Shift+Tab, or claude --permission-mode plan)
3. Methodologies — TDD, SDD, BDD reference
4. Agents — Custom subagents (.claude/agents/*.md, with a tools: allowlist)
5. Hooks — Event automation
6. CI/CD Integration — Pipelines

Power User — Comprehensive (8 steps)

1. Complete Guide — End-to-end
2. Architecture — How Claude Code works
3. Security Hardening — MCP vetting, injection defense
4. MCP Servers — Extended capabilities
5. Trinity Pattern — Advanced workflows
6. Observability — Monitor costs & sessions
7. Agent Teams — Multi-agent coordination
8. Examples — Production templates

Progressive Journey

• Week 1: Foundations (install, CLAUDE.md, first agent)
• Week 2: Core Features (skills, hooks, trust calibration)
• Week 3: Advanced (MCP servers, methodologies)
• Month 2+: Production mastery (CI/CD, observability)

📚 What's Inside

Core Documentation

Examples Library (community templates)

Subagents: code-reviewer, test-writer, security-auditor, refactoring-specialist, devops-sre...

Commands / skills: /pr, /commit, /release-notes, /diagnose, /refactor, /explain... (custom commands are now skills; legacy .claude/commands/*.md files still work, and a skill with the same name wins)

Security hooks: dangerous-actions blocker, prompt-injection detector, unicode-injection scanner, output secrets scanner...

Template counts in the repo change often. Audit any third-party hook or skill before you install it. Templates may predate current Claude Code behavior; compare against the official docs.

Browse Complete Catalog →

Knowledge Quiz

Test your Claude Code knowledge covering all guide sections, with profiles for Junior, Senior, Power User, and PM, immediate feedback with doc links, and weak-area tracking.

Try Quiz Online →

🔧 Rate Limits & Cost Control

Claude Code usage is covered by plan limits (Pro, Max, Team, Enterprise: a rolling five-hour window plus a weekly window) or billed per token on the Console and cloud providers. Official levers, from the costs page:

• /usage shows plan usage bars and what consumed them (skills, subagents, plugins, MCP servers)
• /clear between tasks; /compact with focus instructions on long ones
• /model and /effort to match model and thinking effort to the task (Sonnet 5.5 or Haiku 5.5 for routine work, Opus 5.5 for hard problems)
• /usage-credits to continue past a plan limit where usage credits are enabled
• Non-interactive runs: claude -p --max-turns 5 --max-budget-usd 2.00 "..."

Third-party proxies that route Claude Code through other providers' subscriptions are unofficial. Check the terms of every service involved before using one.

🛡️ Security

Threat Categories

Read the official security page and this site's Security guide. Vulnerability counts in third-party databases vary by methodology and are not reproduced here.

Security Hardening Guide →

MCP Vetting Workflow

Systematic evaluation before trusting MCP servers:

1. Provenance: GitHub verified, 100+ stars, active maintenance
2. Code Review: Minimal privileges, no obfuscation, open-source
3. Permissions: Whitelist-only filesystem access, network restrictions
4. Testing: Isolated Docker sandbox first, monitor tool calls
5. Monitoring: Session logs, error tracking, regular re-audits

🌍 Ecosystem

Complementary Resources

📄 License & Support

Guide: CC BY-SA 4.0 — Educational content is open for reuse with attribution.

Templates: CC0 1.0 — Copy-paste freely, no attribution needed.

Author: Florian Bruniaux | Founding Engineer @ Méthode Aristote

Stay Updated: Watch releases | Discussions | LinkedIn

Version 3.38.1 | Updated daily · Mar 31, 2026 | Crafted with Claude