/configure

name: configure
license: MIT
compatibility: "Claude Code 2.1.277+."
description: "Interactive wizard for OrchestKit settings: MCP servers, hook permissions, keybindings, presets. Use when customizing plugin behavior."
argument-hint: "[preset-name]"
context: inherit
user-invocable: false
allowed-tools: "Bash Read Grep Glob Edit Write AskUserQuestion"
effort: low
model: haiku
metadata:
  category: workflow-automation
  version: "1.0.1"
  author: "OrchestKit"
  complexity: "low"
  tags: "configuration, setup, wizard, customization"
paths: [".claude/**", "**/.claude/**"]

OrchestKit Configuration

Interactive setup for customizing your OrchestKit installation.

Quick Start

configure
configure mcp memory

Argument Resolution

PRESET = "$ARGUMENTS[0]"   # Optional preset name or subcommand, e.g., "mcp"
TARGET = "$ARGUMENTS[1]"   # Optional target, e.g., "memory"
# If no arguments, run interactive wizard.
# $ARGUMENTS is the full string (CC 2.1.59 indexed access)

Done means `~/.claude/plugins/orchestkit/config.json` is written, the user saw the Step 11 preview, and `/reload-plugins` was advised. Budget: at most one AskUserQuestion per step and 11 steps; stop and report at the finish line or the first cap, whichever comes first.

Step 1: Choose Preset

Use AskUserQuestion:

| Preset | Skills | Agents | Hooks | Description | |--------|--------|--------|-------|-------------| | **Complete** | all | all | all | Everything | | **Standard** | all | 0 | all | Skills, no agents | | **Lite** | 28 | 0 | all | Essential only (testing, security, planning) | | **Hooks-only** | 0 | 0 | all | Safety, productivity and team coordination hooks | | **Monorepo** | all | all | all | Complete + monorepo detection |

Live counts: run `claude plugin details ork` (107 skills, 36 agents on 2026-09-25).

Step 2: Customize Skill Categories

Categories available:

• AI/ML (28 skills)
• Backend (16 skills)
• Frontend (9 skills)
• Testing (14 skills)
• Security (7 skills)
• DevOps (5 skills)
• Planning (7 skills)
• Workflow (5 skills)

Step 3: Customize Agents

**Product Agents (2):**

• market-intelligence
• product-strategist

**Technical Agents (17):**

• backend-system-architect
• frontend-ui-developer
• database-engineer
• llm-integrator
• workflow-architect
• data-pipeline-engineer
• test-generator
• code-quality-reviewer
• security-auditor
• security-layer-auditor
• debug-investigator
• system-design-reviewer
• python-performance-engineer
• frontend-performance-engineer
• monitoring-engineer
• event-driven-architect
• infrastructure-architect

**Operations Agents (6):**

• ci-cd-engineer
• deployment-manager
• git-operations-engineer
• release-engineer
• ai-safety-auditor
• multimodal-specialist

**Research Agents (4):**

• web-research-analyst
• market-intelligence
• design-system-architect
• demo-producer

Step 4: Configure Hooks

**Safety (Always On):**

• operator `permissions.deny` rules (written by `/ork:setup`, enforced by Claude Code)
• network egress guard (DENY tier, inside the Bash dispatcher)
• secret handler (PostToolUse output scan; logs only by default, `ORK_SECRET_HOOK=REDACT` to redact)

**Toggleable Hooks:**

• Productivity (auto-approve, logging)
• Quality Gates (coverage, patterns)
• Team Coordination (locks, conflicts)
• Notifications (desktop, sound)

> **CC 2.1.49 Managed Settings:** OrchestKit ships plugin `settings.json` with default hook permissions. These are *managed defaults* — users can override them in project or user settings. Enterprise admins can lock managed settings via managed profiles.

> **CC 2.1.111 — prune overbroad Bash permissions:** Since 2.1.111, read-only Bash commands with glob patterns (`ls:*`, `head:*`, `grep:*`, `wc:*`, `find:*`, etc.) no longer trigger permission prompts by default. If your `.claude/settings.local.json` has explicit `Bash(ls:*)` / `Bash(grep:*)` style allows added to silence old prompts, they are now redundant. The built-in `/less-permission-prompts` skill scans your transcripts and proposes a prune diff — run it once per project and once per user profile, then commit the accepted subset. The committed OrchestKit `src/settings/ork.settings.json` is already minimal (allow = `Read`, `Glob`, `Grep`, a small set of MCP entries) and doesn't need changes.

> **CC 2.1.129 — `Bash(mkdir *)` / `Bash(touch *)` allow rules now work for in-project paths:** previously silently rejected for project-relative paths; now honored as documented. Workaround entries enumerating explicit subpaths (`Bash(mkdir:./src/*)`, etc.) can be collapsed back to the canonical glob form. See `references/cc-version-settings.md` § CC 2.1.129.

> **CC 2.1.157 — plugin auto-load + workflow-trigger control:** Plugins in `.claude/skills` auto-load (no marketplace required); `claude plugin init <name>` scaffolds one there. The "Workflow keyword trigger" toggle in `/config` — and pressing backspace right after the keyword — stops a bare "workflow"/"ultracode" from launching a dynamic workflow. `claude agents` honors the `agent` field in `settings.json`, with `--agent <name>` to override.

> **CC 2.1.160 — write prompts for startup files & build configs:** Expect approval prompts before Claude writes shell startup files (`.zshenv`/`.zlogin`/`.bash_login`, `~/.config/git/`) or — in `acceptEdits` mode — build-tool configs that grant code execution (`.npmrc`, `bunfig.toml`, `.bazelrc`, `.pre-commit-config.yaml`, `.devcontainer/`). These are security defaults; approve them deliberately, don't pre-allow.

> **CC 2.1.141 — `ANTHROPIC_WORKSPACE_ID` for workload identity federation:** When authenticating headless/CI agents (e.g. `ci-sentinel`, `bare-eval`) through Anthropic's WIF flow, set `ANTHROPIC_WORKSPACE_ID` to scope the minted token to one workspace when the federation rule covers more than one. Without it, a multi-workspace rule mints an unscoped token.

> **CC 2.1.142 — `MCP_TOOL_TIMEOUT` for remote MCP:** the per-request timeout now actually ap