Building a Serious AI Engineering Workflow with Claude Code

How I turned Claude Code from an AI coding assistant into a more disciplined software engineering workflow.

AI coding assistants are getting remarkably good.

Give Claude a feature request and it can inspect a codebase, write code, modify files, run tests, and even fix the errors it encounters.

But there is a problem.

Writing code is not the same thing as engineering software.

The difficult part of software development isn't always producing the code. It's understanding ambiguous requirements, choosing the right architecture, checking assumptions against current documentation, writing useful tests, reviewing security implications, and making sure the final implementation actually solves the problem.

That's why I've been experimenting with the growing ecosystem around Claude Code.

Instead of installing every AI skill I can find, I wanted a smaller, deliberate stack: a workflow layer, a documentation layer, a security layer, a few specialized agents, and an optional autonomous loop.

This is the setup I've settled on.

The Goal

My goal isn't to make Claude write more code.

It's to make Claude behave more like a disciplined software engineer.

The workflow I want looks roughly like this:

Each component has a different responsibility.

Layer	Tool	Purpose
Workflow	Superpowers	Structured software development
Documentation	Context7	Current library/framework documentation
Security	Security Guidance	Automated security checks
Specialists	Everything Claude Code	Planning, TDD, review, E2E, etc.
Autonomous execution	Ralph	Repeated implementation/test/fix loops
Quality filter	AntiSlop	Reduce generic AI-generated output

The important part is that these tools are not all equally active all the time.

1. Start With Superpowers

If I could only install one thing, this would be it.

Superpowers on GitHub

Superpowers is an agentic software development methodology for Claude Code. Its current Claude Code integration includes skills and workflows around brainstorming, planning, TDD, debugging, collaboration, and execution.

The biggest difference is philosophical.

Instead of:

you get something closer to:

That is much closer to how I actually want an engineering team to work.

Install

Superpowers is currently available through Anthropic's official Claude Code plugin marketplace:

/plugin install superpowers@claude-plugins-official

The Superpowers project also maintains its own marketplace:

/plugin marketplace add obra/superpowers-marketplace
/plugin install superpowers@superpowers-marketplace

Both installation paths are documented by the project. I'd use the official Claude marketplace unless you specifically need the Superpowers marketplace.

Verify

After installation, try something like:

Help me plan a new authentication feature.

You should see Superpowers' workflow kick in rather than immediately jumping into implementation.

2. Give Claude Access to Current Documentation With Context7

One of the most annoying things about AI coding is this: "Claude knows the library."

Maybe. But does Claude know the version of the library I'm actually using today?

That's where Context7 comes in.

Context7 on GitHub

Context7 provides current, version-aware library documentation to coding agents. Its Claude Code integration can work through MCP or a CLI + skills setup.

For a backend-heavy stack, this is particularly useful. Instead of relying entirely on model memory, Claude can retrieve documentation for the actual library and version it needs.

Install

The simplest current setup is:

npx ctx7 setup --claude

The setup flow configures Context7 for Claude Code and lets you choose the integration mode.

Context7 also provides a dedicated Claude plugin:

claude plugin marketplace add upstash/context7
claude plugin install context7@context7-marketplace

The official documentation recommends using an API key for higher rate limits.

My rule for Claude

For unfamiliar or version-sensitive APIs:

Don't guess. Query the documentation.

Especially for frameworks, AWS SDKs, authentication libraries, ORM/database APIs, and rapidly changing tooling.

3. Put Security in the Default Workflow

This is the part I consider non-negotiable for production systems.

AI-generated code can look perfectly reasonable while introducing a subtle security vulnerability.

Anthropic's official Security Guidance plugin adds three layers of security review:

1. Pattern-based warnings during file edits
2. LLM-based diff review after Claude's turn
3. Agentic review during git commit

The review covers issues such as injection, XSS, SSRF, hardcoded secrets, IDOR, authentication bypasses, unsafe deserialization, and path traversal.

That makes it particularly interesting for fintech/backend systems.

Install

/plugin install security-guidance@claude-plugins-official

Current prerequisites include Claude Code CLI ≥ 2.1.144 and Python 3.8+ available on the PATH. The plugin works with the normal Claude Code API path and does not require additional configuration for its default behavior.

The important mental model

Don't think of security review as something you run at the end. Think of it as another engineering gate:

For sensitive code, I want Claude to actively ask:

• Where does this input come from?
• Can the caller access another user's resource?
• Can this parameter be manipulated?
• Is authentication actually enforced?
• Is authorization checked at the resource level?
• Can this endpoint be abused?
• Are secrets exposed?
• Is data flowing into an unsafe sink?

That is much more valuable than simply asking "Does this code look secure?"

4. Add Specialists With Everything Claude Code

Next comes Everything Claude Code, or ECC.

Everything Claude Code on GitHub

ECC is a large collection of agents, skills, commands, hooks, rules, and other Claude Code configuration. Its current agent catalog includes roles such as planner, architect, TDD guide, code reviewer, security reviewer, build-error resolver, and E2E runner.

But I would not blindly install and activate everything. That's one of the easiest ways to turn a clean Claude Code environment into a confusing pile of overlapping instructions.

Instead, I want ECC to act as a specialist toolbox. My shortlist:

Planner — Use for complex features and refactoring.

TDD Guide — Use for new features, bug fixes, and behavior changes. The goal is to force the implementation toward explicit tests instead of relying on "looks correct."

Code Reviewer — Run after meaningful code changes. Focus areas include correctness, maintainability, architecture, error handling, and unnecessary complexity.

Security Reviewer — Useful as a second security-oriented perspective for sensitive code.

Build Error Resolver — When TypeScript/build/type errors happen:

E2E Runner — Particularly useful for applications with critical browser-based flows. ECC explicitly documents E2E testing through Playwright.

Installing ECC

ECC can be installed as a Claude Code plugin:

/plugin marketplace add affaan-m/everything-claude-code
/plugin install everything-claude-code@everything-claude-code

The project also supports manual installation if you want finer control over which agents, skills, rules, and commands are copied into your Claude configuration.

For my workflow, the important point is: install ECC, but treat its components as a toolbox — not as another giant methodology layered over Superpowers.

Superpowers owns the workflow. ECC supplies specialists. That separation keeps things much cleaner.

5. Use Ralph When the Task Is Boring and Well Defined

Sometimes I don't need Claude to have a conversation with me. I just need it to keep working.

That's where Ralph becomes interesting.

Ralph on GitHub

Ralph is designed around an iterative development loop where work is described as a PRD/task set and the agent repeatedly implements, tests, and progresses through the work. The project provides Claude Code skills for generating PRDs and converting them into Ralph's task format.

The basic idea:

This is extremely useful for well-defined work. For example:

Add pagination to these five endpoints, update tests, update API documentation, and ensure all existing tests remain green.

That's a good candidate. But: "Redesign the payment architecture." Absolutely not. The second task requires human judgment, architecture discussion, trade-offs, and probably several rounds of clarification.

Install

Ralph provides a Claude Code marketplace:

/plugin marketplace add snarktank/ralph
/plugin install ralph-skills@ralph-marketplace

The current project exposes /prd and /ralph skills.

My rule: use Ralph for deterministic work. Use interactive Claude Code for ambiguous work.

6. Add AntiSlop — But Only Where It Helps

AI-generated code isn't the only thing that can feel artificial.

AI-generated UI can become: endless rounded cards, unnecessary gradients, generic hero sections, meaningless marketing copy, decorative components with no purpose.

That's what AntiSlop is designed to fight.

AntiSlop on GitHub

The current project describes itself as a filter rather than a style guide. It has a core filter plus task-specific skills for UI, copy, accessibility/human factors, mobile layout, and code comments.

For my setup, I would not load every AntiSlop skill globally. I'd use:

• UI work → antislop-ui
• Frontend copy → antislop-copywriting
• Accessibility → antislop-human
• Mobile → antislop-layoutmobile
• Code comments → antislop-code

The project documents these as additive skills that can be loaded according to the type of work being performed.

Install

Claude Code plugin:

/plugin marketplace add https://github.com/miqdadbadjuber/anti-slop
/plugin install antislop@anti-slop

Or use the interactive installer:

npx antislop-ai

The project currently supports both approaches.

7. What I'm Deliberately NOT Installing

This is just as important as what I'm installing.

BMAD — BMAD is a legitimate and interesting AI development framework. But I don't need another complete methodology on top of Superpowers. I'd rather have Superpowers + ECC specialists than Superpowers + ECC + BMAD + another workflow framework. More instructions don't automatically mean better engineering.

OpenSpec — OpenSpec is interesting when specification-driven development is the main bottleneck. I'd keep it as an option rather than adding it immediately. If requirements become increasingly complex or AI/human intent alignment becomes a recurring problem, then OpenSpec becomes much more interesting. But initially, Superpowers' brainstorming and planning workflow is enough for me.

Random Skill Marketplaces — This is probably the most important thing I learned while researching the ecosystem. Don't treat agent skills like harmless browser extensions. A skill can influence what an agent does, what tools it uses, what commands it runs, and what instructions it follows.

So I want to know:

• Who maintains it?
• Is the repository public?
• What does the SKILL.md actually contain?
• Does it execute scripts?
• Does it request shell access?
• Does it install additional dependencies?
• Does it modify my Claude configuration?
• Is the source pinned or mutable?

AntiSlop itself, for example, publishes a security policy explaining its behavior and the files it modifies. That's the level of transparency I want from an agent dependency.

8. My Final Claude Code Stack

After stripping away the duplicates, this is the setup I'd actually use:

The important distinction is:

• Always-on foundation — Superpowers, Context7, Security Guidance
• Specialists — ECC
• Optional execution mode — Ralph
• Task-specific quality filter — AntiSlop

This gives each tool a clear job.

9. My Daily Workflow

Once everything is installed, the workflow I want looks like this.

Step 1 — Start With the Problem

Instead of immediately saying "Create endpoint X," I give Claude the context:

We need to add X. Here is the business requirement. Here is the existing behavior. Here are the constraints. First understand the current implementation. Do not modify code yet.

Superpowers should help turn that into a clearer design and plan.

Step 2 — Verify External Knowledge

If the implementation depends on an external library:

Check the current documentation for the version we are using before proposing the implementation.

That's where Context7 becomes useful.

Step 3 — Plan

For anything non-trivial:

I want the plan to exist before the code.

Step 4 — Implement With TDD

For behavior changes:

This gives the agent something concrete to optimize against.

Step 5 — Review

After implementation:

This is where the ECC specialists and Security Guidance become useful.

Step 6 — Verify, Don't Trust

One of the most important rules for AI-assisted development:

Never accept "it should work" as evidence.

Ask Claude to show test results, build results, lint results, relevant command output, and E2E results when applicable. The agent should be able to demonstrate that the implementation works.

10. The Most Important File: CLAUDE.md

Even with all these plugins, one thing remains extremely important: your project's own instructions.

Plugins give Claude general capabilities. CLAUDE.md gives Claude your engineering context.

For example:

# Engineering Guidelines

## Stack
- Node.js >= 20
- TypeScript
- PostgreSQL
- Redis
- AWS
- Jest

## Architecture
- Controllers should remain thin.
- Business logic belongs in services.
- Database access belongs in repositories.
- Never access the database directly from controllers.

## Security
- Never hardcode secrets.
- Validate all external input.
- Always enforce authorization at the resource level.
- Never log PII or authentication credentials.
- Use parameterized queries.

## Testing
- New business behavior requires tests.
- Bug fixes should include regression tests.
- Run the relevant test suite before declaring completion.

## Pull Requests
Before considering a task complete:
1. Run tests.
2. Run type checking.
3. Run linting.
4. Review the diff.
5. Perform security review for sensitive changes.

This is arguably more valuable than adding another random skill.

11. The Architecture I Actually Want

The key isn't having seven AI tools. It's giving each one a clearly defined responsibility.

And when the work is sufficiently deterministic:

12. Final Takeaway

The AI coding ecosystem is moving incredibly fast.

There are hundreds of skills, plugins, MCP servers, agents, frameworks, and autonomous coding loops appearing every month. It's tempting to install everything.

I think that's the wrong approach.

The better approach is to build an engineering system around the model. For me, that means:

• Superpowers for discipline.
• Context7 for knowledge.
• Security Guidance for guardrails.
• ECC for specialist capabilities.
• Ralph for autonomous execution.
• AntiSlop for output quality.

And most importantly: human judgment stays at the top of the system.

Claude can plan. Claude can code. Claude can test. Claude can review. Claude can even keep working autonomously.

But the goal isn't to remove the engineer from the loop. The goal is to make the engineer's time more valuable.

That's the difference between using Claude Code as an AI pair programmer and building an AI-assisted engineering workflow.

Quick Setup

For reference, this is the minimal setup I'd start with:

1. Superpowers

/plugin install superpowers@claude-plugins-official

2. Context7

npx ctx7 setup --claude

3. Security Guidance

/plugin install security-guidance@claude-plugins-official

4. ECC

/plugin marketplace add affaan-m/everything-claude-code
/plugin install everything-claude-code@everything-claude-code

Then selectively use its planner, TDD, review, security, build-error, and E2E capabilities rather than treating the entire repository as one mandatory workflow.

5. Ralph

/plugin marketplace add snarktank/ralph
/plugin install ralph-skills@ralph-marketplace

6. AntiSlop

/plugin marketplace add https://github.com/miqdadbadjuber/anti-slop
/plugin install antislop@anti-slop

Or:

npx antislop-ai

Don't install everything on day one. Start with the foundation, use it for a week, and add specialists when you encounter a real problem they solve.

That's how I want my Claude Code environment to evolve: less plugin collection, more engineering system.