DEV Community

Cover image for Claude config: rules and guardrails for Claude Code on .NET + Angular projects
Angelo Pirola
Angelo Pirola

Posted on Edited on

Claude config: rules and guardrails for Claude Code on .NET + Angular projects

#claude #dotnet #angular #productivity

I work on .NET and Angular projects with Claude Code, and I kept rewriting the same setup instructions for each new project. To stop doing that, I built claude-config: a public template of rules, plus a small Claude Code plugin that enforces the most important of them.

This is my own opinionated approach, not a universal standard. Treat the rules as a starting point, and check the details against the documentation of the versions you use.

What is in the repository

Claude Code loads .claude/rules/ automatically, so the rules are copied into each project, not installed globally.

Module When it loads What it covers
core.md always stack, tests, observability, Docker scope, interaction rules
git.md always branches, commits, release
security.md always authentication, secrets, input validation, CSP, supply chain, OWASP Top 10 2025, ASVS 5.0
frontend.md on *.ts, *.html, *.css, *.scss Angular
backend.md, backend-architecture.md, backend-app.md on C# and project files .NET
docker.md Dockerfiles and Compose files containers

Optional modules (email, infrastructure, feature workflow) live in .claude/rules-optional/ and are enabled per project. The rules are written in Italian; code, identifiers and commit messages stay in English.

Rules that do most of the work

Five rules in core.md carry most of the weight:

  • Ask one question at a time and wait for the answer.
  • Local commits only by default. Pushes, pull requests, tags and releases need an explicit approval, recorded per project in CLAUDE.md.
  • Write a plan file before any substantial work, then execute it step by step. A step is ticked only after build and tests pass.
  • Check the documentation of the installed version of fast-moving libraries, instead of relying on memory.
  • Build and test before declaring work done, and report any error as it is.

The plugin: kit

Written rules are advisory, so the plugin turns the most important ones into hooks:

  • a one-question reminder on every prompt, and a check that allows only one question per AskUserQuestion call;
  • a shell-command guard that always blocks git init, force pushes, deleting remote branches, git reset --hard, git clean -f, --no-verify and forced recursive deletes. Pushes, tag creation, gh pr create/merge and gh release stay blocked until the project approves them. Read-only commands such as git status, git log and gh pr view remain allowed;
  • a guard on secrets and on unsafe patterns in the files Claude writes;
  • quality checks on Docker, dependencies and frontend code;
  • a session-start hook that supplies the plan and the rules to re-read;
  • a watcher that detects rule changes during a session, and drift from the template.

The plugin was renamed from kit-config to kit in November 2026, so that its commands can be exposed under the /kit: prefix. Install it once per machine:

claude plugin marketplace add AngeloDotNet/claude-config
claude plugin install kit@claude-config
Enter fullscreen mode Exit fullscreen mode

If you installed the earlier kit-config plugin, install kit as above, remove kit-config, and restart Claude Code, because hooks are loaded when the session starts.

The current version is 1.8.0. The version changes only at a release.

Using it in a project

There are three situations:

  1. New project: copy the rules and the CLAUDE.md template, fill in the project fields, then ask Claude to start the project.
  2. Existing project without rules: use the "Git only" mode, which keeps only the core and git modules.
  3. Existing project with rules: update them to the latest template version.

Project-specific choices (architecture, ORM, database, multi-tenancy, ASVS level) are asked for and recorded once in CLAUDE.md. They are not assumed. The copia-regole.bat script copies the rules and root files, and it can update the rules already present.

Caveats

Some details are not verified yet, for example the PostgreSQL row-level security syntax and the passkey support in ASP.NET Core Identity on .NET 10. The notes in the template's changelog say which ones.

Links

Top comments (0)