CLAUDE.md Rules for Claude Code That You Can Check

A long list of preferences does not make Claude Code predictable. A useful project rule says what the agent may do, what it must avoid, and which command or diff proves the result. Put architecture notes in docs/; keep the project contract short.

Start with a small contract

# Project rules

## Goal
- Keep changes limited to the requested feature.

## Before editing
- Read package.json and the files named in the task.
- Do not read or print .env files.

## Checks
- Run `npm test` after code changes.
- Run `npm run lint` when TypeScript files change.
- Report each command, its exit code, and every changed file path.

## Scope and conflicts
- Rules in `packages/payments/CLAUDE.md` apply only under `packages/payments/`.
- Inside that directory, the local rule wins when it directly conflicts with this root file.
- Root security and secret-handling rules always apply.

## Forbidden
- Do not run deploy, publish, or destructive Git commands.

Each line has an observable result. “Write quality code” does not; “run npm test and report its exit code” does.

Separate goals, boundaries, checks, and style

Use a goal for the requested outcome, a boundary for files or commands that are off limits, a check for a reproducible command, and a style rule only when it affects review. If a command is not present in package.json, do not invent it. Move long explanations and exception lists to documentation with a link from CLAUDE.md.

Keep secrets out

CLAUDE.md is part of the repository and is read with the project. Never put API keys, CI tokens, real personal data, or copied API responses in it. State the boundary instead:

- Never open, print, or commit `.env`, `*.pem`, or `secrets/`.
- Use `API_KEY=your_api_key_here` in examples.

Pass a real key through an environment or secret store when a test needs one. Do not paste it into a prompt or handoff.

Resolve scope and conflicts

Keep repository-wide rules in the root file and package-specific rules close to the package. When two files disagree, inspect the instructions visible to the target file, remove the duplicate, and keep the narrower rule local. Do not add another paragraph to hide a conflict.

Test one rule on a reversible task

Test one rule with a reversible task:

1. Ask Claude Code to rename one local variable in a test file.
2. Run git diff --check and inspect git diff --stat.
3. Execute the test command from CLAUDE.md.
4. Reject the result if another file changed or the command was not run. This isolates the rule from a large project plan.

Connect the API workflow without mixing secrets

For Claude Code API work, use your own key and check the current Base URL and model in BetterToken’s Claude Code documentation. BetterToken provides API access and usage data; it does not turn CLAUDE.md into a secret store or replace Claude Code settings.

Sources

• Claude Code memory
• BetterToken Claude Code documentation

---

Originally published on the BetterToken blog.

BetterToken provides pay-as-you-go access to AI model APIs through
OpenAI-compatible and Anthropic-compatible endpoints — useful if you are wiring
Claude Code, Codex, or your own tooling to a custom base URL.
See the docs to get started.