Scattered knowledge
Build a predictable documentation tree for system facts, decisions, test evidence, operations, proposals, and archives.
Evidence over assumptions
Explicit actions only
Context loaded on demand
Human-readable outputs
The problem → the outcome
Turn scattered project knowledge into records a team can inspect.
Missing setup notes, stale decisions, and inconsistent reviews create uncertainty. The kit gives those concerns a stable home, a focused check, and an explicit evidence trail.
Silent documentation drift
Check required files, placeholders, headings, metadata, and local links. A structural pass never claims the prose is factually correct.
Inconsistent quality reviews
Use stable control and practice IDs to record evidence, ownership, remediation, verification, and limitations.
How it works
Inspect → choose scope → collect evidence → keep a record.
The CLI creates files and runs documentation structure checks. A human or authorized AI-assisted workflow investigates security and engineering questions.
- 01
Inspect context
Read repository instructions and locate the code, configuration, tests, and records that can answer the question.
- 02
Choose one scope
Select a documentation area, security phase, or engineering topic. Define exclusions before the review grows.
- 03
Collect evidence
Use repository paths, command output, metrics, or observations from an explicitly authorized environment. Separate facts from inference.
- 04
Keep a durable record
Record status, impact, remediation, owner, verification, and limitations in the project. A generated worksheet begins Unverified.
Three jobs, clear boundaries
Choose the workflow that matches the work.
The catalog contains seven documentation areas, 12 security phases, and 14 engineering topics. These are selectable guidance areas, not 33 automatic scans.
01 / Documentation
Maintain project memory with every material change.
Setup supplies an agent policy and manual impact loop; checks cover required files, placeholders, headings, metadata, and local links.
Read purpose and boundariesWhat it does
Creates a navigable project record, guides compatible agents to update affected records, and reports structural issues with actionable paths.
What it does not do
The instruction file does not run an agent, and a structural pass does not prove statements are true or current.
Example output
PASS required-document docs/README.mdPersist text, Markdown, or JSON reports only when --report is explicit.
02 / Security
After documentation setup, create a scoped worksheet and record evidence.
Capture risk, remediation, owner, and verification for each applicable control.
Review the security modelWhat it does
Supplies stable controls and an evidence-first status model for a bounded review.
What it does not do
Worksheet creation is not a vulnerability scan, security certification, or authorization to test a target.
Example output
PassFailUnverifiedN/A
A policy can require a blocking decision; enforcement needs an explicit CI or release control.
03 / Engineering
After documentation setup, review design and operations against evidence.
Topics cover testing, performance, reliability, APIs, maintenance, deployment, observability, and cost.
Explore the toolkit architectureWhat it does
Creates guidance and a durable record of observed practices, impact, and recommendations.
What it does not do
Recommendations are advisory unless separately enforced or supported by a demonstrated defect.
Example output
AppliedPartialRecommendedUnverifiedN/A
Fresh worksheets start Unverified rather than claiming an implementation exists.
Sanitized, reproducible example
See what changes in a disposable fictional repository.
The paths and formats below match the current CLI. They are samples, not claims about a real project.
No Agent Docs workspace
sample-app/
├─ package.json
├─ src/
└─ tests/Real generated paths
AGENTS.md
CLAUDE.md
GEMINI.md
.agent-docs/config.json
.agents/skills/manage-project-quality/
.claude/skills/manage-project-quality/
docs/README.md
docs/01-system/overview.md
docs/02-project/README.md
docs/03-development/engineering-reviews/
docs/04-testing/security-audits/
docs/05-operations/README.mdPlain setup writes the same paths without the agent files or skill. Add them later with setup --agents all.
A real structural result shape
# Documentation audit
- Result: FAIL
| Status | Rule | Path | Detail |
| FAIL | broken-link | docs/README.md | Missing target: setup.md |Fix the link and rerun; a saved failure does not advance next.
No invented pass
| Control ID | Priority | Status | Evidence | Remediation | Owner | Verification |
| Add each applicable control | Medium | Unverified | File/line, command output, or approved observation | Required follow-up | Unassigned | Not verified |A recommendation is not an implementation
| Practice ID | Status | Evidence | Impact | Recommendation | Owner | Verification |
| ENG-08-01 | Recommended | API tests only; UI flow untested | Regression risk | Add one browser smoke test | Alex | Run in CI |Fictional, manually reviewed evidence sample; the CLI did not automatically apply the recommendation.
Safe first run
Inspect first. Write only after you choose to.
Requires Node.js 22+ and npm. npx avoids a global install, but it may download and cache the package from npm and may prompt before execution.
Step 01
Check local prerequisites
These commands do not change the target project.
node --version
npm --versionInspect paths and preview files
Running through npx can access the npm registry, but these CLI actions do not write target-project files.
- Inspect onboarding pathsNew, existing, AI-assisted, and manual options.
npx @ghostbyte/agent-docs-kit@latest start - Preview owned setup filesReview every planned path before writing.
npx @ghostbyte/agent-docs-kit@latest setup --dry-run
Set up only after review
Try this in an empty or disposable repository first. Existing files are skipped unless --force is explicit.
- Create the reviewed scaffoldThis is the first command here that writes target-project files.
npx @ghostbyte/agent-docs-kit@latest setup - Check the next action
nextis read-only and evaluates project evidence.npx @ghostbyte/agent-docs-kit@latest next
AI-first documentation
Repository instructions, not a built-in model.
The workflow is designed primarily for compatible AI coding agents, while remaining usable manually. Setup creates AGENTS.md only when absent; the package does not bundle an AI model or background process.
Agent required for agent-assisted updates
Initialize documentation, agent files, and the skill together.
npx @ghostbyte/agent-docs-kit@latest setup --aiCreates the documentation scaffold, AGENTS.md, thin CLAUDE.md and GEMINI.md files that import it, and the project skill. Open or restart a compatible agent so it discovers them. Provider support varies; the same impact loop remains available manually.
Preview first (writes nothing)
npx @ghostbyte/agent-docs-kit@latest setup --dry-run --aiExisting agent files: An existing AGENTS.md, CLAUDE.md, or GEMINI.md is never replaced, even with --force. If one lacks the import line, the CLI prints the single @AGENTS.md line to add. The skill is a copy committed to your repository, and next warns when it is older than the installed CLI.
New versus existing projects: Choose start new or start existing; the CLI does not guess project maturity or whether an agent is running. Setup creates AGENTS.md when absent, preserves an existing one exactly, and leaves unrelated repository skills untouched.
Suggested prompt
Use $manage-project-quality. Inspect this repository, determine the current Agent Docs stage, and guide me through the next safe step. Do not infer facts without evidence.Read-only commit or push reminder
npx @ghostbyte/agent-docs-kit@latest suggest reviews --staged
npx @ghostbyte/agent-docs-kit@latest suggest reviews --base origin/mainGit integration: The suggestion command prints documentation confirmation and path-based review candidates but creates no worksheet. Teams may call it from an explicitly managed hook or CI job. The package never silently installs hooks, changes Git configuration, or blocks a commit or push.
Private repositories: Sending code to an AI provider can transfer it under that provider's terms and organization settings. Installing this package is not approval to share private code, credentials, personal data, or vulnerability evidence.
Trust and limitations
Useful automation without hidden authority.
Inert installation
No install lifecycle hook changes a repository. Setup, reports, templates, and skill installation require explicit commands.
Local project files
The CLI has no project telemetry service. npm/npx and optional AI providers have their own data flows and policies.
Bounded security work
Worksheet creation runs no active scan. Testing a service or environment requires explicit authorization for the exact target.
Evidence-first status
Fresh findings start Unverified. Pass, Applied, and other conclusions require evidence, ownership, and a verification step.
Inside the package
A versioned library and durable output formats.
The same canonical catalog drives the CLI and progressive skill: seven documentation areas, 12 security phases, and 14 engineering topics with stable IDs.
Explicit commands
Guided paths, setup preview, change suggestions, structural audit, worksheets, templates, validation, and diagnostics.
Focused references
Load the selected area or topic rather than putting all 33 catalog areas into an agent's context.
Optional agent guidance
A repository-scoped router, protocols, evidence rules, report assets, and validator.
Project-owned records
Documentation, dated audits, review worksheets, decisions, runbooks, incidents, changes, and test evidence.
Command presentation
Use npx for discovery or a reviewed installation for repeated use.
Selecting a mode updates every marked command and its copy button. For automated team use, pin a package version.
How are you running it?
npx @ghostbyte/agent-docs-kit@latest start existing
npx @ghostbyte/agent-docs-kit@latest setup --dry-run
npx @ghostbyte/agent-docs-kit@latest setup --dry-run --ai
npx @ghostbyte/agent-docs-kit@latest audit documentation --strictnpx @ghostbyte/agent-docs-kit@latest list security
npx @ghostbyte/agent-docs-kit@latest security worksheet api-layer --style learningnpx @ghostbyte/agent-docs-kit@latest list engineering
npx @ghostbyte/agent-docs-kit@latest engineering worksheet testing-typesnpx @ghostbyte/agent-docs-kit@latest skill install --target project
# Creates:
# .agents/skills/manage-project-quality
# Per-agent project target, where the tool documents one:
npx @ghostbyte/agent-docs-kit@latest skill install --target claude
# Creates:
# .claude/skills/manage-project-qualityCLI reference
Know what writes before you run it.
--dry-run previews supported writes. --force can replace only files owned by the selected command; it does not make every repository file writable.
Open the guided menu
In a non-interactive shell, prints help instead of waiting for input.
Choose an onboarding path
Explains ordered steps and safety boundaries without changing project files.
Continue from project evidence
Evaluates configuration, required documents, prompts, the latest applicable audit result, and worksheets. It never writes files.
Create the documentation scaffold and agent policy
Use setup --dry-run first. Existing files are skipped unless --force is explicit; an existing root AGENTS.md is always preserved.
Set up documentation, agent files, and the project skill together
Preview with setup --dry-run --ai. Writes only inside the project. Use --agents claude,gemini to create only some pointer files, or --agents auto for the tools this repository already shows signs of using.
Suggest focused reviews from Git changes
Prints matched paths, reasons, and optional worksheet commands. It does not create a report, perform an audit, or prove that unmatched changes are safe.
Run documentation structure checks
Checks configured files, placeholders, headings, metadata, and local links. It writes only when --report is supplied.
Browse documentation guidance
Lists all seven areas or prints one focused reference.
Create a security worksheet
Requires initialized documentation, then creates an Unverified scoped record. The v4 audit security form remains an alias.
Create an engineering worksheet
Requires initialized documentation, then creates an Unverified review record. The v4 review engineering form remains an alias.
List or create durable records
Available templates cover ADRs, runbooks, changes, incidents, and test evidence. Creation is collision-safe.
Install the optional repository skill
Copies the owned skill into .agents/skills/. Preview with --dry-run.
Validate content or prerequisites
Checks the distributed catalog or reports local Node.js and Git availability.
Open the canonical website
Opens https://agent-docs-kit.ghostbyte1014.workers.dev/ and prints it as a fallback.
Inspect commands and version
Use these before following guidance written for a different release.