How to Scaffold, Audit & Manage AI Agent Rulebooks from the Terminal (npx devscratchpad)

Managing AI steering guidelines across multiple repositories is fast becoming a major operational challenge for engineering teams. Every AI assistant uses a different standard:

• Cursor IDE requires frontmatter-scoped .cursor/rules/*.mdc files.
• Claude Code expects procedural capability packages in .claude/skills/*/SKILL.md.
• Repository-wide steering uses root CLAUDE.md and AGENTS.md.
• Windsurf and GitHub Copilot have their own designated instruction paths.

When teams copy-paste prompts from outdated gists or chat sessions, rules rapidly drift, globs pollute context windows, and assistants start hallucinating deprecated APIs.

The DevScratchpad CLI (npx devscratchpad) eliminates manual prompt management with zero installation, zero npm dependencies, and 100% offline privacy.

INTERACTIVE TERMINAL SIMULATOR | Live Web Companion

Try the Headless Terminal AI Engine in Your Browser

Explore command execution, switch between 6 assistant formats and 8 technology presets, and test live terminal outputs directly on our dedicated CLI page.

Open CLI Terminal Simulator →

1. Quick Start: Zero-Install Terminal Execution

The devscratchpad CLI requires no global installation. You can run it instantly using your preferred package runner:

Installing Production Rulebooks

# Install Next.js 15 App Router rules for Cursor (.cursor/rules/nextjs-15.mdc)
npx devscratchpad add cursor-rules/nextjs-15

# Install FastAPI & Pydantic v2 skill for Claude Code (.claude/skills/fastapi/SKILL.md)
npx devscratchpad add fastapi -f claude-skills

# Install Tailwind CSS v4 rules for Windsurf
npx devscratchpad add tailwind-v4 -f windsurf

# Install strict TypeScript rules for GitHub Copilot
npx devscratchpad add typescript-strict -f copilot

Alternative Modern Runtimes

If your project uses pnpm or bun, devscratchpad works natively without extra configuration:

# Run with pnpm dlx
pnpm dlx devscratchpad add cursor-rules/react-19

# Run with bunx
bunx devscratchpad add docker-compose -f cursor-rules

2. Supported Formats and Directory Standards

DevScratchpad maps rules directly to standard repository paths:

3. Auditing Repository Rule Health (npx devscratchpad audit)

Writing rules is only half the battle; maintaining their quality is what prevents hallucinations.

Run the audit command in any project directory:

npx devscratchpad audit

The auditor inspects existing rule files and outputs a 0–100 health score evaluating:

1. Negative Boundary Guardrails: Does the rule state what the AI must never do? Without negative bounds ("Never use any", "Do not mutate props"), LLMs drift toward generic solutions.
2. Glob Precision: Are file attachments scoped (e.g. src/features/**/*.tsx) or broad catch-alls (**/*) that pollute token budgets?
3. Format Schema Compliance: Are required YAML frontmatter tags properly formatted and valid?

4. Scaffolding New Repositories (npx devscratchpad init)

When starting a fresh project, run:

npx devscratchpad init

This command scaffolds universal multi-agent starter guidelines:

• .cursor/rules/cursor-rules-pro.mdc: Scoped engineering principles and testing requirements.
• CLAUDE.md: Root invariant memory preventing hallucinations across Claude Code sessions.

5. How to Author Custom .md & SKILL.md Files

When creating custom rule files for proprietary tech stacks, follow these structural templates:

A. Cursor Rules (.cursor/rules/my-feature.mdc)

---
description: Coding standards and state management rules for User Authentication
globs: ["src/features/auth/**/*.ts", "src/features/auth/**/*.tsx"]
alwaysApply: false
---

# Authentication Architecture Rules

## Core Directives
- Use Zod schemas for all form validations.
- Store session tokens strictly in HttpOnly cookies.

## Critical Negative Guardrails
- NEVER store raw JWT tokens in browser localStorage or sessionStorage.
- NEVER export unvalidated auth state outside the AuthProvider context.

B. Claude Code Skill (.claude/skills/code-review/SKILL.md)

---
name: security-reviewer
description: Performs static security and dependency audits before creating pull requests.
---

# Security Review Protocol

## Trigger Procedures
When the user executes `/security-review` or asks for a security audit:
1. Scan git diff for exposed secrets, hardcoded API keys, and insecure endpoints.
2. Verify all database queries use parameterized SQL.
3. Check that input parameters pass strict boundary validation.

6. Under the Hood: 100% Local & Auditable Privacy

Most developer CLI tools secretly phone home with usage telemetry, machine IDs, and prompt contents.

DevScratchpad takes the opposite approach:

• Zero Runtime Dependencies: The package has 0 dependencies in package.json. It operates purely on native Node.js standard modules (node:fs, node:path, node:https).
• Zero Telemetry: No analytics, no prompt logging, no network transmission of your project code.
• Path Confinement: All file writes are strictly sandboxed within your project root to prevent path traversal.
• Dry-Run Inspection: Run with --dry-run to preview exact file writes before anything is touched on disk:

npx devscratchpad add cursor-rules/nextjs-15 --dry-run

Summary & Next Steps

Ready to test and configure your repository's AI rulebooks?

• 💻 Live Terminal Simulator: Visit devscratchpad.tech/cli to preview commands and directory structures.
• 🎨 Visual AI Skill Studio: Use the AI Skill Studio to visually customize rules, import manifests, and run one-click auto-fix linters.
• 📦 NPM Registry: Inspect the package at npmjs.com/package/devscratchpad.
• ⭐ GitHub Repository: Star and audit the open-source runner at github.com/Saad-web-spec/DevScratchPad.