thinkingraven/rookery

Claude Code · Codex · Cursor · GitHub Copilot · Gemini CLI · Windsurf · MCP · skillshare · npx skills
---
Every team ends up writing its own *review my PR*, *write a commit message* and *deploy to staging* skill: for Claude Code in one repo, Cursor in another, Copilot in a third. Nobody knows how many there are, which one is best, or which one quietly pipes environment variables to a webhook or tells the agent to skip approval prompts.
**rookery** gives you that picture in one command. It runs locally, takes about a second, and never uploads anything.
Quick start
Or install it: npm install -g @thinkingraven/rookery, then run rookery scan .. Node 20 or newer.
What you get
| | |
|---|---|
| **Inventory** | Every skill, command, subagent, rules file, settings file, hook and MCP server, with its agent, purpose and size in tokens. |
| **What teams keep building** | Artifacts grouped by purpose (code review, testing, commits, deployment…) and how many repos have one. A tall bar across many repos is your best candidate for one shared, reviewed skill. |
| **Near-duplicates** | Copy-pasted and lightly edited skills clustered across repos *and* across agents. A Cursor rule, a Claude skill and a Copilot prompt can be the same thing. |
| **Where skills come from** | Skills installed by skillshare or npx skills: the source repo and commit, which tools each one is linked into, and which ones were **edited since install**. Symlinks and synced copies count once, not as duplicates. |
| **Skill quality** | Whether an agent can find and use each skill: names and descriptions that break the Agent Skills format or an agent's limits, misspelled frontmatter fields that agents silently ignore, links to files the skill doesn't ship, and two skills fighting over one name. |
| **Security findings** | 25 static checks on skill text, bundled scripts and agent config: secrets, exfiltration, prompt injection, hidden Unicode, harness overrides, piped installs, risky hooks, broad permissions and MCP servers. |
Add --html report.html for a self-contained report you can send to your team:
What it finds
| Agent | Files |
|---|---|
| **Claude Code** | .claude/skills/*/SKILL.md, .claude/commands/, .claude/agents/, .claude/settings*.json (hooks, permissions), CLAUDE.md, .mcp.json, .claude-plugin/ |
| **Claude Code plugins** | every folder with .claude-plugin/plugin.json or listed in a marketplace.json: its agents/, commands/, hooks/hooks.json, skills and MCP servers, plus agent and command paths the manifest declares |
| **Codex** | AGENTS.md, .codex/config.toml (MCP servers), .codex/prompts/, .codex/skills/ |
| **Cursor** | .cursor/rules/*.mdc, .cursorrules, .cursor/commands/, .cursor/skills/, .cursor/mcp.json |
| **GitHub Copilot** | .github/copilot-instructions.md, .github/instructions/, .github/prompts/, .github/chatmodes/, .github/agents/, .vscode/mcp.json |
| **Gemini CLI** | GEMINI.md, .gemini/settings.json, .gemini/commands/, .gemini/skills/ |
| **Windsurf** | .windsurfrules, .windsurf/rules/, .windsurf/workflows/ |
| **skillshare** | ~/.config/skillshare/ and a project's .skillshare/ (or skillshare/): skills (including tracked repos), agents, extras (rules, commands), and MCP servers in config.yaml / mcp.yaml. Install records (.metadata.json, skills.lock.json, .skillshare-manifest.json) give each skill's source, commit and local edits |
| **npx skills** | .agents/skills/ with .agents/.skill-lock.json for install sources |
| **Agent Skills** | any SKILL.md folder, including the scripts and references bundled next to it |
| **Catalogues** | collections that publish files outside the folders an agent loads them from are recognised by frontmatter: .mdc files with globs/alwaysApply (Cursor rules), .md files with name, description and tools or model (subagents), and .md files with argument-hint (commands) |
Point it at one repo or a folder of many. Each nested .git counts as its own repo, and repos with no agent files are counted too (a catalogue layout is the usual reason). Linked git worktrees (such as Claude Code's .claude/worktrees/) are skipped, so branch checkouts don't show up as duplicates; pass --worktrees to include them.