What Is Claude Code Templates? Template Catalog, Installation, Security Warnings and Monitoring
You type `npx claude-code-templates@latest` in the terminal; it installs the ready-made agent, command, MCP, setting, hook or skill template you choose from the catalog (aitmpl.com) into Claude Code. davila7/claude-code-templates is MIT-licensed; no account or fee. Based on the file count in the repository tree, roughly: 915 skills, 423 agents, 348 commands, 107 MCP templates. Know three things: the installer sends usage data to aitmpl.com by default (the README doesn't mention it; it can be turned off), the same package has two published high-severity security advisories (patched versions 1.29.4 and 1.29.7), and since the templates are other authors' content, read them before installing.
- What it does
- Installs ready-made agents, commands, MCPs and skill templates for Claude Code
- Type
- Template collection + npx installer
- Where
- Claude Code
- Contents
- About 2,000 components: skills, agents, commands, MCPs, hooks…
- Security
- Two high-severity advisories; sends usage data
- Turkish
- Not stated in the official documentation
- Cost
- Free (MIT); no account
What Is Claude Code Templates Used For? What's Inside?
Instead of configuring Claude Code yourself, you choose from templates prepared by the community and add them to your project with a single command: a code reviewer agent, a test generation command, a database MCP, a git hook, a setting. You can also browse the templates in your browser at aitmpl.com (there's a search box and a stack builder).
Approximate counts based on the number of files in the repository tree (October 14, 2026; changes live):
| Type | Approximate count |
|---|---|
| Skill | 915 |
| Agent | 423 |
| Command | 348 |
| MCP template | 107 |
| Mode, setting, hook, loop, sandbox | 88 / 74 / 64 / 18 / 9 |
Extra tools: a usage analytics dashboard, a chat monitor (including remote access through an optional Cloudflare tunnel), setup diagnostics and a plugin dashboard. Who it's for: people who are new to Claude Code or looking for ready-made starting points. The components were compiled from other repositories and each has its own license (such as MIT, Apache 2.0, CC0); there's no promise that they've been audited.
How Do You Install Claude Code Templates?
You need Node.js (npx) and Claude Code; no account or key is required. There's no permanent install; the npx command runs each time. The commands are taken verbatim from the README.
› npx claude-code-templates@latestThe command lets you pick components. The ones you pick are written to your project; the README doesn't list the target folders, so check the files added after installation.
› npx claude-code-templates@latest --agent development-tools/code-reviewer --yes› npx claude-code-templates@latest --command performance/optimize-bundle --yes› npx claude-code-templates@latest --hook git/pre-commit-validation --yes› npx claude-code-templates@latest --mcp database/postgresql-integration --yes!--yes installs without asking for confirmation. A hook or MCP template adds a command Claude Code will run on events, or a startup command; read the template's contents on aitmpl.com or in the repository before installing.
› npx claude-code-templates@latest --analytics› npx claude-code-templates@latest --health-check!The dashboard features (analytics, agents, chat monitor) had a published security vulnerability; see the "What does it access?" section below and avoid versions before 1.29.7. --chats --tunnel opens your chats remotely through a Cloudflare tunnel; don't use it unless you need to.
SECURITY.md recommends using npx claude-code-templates@latest to stay current. Pinning by giving a version number is technically possible; the docs don't make clear whether component content is downloaded from the main branch.
How Do You Use Claude Code Templates?
After installation, the added agents, commands or skills are used in Claude Code as usual. Read a template in the catalog first, then install it.
› npx claude-code-templates@latest --health-checkA project template can put a bare "Bash" in permissions and allow every Bash command (open issue #1118). After installing, read the permission lines in .claude/settings.json.
Where Does Claude Code Templates Work?
| Claude CodeYes | The README defines the tool and templates for Claude Code only. |
|---|---|
| Other coding toolsUnclear | The README doesn't mention other clients; "not in the docs" doesn't mean "doesn't work." |
What Does Claude Code Templates Access, and What Data Is Sent?
Writes the selected components to your project. A hook template adds a command Claude Code will run on events; an MCP template adds a startup command (the README doesn't list this explicitly; it appears as a catalog claim).
The analytics dashboard and chat monitor read Claude Code session logs (according to the catalog description).
The installer sends the component type, name, path, category and CLI version to www.aitmpl.com/api/track-download-supabase; command usage and the install result also go to separate addresses. The README doesn't mention this tracking. The CCT_NO_TRACKING=true or CCT_NO_ANALYTICS=true environment variable, or CI=true, turns it off.
The tool doesn't delete files; you delete the installed files yourself.
!The same package has two published high-severity security advisories. (1) GHSA-79wm-x847-7cvg / CVE-2026-73222: the --studio server could bind to all interfaces and run commands without authentication; 1.29.2 and earlier were affected, patched in 1.29.4. (2) GHSA-4jm9-m3fr-9jpx: the analytics dashboard's WebSocket on port 3334 was open to unauthenticated command injection; versions from 1.11.0 up to 1.29.7 were affected, patched in 1.29.7. In addition, open issue #1139 reports a local proxy server's CORS and its binding to all interfaces. This doesn't mean "the current version is safe"; even if you don't use the dashboard features, avoid versions before 1.29.7.
Is Claude Code Templates Free?
Yes. The README and the aitmpl.com home page list no plan, price or account requirement; it's MIT-licensed open source. The README has sponsor and partnership links (for example Bright Data). Claude Code's own subscription is separate.
- MIT: you're free to use and modify the tool
- The components were compiled from other repositories; each has its own license (such as MIT, Apache 2.0, CC0)
Source: README and LICENSE. This isn't legal advice.
Common Problems and Fixes
| What's happening | What to do |
|---|---|
| Security vulnerability in the analytics dashboard or chat monitor | 1.29.7 and later are patched; 1.11.0 through 1.29.6 are affected. Run the current version with @latest. |
| --studio server security vulnerability | 1.29.4 and later are patched; 1.29.2 and earlier are affected. |
| Reported by users Project templates put a bare "Bash" in permissions | Open issue #1118 (October 7, 2026); read the template's permission lines before installing. |
| Reported by users A claim that the local proxy server has open CORS and allows remote session listing | Open issue #1139 (October 9, 2026); not an advisory, no fix information. |
| You don't want usage data sent | Set the CCT_NO_TRACKING=true (or CCT_NO_ANALYTICS=true) environment variable. |
How Do You Remove What Claude Code Templates Installed?
- The tool itself: There's no permanent install; npx runs each time, so there's nothing to remove.
- Installed templates: Manually delete the added agent, command, hook and MCP files from the relevant folders in your project and from .claude/settings.json. The README doesn't list the target files; comparing the file list before and after installing (git status) helps.
Frequently asked questions
Is Claude Code Templates paid, and does it require an account?
The README and the aitmpl.com home page list no plan, price or account requirement; it's open source and MIT-licensed.
Is my usage data collected?
By default, the installer code sends the component type, name, path, category and CLI version to aitmpl.com. It's turned off with CCT_NO_TRACKING=true or CCT_NO_ANALYTICS=true (or when CI=true). The README doesn't mention this tracking.
Are there security warnings?
Yes: there are two high-severity advisories published on GitHub (the --studio server and the analytics dashboard). Even if you don't use the dashboard features, avoid versions before 1.29.7.
Can I pin the version?
SECURITY.md recommends using npx claude-code-templates@latest to stay current. Pinning by giving a version number is technically possible, but the docs don't make clear whether component content is downloaded from the main branch.
Are the templates I install safe?
The components were compiled from other repositories, and there's no promise that they've been audited. A hook or MCP template can run commands on your computer; read it before installing.
Related guides
Sources
Not clear in the official sources: The target folders the interactive install writes to (the README doesn't list them) · the files the analytics dashboard and chat monitor read (unclear in the official sources) · whether component content is downloaded from the main branch · the accuracy of issue #1139 · Turkish support · OSV scan. Counts are approximate, taken from the repository tree. Each one is covered in its section.