What Is Ruflo (Claude Flow)? Agent Team Kit for Claude Code: Setup, Hooks and Security Advisory

Ruflo (formerly Claude Flow) is, in the README's own words, an agent meta-harness for Claude Code and Codex: install it and your agents get multi-agent coordination, persistent memory, hooks and a console. It installs into Claude Code from the plugin marketplace or with `npx ruflo@latest init wizard`; it is MIT-licensed, needs no account, and the cost of the model the agents call is billed by your own provider. Know before you install: the counts (plugins, tools, commands) do not match across the README, STATUS.md and the repository directory; ruflo-core installs hooks even though the plugin path is said to have none; the speed and accuracy claims come from the maker's own tables.

What it does: Runs several agents together in Claude Code and Codex
Type: Kit: plugins, agents, skills, hooks, MCP, console
Where: Claude Code (primary), Codex, MCP clients
Requirements: Claude Code 2.1.287+ and Node.js 20+
Security: Critical advisory (CVE-2026-59726), fixed in 3.16.3
Turkish: Not stated in official sources
Cost: Free (MIT); model cost is with your provider

What does Ruflo do? What is in it?

Ruflo adds an extra layer to Claude Code: splitting a large job across several agents and coordinating them (swarm), memory across sessions and learning from past tasks, hooking into commands and file writes, and a console for monitoring agent work. The README says the agents still call a language model and the cost comes from the provider you connect. MCP is the standard that lets AI programs connect to outside tools.

Work with several agentsWhat you get: Coordinated agent work; output quality not independently measuredNeeds a separate setup Memory across sessionsWhat you get: Local memory databaseNeeds a separate setup

The number of components differs by source, so no single figure is given:

Source	Plugins	MCP tools	CLI commands
README	"All 35 plugins"; "33 native + 21 npm"	314	26
STATUS.md (3.10.2 snapshot)	33	323	45
Repository directory	marketplace.json 46 entries; 47 folders under plugins/	ruflo-core: "300+"	—

The README also says the init path writes 98 agents, 30 skills and 60+ commands. Who it helps: People doing long, multi-step work with Claude Code who want to try agent coordination. For small jobs it can add unnecessary weight.

How do you install Ruflo?

There are two main paths, and their footprints are very different: the plugin path ("lightweight" in the README) and the init path ("full loop"). The commands are copied verbatim from the README.

1. Add the marketplace› /plugin marketplace add ruvnet/ruflo

2. Core only› /plugin install ruflo-core@ruflo

The README's full path also tells you to install the ruflo-console and ruflo-mods plugins and run the /reload-plugins and /ruflo commands. Components such as swarm and memory are separate plugins (ruflo-swarm, ruflo-rag-memory).

ruflo-mods plugins run with your account's permissions and without a sandbox (README); read their code before installing.

Wizard (all operating systems)› npx ruflo@latest init wizard

This path writes .claude/, .claude-flow/ and CLAUDE.md to the working folder; it installs agents, commands, skills, MCP, hooks and a background process (daemon). The README gives no undo command.

MCP server for Claude Code› claude mcp add claude-flow -- npx ruflo@latest mcp start

In another MCP client, the command is npx and the arguments are ["-y", "ruflo@latest", "mcp", "start"].

macOS, Linux, WSL, Git Bash› curl -fsSL https://cdn.jsdelivr.net/gh/ruvnet/ruflo@main/scripts/install.sh | bash

This command downloads the script from the main branch and runs it directly. Download and read the script before running it.

Start with ruflo-core; add extra plugins one at a time as you need them. The init path writes a lot of files into your project.

How do you use Ruflo?

The skills and commands that come with the plugins are called inside Claude Code; to check status and setup, ruflo-core brings these commands: ruflo-status, witness, plus the doctor and init-project skills.

Check status"/ruflo-status Is my Ruflo setup healthy? List which plugins and hooks are active."

Work with an agent team"Using the ruflo-swarm plugin, split this feature across three agents: one writes the code, one writes tests, one reviews. Show me the plan before you start."

Terminal interface (optional)› npx ruflo tui

Figures in the README such as "89 percent routing accuracy," "2.8-4.4x speed" and "30-50 percent token savings" come from the maker's own tables; there is no method, dataset or independent verification. Measure it on your own work.

Which programs does Ruflo work in?

Claude CodeYes	Plugin marketplace, hooks, console; 2.1.287 and later.
CodexPartly	npx install and MCP server; hook support depends on the client. A release note says "Codex MCP backend retired"; the note does not explain what that means.
Other MCP clientsUnclear	The README only says "MCP enabled tool" and lists no specific client names.

What does Ruflo access, and what do its hooks run?

Hooks

The README table says the plugin path has no hooks, but the ruflo-core plugin installs 9 hook commands via hooks.json (per the source file): before and after Bash and file edits, on context compaction and at session end. The script always allows and exits with code 0, so it never blocks a turn.

Reads

Your project files and the Bash commands you run (hook event data), session history and its own memory database.

Writes

init writes .claude/, .claude-flow/ and CLAUDE.md to the working folder. Memory and learning records are written to disk; memory encryption is off by default. Federation and browser tools can send requests out.

Outbound data

hooks.json calls the hooks "telemetry" and passes the event to a local command; the docs do not make clear whether that command sends the data out.

The version is not pinned: if nothing is installed locally, the hook runs npx ruflo@latest and the MCP launcher runs npx @claude-flow/cli@latest, so the newest release is pulled every time. RUFLO_HOOK_SKIP_NPX=1 and RUFLO_MCP_SKIP_NPX=1 prevent this. Hooks start as separate background processes (at most 4 at once).

The repository has a published critical security advisory: GHSA-c4hm-4h84-2cf3 (CVE-2026-59726), "unauthenticated remote code execution in the default docker-compose deployment of the MCP bridge." Affected versions are those before 3.16.3; it was patched in 3.16.3 (July 1, 2026). The current version does not appear to be affected, but that does not mean "safe." The project's SECURITY.md support table lists only 3.5.x as "supported" (it may be out of date). The repository has more than 1,000 open issues. Review the repository and the version before installing.

Is Ruflo free?

Ruflo itself, yes: it is MIT-licensed and needs no account or subscription. But the agents still call a language model; the cost comes from the provider you connect (for example your Claude subscription or API key), and multi-agent runs can use more than usual.

Allowed

MIT: free to use, modify and use in commercial work

Not allowed

The README does not cover enterprise admin approval

Source: README and LICENSE. This is not legal advice.

Common problems and fixes

What happens	What to do
On Windows, "PreToolUse hook (failed) exit code 1" on every tool call	A problem caused by the old bash-based hook (#2721) was moved to a node-based shell; update the plugin.
Hooks slow down every command	Per the script comment, the measured delay was 0.9 s before and 1.5-4 s after (#4128); they now run in the background. `RUFLO_HOOK_SYNC=1` brings back the old synchronous behavior.
The plugin and a manually installed npm version show different versions	The MCP launcher first looks for a local install, otherwise it pulls @latest. You can pin it with `RUFLO_MCP_CLI_OVERRIDE` (#2971).
Reported by users Memory search drops to a single result or uses the wrong embedding	Open issues #4191 and #4192 (October 14, 2026); a fix is pending.

How do you remove Ruflo?

Plugin path: From the /plugin menu, remove ruflo-core, ruflo-console, ruflo-mods and any other ruflo-* plugins you installed.
If you added it as MCP: claude mcp remove claude-flow.
If you installed with init: First stop the background process (npx ruflo@latest daemon stop), then review and manually delete .claude/, .claude-flow/ and CLAUDE.md in the project folder; the README gives no undo command.
Global npm install: npm uninstall -g ruflo.

Frequently asked questions

Are Ruflo and Claude Flow the same thing?

Yes. The README says "Claude Flow is now Ruflo." The old repository redirects to the new address; some commands in the README still use the claude-flow name.

Should I install the plugin or run npx ruflo init?

Per the README's table, the plugin path is lightweight and the init path is a full install: agents, commands, skills, MCP, hooks, a background process and files in your working folder. The table says the plugin path has no hooks, but the ruflo-core plugin installs hooks. To start, the plugin path with only the core plugin writes fewer files.

Are figures like 89 percent accuracy and 2.8-4.4x speed accurate?

These figures appear in the README and the user guide; there is no measurement method, dataset or independent verification. They are the maker's claims.

Is there a security advisory?

Yes, one published: CVE-2026-59726 (critical), unauthenticated remote code execution in the docker-compose deployment of the MCP bridge; versions before 3.16.3 were affected, and it was fixed in 3.16.3. This does not mean the current version is safe.

What do the hooks run, and can I turn them off?

ruflo-core installs hooks that call the local Ruflo command before and after the Bash and file edit tools, on compaction and at session end. To turn off the npx fallback, set RUFLO_HOOK_SKIP_NPX=1; removing the plugin removes the hooks.

Is it free?

Ruflo, yes (MIT, no account). The cost of the model the agents call comes out of your own account.

Related guides

Claude

Claude Code

Sources

Not clear in the official sources: The current number of components (README, STATUS.md and directory differ) · whether the hooks' "telemetry" data leaves your machine · speed, accuracy and token savings claims (no evidence) · the scope of the memory delete commands · the scope of Codex support · OSV scan (no results for npm) · Turkish support. Each is covered in the relevant section.