Claude Folder Anatomy

```html

DevLog

Articles Guides System Architecture

Configuration Guide

Anatomy of the .claude/ Folder

A technical review of the hierarchical file system used to configure the behaviors, permissions, and workflows of the Claude AI assistant in your projects.

Directory Map

your-project/

CLAUDE.md

CLAUDE.local.md

.claude/

settings.json

settings.local.json

commands/

review.md

fix-issue.md

deploy.md

rules/

code-style.md

testing.md

skills/

security-review/

SKILL.md

agents/

code-reviewer.md

security-auditor.md

Core Instructions

Files located in the project root that determine the fundamental context of the assistant.

CLAUDE.md (Team-wide)

Added to version control (Git). Binding for the entire team.

Correct Example

"Always use Tailwind CSS for UI components. Apply the Singleton pattern in the service layer."

CLAUDE.local.md (Personal)

Excluded from version control (.gitignore). Binds only your local environment.

Correct Example

LOCAL_DB_PATH="C:/dev/dbs/test.sqlite3"

Permissions: settings.json

Configures the assistant's read and write permissions on the system.

Wrong Usage

Granting unrestricted access to the entire system creates a security vulnerability.

{
  "permissions": {
    "read": ["/"],
    "write": ["/"]
  }
}

Correct Usage

Specific permissions should be granted only to necessary directories (Principle of Least Privilege).

{
  "permissions": {
    "read": ["./src", "./docs"],
    "write": ["./src/components"]
  }
}

Custom Commands (commands/)

Defines / (slash) commands that can be triggered manually in the chat interface. The file name determines the command name.

deploy.md

/project:deploy

Content Example: "Compile the project for the production environment, generate static files, and report by running tests."

Automation: Skills

Background tasks that run with specific triggers without human intervention.

Example Scenario: security-review/SKILL.md

When a developer opens a new Pull Request, this skill triggers automatically. It scans the code for SQL Injection and XSS vulnerabilities, and adds the findings as a PR comment.

Isolated Roles: Agents

Sub-assistants with specific expertise, isolated from the main assistant's context. Provides Separation of Concerns.

security-auditor.md

"You are only a security auditor. Do not concern yourself with the business logic of the code, only report vulnerabilities."

code-reviewer.md

"You are a senior software architect. Check the code's compliance with SOLID principles and offer refactoring suggestions."

© 2026 DevLog. System Architecture Notes.

```