Cycling through all six. Tap any point to stop.

Measured on six things

Free Claude Code plugin for disciplined, test-first AI-as...

Security

HTTPS and a CSP are in place, but HSTS, frame protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are all missing, and there's no SPF/DMARC. No published audits or bug bounty found.

Screenshots

1 / 1

ClaudioXP

About this app

Guard rails for Claude Code. Claude types fast; you decide what ships.

Key features

1Enforced XP/TDD phase gates inside Claude Code: PLAN, SPECIFY, RED, PROMPT, GREEN, REVIEW, REFACTOR, COMMIT, each requiring human approval.
2Tests locked during implementation and refactor phases so Claude can't quietly change or skip them; git is read-only for Claude.
3Craft rules (SOLID, Clean Code, Clean Architecture, KISS/DRY/YAGNI, design patterns) read before Claude writes, plus corrections saved as dated rules.
4Two-command install via the Claude plugin marketplace; free and open source under Apache 2.0.

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Experienced software engineers using AI coding assistants

Pain points

AI generates code too fast to review; risk of tests being changed or ignored; loss of control over commits.

Primary needs

Guard rails that enforce TDD and small steps, while keeping human judgment at every phase.

Demographic

Tech leads and senior developers concerned about code quality

Pain points

AI-generated code often lacks tests, follows poor patterns, or bypasses review; hard to maintain standards.

Primary needs

Automated enforcement of SOLID, Clean Code, and test-first practices; ability to review and approve each change.

Demographic

Development teams adopting AI pair programming

Pain points

Inconsistent AI output quality; difficult to scale best practices across team members; lack of structured workflow.

Primary needs

A shared, enforceable process for AI-assisted development that integrates with existing tools (Claude Code, Git).

Scout Review

Written by AI from measured evidence, scored out of 100.

ClaudioXP is a focused, well-built indie tool that adds XP-style guard rails to Claude Code: enforced test-first phases, locked tests during implementation, and a human decision at every commit. The homepage is developer-native and fast — 94 mobile Lighthouse, zero layout shift — with a genuinely smart phase diagram and copyable install commands. The weaknesses are consistent: an unloaded hero video that undercuts the demo, faint small body text, a security posture that stops at HTTPS and a CSP (4/12 on header checks, no DMARC, no audits), and a free-and-open-source model that limits commercial upside. It knows exactly who it's for — experienced engineers who refuse to vibe-code — and says so bluntly. As a craft-first workflow layer for AI coding, it's competent and clearly positioned; as a business, it's a niche bet.

Measure by measure

Usability

Copyable install commands, a visible prerequisites line and an accordion 'How it works' make setup and concept graspable fast. Dense lower sections and small grey text slow scanning, and there's no live demo beyond the video.

Design

Cohesive red-and-charcoal palette, a scannable phase diagram and a real terminal screenshot sell the workflow. Undercut by an unloaded hero video, tiny low-contrast body copy and dead space in the community cards.

Speed

Lighthouse mobile 94/100 with LCP 2.2s, CLS 0 and TBT 0ms; desktop 99/100. A lightweight static page that loads cleanly with no layout shift and no lag complaints.

Security

Accessibility

Lighthouse accessibility 95/100 with only two failing audits: insufficient color contrast and a missing main landmark. The contrast issue is real and visible in the small grey body text; no a11y statement or multi-language support found.

Growth

A real, specific problem — AI writes faster than you can review — with a concrete wedge: enforced TDD/XP phase gates inside Claude Code. Free and open source helps adoption but caps revenue; the differentiation is real yet narrow.

Improvement areas

Security hardening: missing HSTS, frame protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, SPF and DMARC (4/12 header checklist).
Hero demo video renders a blank black frame with no poster, undercutting the product showcase.
Small, low-contrast body text and a missing main landmark fail accessibility audits and hurt readability.
No published security/trust page, audit or bug bounty despite asking for commit and test-gate control.

Design & Usability

ClaudioXP's homepage is a confident, developer-native piece of design: a restrained red-and-charcoal palette, a genuinely clever phase diagram that turns an abstract XP workflow into a scannable system map, and a real terminal screenshot showing the test table and prompt. The install panel with two copyable commands and a visible prerequisites line respects developer conventions and gets you to action fast. The cracks show in the details: the hero video sits on a blank black frame with a '0:00' timecode and no poster, so the centerpiece demo reads as broken; body copy in the 'Who it's for', 'craft inside' and community sections is very small and light grey; and the community cards leave awkward dead space with near-illegible platform labels. Usability is competent — clear CTAs, an accordion that invites exploration, a docs link for depth — but the dense lower half and faint text make long scanning a chore, and there's no live demo to substitute for the stalled video.

Speed & Security

Speed is a clear strength. Lighthouse measured mobile performance at 94/100 with LCP 2.2s, CLS 0 and TBT 0ms, and desktop at 99/100 — a lightweight static page that loads cleanly with no layout shift and no blocking time. No lag complaints surfaced in the collected evidence. Security is the weak flank. HTTPS is enforced and a Content-Security-Policy is present, which is a good start, but the HTTP/DNS probe found no HSTS, no frame protection, no X-Content-Type-Options, no Referrer-Policy and no Permissions-Policy, and neither SPF nor DMARC records exist — a 4/12 checklist score. No SOC 2, ISO, pen-test or bug-bounty claims were found. For a tool that asks engineers to hand it control over commits and test gates, the missing hardening and the absence of any published security posture are a real gap against what a trust-sensitive developer tool should show.

Accessibility & Growth

Accessibility lands at a solid 78: Lighthouse scored 95/100 with only two failing audits — insufficient color contrast and a missing main landmark — and the contrast issue is corroborated by the visual audit's small light-grey body text. No accessibility statement or multi-language support was found, so the automated score is the main signal. Growth is a judgement on the idea. The problem ClaudioXP names is real and specific: AI assistants generate code faster than engineers can review, risking tests being silently changed or skipped. The wedge is concrete — enforced TDD/XP phase gates (RED, GREEN, REVIEW, COMMIT) inside Claude Code, with human approval at every step — and it is genuinely distinct from Copilot and Cursor, which are broad AI coding tools that do not enforce workflow discipline. The limits are real too: it is free and open source (Apache 2.0), which caps monetization, the domain is brand new, and the differentiation is narrow — it sells discipline to a market that mostly bought speed. A credible niche, not a category-defining bet.

Conclusion

If you're a senior engineer already using Claude Code and quietly worried that the AI is rewriting your tests while you're not looking, ClaudioXP is aimed squarely at you, and the phase-gate model is a real answer to a real problem. Install is two commands and the prerequisites are stated up front. Go in expecting a young, free, open-source project: the security hardening is thin, the demo video doesn't load, and the polish fades below the fold. But the core idea — keep the speed, keep the craft, keep control — is coherent and the execution on the workflow itself is thoughtful. Worth a star and a trial run on a side project before you trust it with anything that ships.

Suggestions for improvement

Fix the hero video: add a poster frame and autoplay a short loop, or replace it with an animated terminal GIF that actually shows a phase gate in action.
Raise body-copy size and contrast in the 'Who it's for', 'craft inside' and community sections; the faint grey text fails the contrast audit and hurts scanning.
Harden the headers: add HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame protection, and publish SPF/DMARC records.
Add a short 'Security & trust' page explaining what the plugin can and cannot touch, and tighten the community cards' dead space and platform labels.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	ClaudioXP	GitHub Copilot	Cursor
Enforces test-first / TDD workflow	Yes — RED/GREEN phases with locked tests and human approval	No — suggests code, no workflow enforcement	No — generates code, no test-first discipline
Phase-based development gates with human decision points	Yes — 8 phases, only you advance and commit	No — inline completions and chat	No — chat and generation, no enforced phases
Integrates with Claude Code	Yes — installs as a Claude plugin	No — separate IDE assistant	No — standalone AI editor
Pricing model	Free and open source (Apache 2.0)	Paid subscription tiers	Freemium with paid Pro/Business tiers
Built-in craft rules (SOLID, Clean Code, patterns)	Yes — rules read before Claude writes	No — general-purpose suggestions	Partial — via user rules/config, not enforced