A comprehensive collection of Claude Code skills and agents for Drupal development. Install battle-tested patterns for configuration management, module updates, security, local development, OAuth,...
Overview
A comprehensive collection of Claude Code skills and agents for Drupal development. Install battle-tested patterns for configuration management, module updates, security, local development, OAuth, search, and more. Copy-paste this into Claude Code (or any AI coding agent) from your Drupal project directory: This copies skills into .claude/skills/ but does install agents, settings, or the workflow guide. Works with Claude Code, Cursor, Codex, Gemini CLI, and any tool supporting the agentskills.io specification. Then add the agent workflow guide from AGENTS.md to your project's CLAUDE.md. The React/JSX Code Component skills (component definition, metadata, composability, styling, data fetching, etc.) are maintained upstream — install them from the official suite rather than duplicating here (see Canvas Ecosystem). This repo ships only the complements that suite doesn't cover: Sample Drupal-safe permission patterns.
README
Drupal Claude Skills
A comprehensive collection of Claude Code skills and agents for Drupal development. Install battle-tested patterns for configuration management, module updates, security, local development, OAuth, search, and more.
Quick Install
Option 1: Give this prompt to your AI agent
Copy-paste this into Claude Code (or any AI coding agent) from your Drupal project directory:
Install Drupal Claude Skills into this project from https://github.com/grasmash/drupal-claude-skills:
1. Clone the repo to a temp directory
2. Copy skills/ into .claude/skills/
3. Copy .claude/agents/ into .claude/agents/
4. Copy .claude/settings.json (if I don't already have one)
5. Read AGENTS.md from the repo and append the "Agent Workflow Guide" section to my CLAUDE.md (create CLAUDE.md if it doesn't exist)
6. Clean up the temp directory
Option 2: Shell script
bash <(curl -s https://raw.githubusercontent.com/grasmash/drupal-claude-skills/main/install.sh)
Or from a cloned copy:
./install.sh /path/to/your/drupal/project
Option 3: Skills CLI (skills only, no agents)
npx skills add grasmash/drupal-claude-skills
These skills cover Drupal only. For a JavaScript framework on top of Drupal (React, Vue, Angular, and so on), install that framework’s skills alongside them, for example with npx skills find .
This copies skills into .claude/skills/ but does not install agents, settings, or the workflow guide. Works with Claude Code, Cursor, Codex, Gemini CLI, and any tool supporting the agentskills.io specification.
Option 4: Manual
git clone https://github.com/grasmash/drupal-claude-skills.git /tmp/drupal-skills
# Skills
cp -r /tmp/drupal-skills/skills/* .claude/skills/
# Agents
cp -r /tmp/drupal-skills/.claude/agents/* .claude/agents/
# Settings (review and customize)
cp /tmp/drupal-skills/.claude/settings.json .claude/settings.json
# Clean up
rm -rf /tmp/drupal-skills
Then add the agent workflow guide from AGENTS.md to your project’s CLAUDE.md.
What’s Included
Skills (skills/)
Core Drupal
| Skill | Description |
|---|---|
| drupal-at-your-fingertips | Core API patterns from Selwyn Polit’s book — 14 topics in depth (services, hooks, events, plugins, entities, forms, routes, Twig, caching, AJAX, queries, config, Paragraphs, DTT), the other 39 chapters linked online |
| drupal-config-mgmt | Configuration management — safe import/export, config splits (complete vs partial), environment syncing, merge workflows |
| drupal-config-reconcile | Resolve config drift item-by-item against a deployed env — import vs export vs skip, verify with the import transformer, never write to prod |
| drupal-contrib-mgmt | Contrib module management — Composer updates, composer-patches v2 (patches.lock.json + relock), Drupal 11 compatibility, drupal.org workflow |
| drupal-ddev | DDEV local development — setup, commands, database ops, Xdebug, performance (Mutagen), Docker/Mutagen troubleshooting |
| drupal-deploy-safety | What passes locally and breaks on deploy — deploy path per change class, the updb → cr → cim → cr tail, killed-updb maintenance stranding, the custom_field addColumn() truncate trap, re-firing external-store update hooks, service arity, Drush discovery, committed-vendor autoloader skew |
| drupal-mail | Mail system configuration — Mailpit local testing, transactional-API production sending, HTML email Content-Type gotchas, sender/formatter plugins |
| drupal-performance | Performance methodology + anti-patterns — cold-render query count as the metric, http.client render-path hangs, batched projections, plus eight caching/invalidation lessons (references/caching-lessons.md) |
| drupal-views-patterns | Views mechanics + the “View vs custom vs JSON:API” decision — cache plugins, the eager-entity-row trap, pager COUNT cost, lean projections |
| drupal-api-endpoints | Custom API endpoints with UUID-based security — route/controller/fetch templates, authenticated cURL testing, the JSON:API filter-access cache-poisoning fix |
| drupal-testing | TDD with PHPUnit + DTT — bug-fix RED-first, bootstrap-level cost (Unit/Kernel/ExistingSite), the anonymous-403 permission trap, vacuous-pass pin |
| ivangrynenko-cursorrules-drupal | OWASP Top 10 security patterns from Ivan Grynenko — auth, access control, injection prevention, crypto |
| drupal-simple-oauth | OAuth2 with simple_oauth — TokenAuthUser permissions, scope/role matching, field_permissions, CSRF bypass, debugging |
| drupal-search-api | Search API — index configuration, boost processors, custom processors, config management, reindexing |
| drupal-vite-theme | Fast custom themes on Vite + Tailwind v4 + SDC — the drupal/vite dev-server probe cold-render trap, content-hashed dist vs version: pins, anti-monolith bundling, Tailwind v4 preflight/@theme pitfalls, dist drift |
| skill-developer | Meta-skill for creating new skills — agentskills.io spec, frontmatter schema, progressive disclosure, 500-line rule |
Design QA
| Skill | Description |
|---|---|
| design-review | Live-environment design/QA pass for UI changes — 7 review phases, mockup parity, a11y, triage-matrix reporting, the layout-topology gate, the Tailwind computed-styles trap |
| mockup-parity | Porting static HTML mockups into themed Twig/SDC routes — two-gate reconciliation workflow, delta classification, capability preservation, visual diff ledger |
Tooling & Observability
| Skill | Description |
|---|---|
| sentry-integration | Sentry for Drupal — MCP issue triage, the comment REST API, N+1 patterns, raven module tracing gotchas (the trace PII trap, the tracing permission gate) |
| claude-code-mcp-setup | Add and configure MCP servers in Claude Code — stdio/HTTP/SSE transports, OAuth servers, troubleshooting /mcp failures |
Drupal Canvas (page builder)
The React/JSX Code Component skills (component definition, metadata, composability, styling, data fetching, etc.) are maintained upstream — install them from the official suite rather than duplicating here (see Canvas Ecosystem). This repo ships only the complements that suite doesn’t cover:
| Skill | Description |
|---|---|
| drupal-canvas | Short pointer to the official drupal-canvas/skills suite for Code Components — lists its skills and routes Twig SDC and contribution work to the complements below |
| drupal-canvas-sdc | Twig-based Single Directory Components — component.yml schemas, Canvas registration rules, component config entities, instance version management, deploy pitfalls (the official suite is React/JSX only) |
| canvas-contribution | Contributing Canvas features/fixes upstream to drupal.org — issue forks, MRs, composer patches |
| acquia-source | Connect to an Acquia Source CMS — JSON:API (/api) + OAuth2, the MCP server (claude mcp add), the @drupal-canvas CLI, and Canvas Page API deploy pitfalls |
8 Agents (.claude/agents/)
| Agent | Description |
|---|---|
| quality-gate | Pre-commit code review — security, performance, testing, regressions |
| done-gate | Completion validator — builds pass, tests run, deliverables exist |
| drupal-specialist | Drupal/PHP implementation — modules, hooks, services, Drush |
| frontend-specialist | Frontend — Twig, SCSS, JavaScript, responsive design, accessibility |
| researcher | Codebase exploration — architecture, patterns, execution paths |
| reviewer | Code review — bugs, security, quality, actionable feedback |
| test-runner | Test execution — PHP, JS, SCSS validation, build checks |
| test-writer | ExistingSite test writing — bug reproduction, DTT patterns |
Settings (.claude/settings.json)
Sample Drupal-safe permission patterns. Prompts for confirmation before destructive operations like drush cim, drush sql-drop, and drush site:install.
Canvas Ecosystem
The core Drupal Canvas Code Component skills (component definition, metadata, composability, utils, styling, data fetching, push, regions, page definition, …) are maintained in the official drupal-canvas/skills repo. Install them directly rather than relying on a fork:
npx skills add drupal-canvas/skills
This repo intentionally does not duplicate those — it adds only the complements the official suite doesn’t cover: drupal-canvas-sdc (Twig SDC) and canvas-contribution (contributing upstream to drupal.org). Use them alongside the official suite.
Scaffold a new Canvas project:
npx @drupal-canvas/create my-project
Usage
Skills activate automatically based on context:
- Working with config splits →
drupal-config-mgmtactivates - Updating a module →
drupal-contrib-mgmtactivates - Security review →
ivangrynenko-cursorrules-drupalactivates - OAuth debugging →
drupal-simple-oauthactivates - Local dev issue →
drupal-ddevactivates
You can also invoke skills explicitly:
"Using the drupal-config-mgmt skill, help me set up partial config splits"
Repository Structure
skills/ # One dir per skill: SKILL.md + optional references/, examples/, scripts/
├── acquia-source/
├── canvas-contribution/
├── claude-code-mcp-setup/
├── design-review/
├── drupal-api-endpoints/
├── drupal-at-your-fingertips/
├── drupal-canvas/
├── drupal-canvas-sdc/
├── drupal-config-mgmt/
├── drupal-config-reconcile/
├── drupal-contrib-mgmt/
├── drupal-ddev/
├── drupal-deploy-safety/
├── drupal-mail/
├── drupal-performance/
├── drupal-search-api/
├── drupal-simple-oauth/
├── drupal-testing/
├── drupal-views-patterns/
├── drupal-vite-theme/
├── ivangrynenko-cursorrules-drupal/
├── mockup-parity/
├── sentry-integration/
└── skill-developer/
.claude/
├── agents/ # Agent definitions
│ ├── quality-gate.md
│ ├── done-gate.md
│ ├── drupal-specialist.md
│ ├── frontend-specialist.md
│ ├── researcher.md
│ ├── reviewer.md
│ ├── test-runner.md
│ └── test-writer.md
├── settings.json # Sample Drupal permissions
└── scripts/ # Upstream sync scripts
├── sync-d9book.sh
└── sync-ivan-rules.sh
Updating Upstream Skills
Two skills sync from upstream sources:
# Sync Drupal at Your Fingertips references
./.claude/scripts/sync-d9book.sh
# Sync Ivan Grynenko security patterns
./.claude/scripts/sync-ivan-rules.sh
Recommended Companion Tools
These aren’t Drupal-specific, so they live outside this repo — but they pair well with these skills on real Drupal work. Install separately; they’re optional.
- caveman — a token-compression skill that has the agent reply in a terse, fragmented style, cutting output tokens ~65–75% while keeping technical accuracy. Useful for long Drupal sessions (config audits, multi-file refactors) where verbose narration burns tokens. Toggle with
/caveman; stop with “normal mode.”
Contributing
See CONTRIBUTING.md for guidelines on:
- Adding new skills (follow agentskills.io spec)
- Adding new agents
- Improving existing content
- Syncing upstream sources
Credits
- Selwyn Polit — Drupal at Your Fingertips
- Ivan Grynenko — Drupal security patterns
- Drupal Community — Ongoing contributions to documentation and best practices
License
MIT — see LICENSE
Related Resources
- agentskills.io Specification
- Claude Code Documentation
- Drupal Canvas Skills
- Drupal.org
- DDEV Documentation
Star History
Recommended Tools
Try a different keyword or remove a filter.
Install
npx skillfish add grasmash/drupal-claude-skills