AG FM hooks: PreToolUse, PostToolUse, Stop only.
Settings-level hooks affect ALL SAs -- configure in settings.json or PLG/hooks/hooks.json.
AG Scope & Precedence
Priority
Location
Scope
How to Create
1 (highest)
--agents CLI flag
Current session
JSON at launch
2
.claude/agents/
Project
Manual or /agents
3
~/.claude/agents/
User (all projects)
Manual or /agents
4 (lowest)
plugin/agents/
Where PLG enabled
Installed with PLG
Protected-path (v3.4.70): AG Write targets → .claude/<subdir>/ (project-relative). ~/.claude/* blocked ALL modes; exceptions: commands|agents|skills|worktrees. See memory protected_path_write_block.md.
CLI JSON Format (session-only)
claude --agents '{
"code-reviewer": {
"description": "Expert reviewer. Use after code changes.",
"prompt": "You are a senior code reviewer...",
"tools": ["Read", "Grep", "Glob", "Bash"],
"model": "sonnet"
}
}'
Spawn From Main Conversation Only (BC workflow)
CC capability: since v2.1.172, SAs can spawn their own SAs (up to 5 levels deep). BC workflow stance: spawn ONLY from main conversation. Nested spawns bypass session binding + grepai injection.
Nesting-depth guidance: nesting allowed up to 5 levels, but each level multiplies token cost + loses ctx fidelity. Prefer flat fan-out from main. Give Task/AG TL to an AG only when it genuinely orchestrates.
skills: in FM -- content injected at startup (not runtime)
File-based comms
AGs write results to files, next AG reads
AG Teams (v2.1.33+)
Lead coordinates teammates (BC: keep one level deep from main)
AG Teams -- lead coordinates via Task API TLs: TaskCreate, TaskUpdate, TaskList, TaskGet, TaskOutput, TaskStop. Hook events: TeammateIdle, TaskCompleted, TaskCreated (v2.1.84). BC: keep coordination one level deep from main.
"Check for SQL injection by examining DB queries for parameterization"
Actionable
"Analyze the code"
"Read file via Read TL, then search patterns via Grep"
Edge cases
(not mentioned)
"If insufficient ctx, ask clarifying questions before proceeding"
Color Semantics
Color
Use for
EXs
cyan
Analysis, review
code-reviewer, security-analyzer
green
Generation, creation
test-generator, doc-generator
yellow
Validation, warning
PLG-validator, schema-checker
red
Security, critical
security-scanner, vuln-finder
magenta
Transformation
code-migrator, refactorer
TRGing EXs Guide
EXs help Claude disambiguate -- use ONLY when AG overlaps with others.
Condition
EXs needed
Unique, clear domain
0 -- single-line description suffices
Overlaps with 1-2 others
1 EX showing distinguishing TRG
Highly ambiguous
2-3 EXs covering explicit + implicit TRGs
EX format (minimal)
<example>user:"exact phrase user would say"<commentary>Why THIS AG, not another</commentary></example>
No Context: line needed
No assistant: response needed
<commentary> REQ -- it's the selection signal
Vary phrasing: don't repeat same pattern twice
Common AG Types
Type
MDL
TLs
Focus
developer-*
opus
Read, Write, Edit, Bash, Task
Implementation
reviewer
opus
Read, Glob, Grep
Code review
tester
sonnet
Read, Bash
Test exec
arch-*
opus
Read, Glob, Grep, WebFetch
Architecture (read-only)
docs-*
sonnet
Read, Write, Edit
Documentation
explorer
haiku
Read, Glob, Grep
Quick search
Best Practices
Practice
Benefit
Scope TLs per AG
Least privilege
Single clear goal
Focused behavior
Include checklist
Definition of Done
Ask before major changes
User control
Start restrictive
Expand TLs as validated
Define next steps
Clear handoffs
Complete AG EXs
Production-ready AGs showing FM + SP essentials.
code-reviewer
Field
Value
MDL
opus
color
cyan
TLs
Read, Glob, Grep
---name:code-reviewerdescription:Reviews code for quality, security, patterns. Use after code changes or for PR review.model:opuscolor:cyantools:Read, Glob, Grep---
Output: Structured report with severity levels (Critical/High/Medium/Low)
Read-only: no modifications, only analysis + recommendations
Report format: findings table with file, line, severity, issue, recommendation
test-generator
Field
Value
MDL
sonnet
color
green
TLs
Read, Write, Edit, Bash
---name:test-generatordescription:Creates unit tests for Java/Kotlin code. Use when tests needed for new features.model:sonnetcolor:greentools:Read, Write, Edit, Bash---
SP key elements:
Role: QA engineer specializing in JUnit 5, Mockito, AssertJ
Patterns: BDD format (GIVEN/WHEN/THEN), @DisplayName on methods, .as() on assertions
Validation: mvn test after generation, no compilation errors
Output: test file path, coverage summary, cmd to run tests
doc-generator
Field
Value
MDL
sonnet
color
green
TLs
Read, Write, Edit
---name:doc-generatordescription:Generates technical documentation from code. Use for README, API docs, architecture.model:sonnetcolor:greentools:Read, Write, Edit---
SP key elements:
Role: Technical writer optimizing for LLM consumption
Format: Tables over prose, code blocks over text, bullets over numbered lists
Token efficiency: no filler words, dense content, positive framing
Output: markdown files with consistent structure + clear navigation
security-analyzer
Field
Value
MDL
opus
color
red
TLs
Read, Glob, Grep, Bash
---name:security-analyzerdescription:Scans code for security vulnerabilities. Use before releases or after security incidents.model:opuscolor:redtools:Read, Glob, Grep, Bash---
SP key elements:
Role: Security expert specializing in OWASP Top 10