Garry Tan open-sources gstack for Claude Code: what developers should know

Most developers using Claude Code start with a blank CLAUDE.md and build their own workflow from scratch. You invent your own review process, your own QA approach, your own release checklist. Some of that's intentional. Most of it is friction.

gstack is Garry Tan's answer to that problem. The YC CEO open-sourced his entire Claude Code setup as 23 opinionated slash-command skills, each mapped to a specific role in a software sprint. 108K stars in a few weeks tells you how many developers recognized the problem immediately.

What Happened

Garry Tan published gstack as a collection of Claude Code skills built from his own production workflow. The project is at v1.57.6.0 with 313 commits, 81 contributors, and active CI on both Linux and Windows. Every commit in the repo is co-authored with Claude Opus 4.8, as shown in the git log.

The latest release fixed 8 community bugs, including 4 security guards that were failing open, and added cross-session decision memory and gbrain dream-stage caching in v1.57.5.0. The cadence of fixes tells me this isn't a polished demo released for attention; it's a production tool being stress-tested by thousands of developers daily.

Installation is a one-command paste into Claude Code. Claude handles the rest: clones the repo, runs setup, and registers the skills. Team mode bootstraps shared repos, so teammates get gstack automatically, with update checks throttled to once per hour.

Key Features

• 23 slash-command skills in a sprint structure: Think, Plan, Build, Review, Test, Ship, Reflect. Each skill feeds output to the next. /office-hours writes a design doc that /plan-ceo-review reads. /plan-eng-review writes a test plan that /qa picks up.
• Real browser testing via /qa: Uses Playwright-backed Chromium with anti-bot stealth, cookie import from Chrome, Arc, and Brave, and a sidebar extension. The agent clicks through flows, takes screenshots, finds bugs, generates regression tests, and verifies fixes.
• Multi-model review via /codex: Brings in OpenAI's Codex CLI as a second reviewer. When both /review (Claude) and /codex (Codex) have run, you get a cross-model analysis showing which findings overlap and which are unique to each model.
• Security auditing via /cso: Runs OWASP Top 10 and STRIDE threat modeling with a confidence gate of 8/10 or higher required, 17 false-positive exclusions, and independent finding verification.
• 10-agent host support: Adapter configs for Codex CLI, Cursor, Factory Droid, OpenCode, Kiro, Hermes, Slate, GBrain, OpenClaw, and Claude Code. Setup auto-detects installed agents.
• Cross-session decision memory: /learn manages what gstack learned across sessions: patterns, pitfalls, and preferences that compound over time on your codebase.

Why It Matters

The sequencing is what makes this more than a collection of prompts. Running /autoplan triggers CEO review, then design review, then engineering review automatically, surfacing only taste decisions for human approval. That's a real sprint process, not ad hoc prompting.

I keep coming back to the v1.57.6.0 fix wave: 4 security guards failing open. That detail tells you something. This isn't a showcase repo; it's a tool with enough real-world usage that production security issues get found and fixed within hours. The 81 contributors and active CI confirm the same.

The /ship skill is the one I'd point teams toward first. It bootstraps test frameworks from scratch if a project doesn't have one, audits coverage on every run, and auto-invokes /document-release to keep docs current. That last part removes a real overhead: every PR from this workflow has updated documentation by default.

Example Use Case

A TypeScript team building a Next.js app runs /office-hours to describe a new feature, then /plan-eng-review for architecture diagrams and test matrices. After implementation, /review auto-fixes obvious issues and flags gaps in completeness. /qa https://staging.example.com opens a real browser, navigates the app, and generates regression tests for any bugs found. /ship runs tests, audits coverage, creates the PR, and updates the README.

The whole sequence produces a PR with test coverage, updated docs, and a structured body, all from slash commands typed into Claude Code. This is the workflow I'd walk through with a team that's been reinventing this from scratch on every project.

Competitive Context

Claude Code ships with a skills system but no pre-built skill packs for a complete development workflow. gstack provides exactly that, with an opinionated sprint structure rather than a loose collection of helpers.

The /codex skill's multi-model approach stands out. Most AI coding setups treat Claude and Codex as alternatives. gstack runs them through a review pipeline: Claude reviews first, Codex reviews independently, and the cross-model analysis surfaces where they agree and diverge. That's a more useful quality signal than either model alone.

The template system (SKILL.md files generated from .tmpl sources with resolver-based placeholder substitution) also means skills stay consistent across updates. CI checks freshness on every push, so stale skills don't silently ship.

My Take

gstack is Garry Tan's production Claude Code setup, open-sourced and maintained by 81 contributors. The 108K stars reflect how many developers have been building their own version of this from scratch and recognized what they were looking at.

At v1.57.6.0 with active bug fixes landing hourly, this has moved well past the "interesting fork material" stage. Fork it, strip out what doesn't fit your stack, and keep the structure that does.