Ruflo installs a control plane around coding agents
The full Ruflo path brings 98 agents, more than 60 commands, 30 skills, an MCP server, hooks, and a daemon into a Claude Code workspace. Codex gets its own AGENTS.md route. Ruflo then coordinates tasks, keeps memory between sessions, and can send work to different model providers. That is a meaningful step beyond adding a prompt file. You are installing a system that can influence how commands run and how work moves between agents.
The appeal is easy to understand once one agent becomes a small team. A security review, implementation, test pass, and documentation update can have separate owners while sharing task state. Ruflo also packages narrower jobs such as browser work, cost tracking, architecture records, and retrieval as plugins. The governing question is whether you need that coordination layer now. If your pain is simply weak code generation, adding 98 agent definitions will not fix the model underneath them.
What happened when we ran it
Our sandbox cloned commit fce8e6d into an unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and the lab-node:22 image. The checkout had 5,951 files, about 943,196 lines of source, and occupied 88.7 MB. We also found 31 CI workflow files, monorepo workspaces, a tests directory, and no Dockerfile at the measured root.
The frozen pnpm install failed after 62 seconds with exit code 1. Its final message was ERR_PNPM_LOCKFILE_CONFIG_MISMATCH: the current overrides configuration did not match the lockfile. The log also warned that pnpm ignored the pnpm.overrides field and did not support the workspaces field in package.json, directing the project to pnpm-workspace.yaml. It suggested rerunning with pnpm install --no-frozen-lockfile. We left the lockfile untouched.
That failure stopped the source evaluation at dependency installation. It provides no build result and no test result, even though the checkout contains tests. The finding is narrower than saying Ruflo never installs: the published npx package and plugin marketplace use different paths. It is still decisive for anyone cloning the repository to contribute, audit a release, or reproduce the package set. Commit fce8e6d did not clear the first frozen-install gate in our run.
The two install paths have different blast radii
The README separates a Claude Code plugin path from npx ruflo init. A plugin adds selected slash commands, skills, and agent definitions. The core plugin also registers its own MCP server. The full CLI route writes .claude/, .claude-flow/, CLAUDE.md, helper files, and settings, then enables hooks, memory, MCP, and a daemon. Treating those routes as interchangeable hides the biggest setup decision.
Start with core plus one feature whose effect you can observe. Commit your existing Claude Code and MCP configuration first, install into a disposable branch, and inspect every changed file. A 35-plugin catalog encourages browsing, but each installed hook adds code that may run during ordinary agent work. One plugin gives you a clean before-and-after comparison. The full initializer makes sense only after several Ruflo systems have already proved useful separately.
Node.js 20 or newer is the documented base, with npm, pnpm, or Bun as the package manager. Claude Code must be installed for the primary route. Model-backed tasks need provider credentials or a reachable local service such as Ollama. Native Windows users cannot use the POSIX curl | bash command as written. the README sends PowerShell and cmd users to npx ruflo init wizard. ChatGPT clients require Ruflo's HTTP transport on a remotely reachable MCP server.
Plugin verification is not a dependable safety boundary yet
Open issue #3557, filed on September 29, 2026, reports that ruflo plugins install --verify reads the flag but never uses it. The same report says a plugin's declared trust level and permissions are printed rather than enforced, and a local plugin can register enabled hooks and commands without a consent step. That is a concrete reason to inspect plugin code yourself instead of treating the install command as a security review.
Issue #3189 points to a separate release-check problem. Its September 30 update says witness verification found every referenced artifact missing because the scheduled environment had a source-only checkout without built output. The issue remained open after repeated runs. Neither report proves that every Ruflo plugin is unsafe. Together, they show that verification labels need their outputs checked, especially when an agent tool can execute commands with your account's filesystem and network access.
September activity is high, and so is the unresolved queue
GitHub showed 73,545 stars on September 30, 2026, with 685 open issues and 345 open pull requests. The repository was pushed that day, and recent issues had same-day comments and updates. Release v3.48.0 shipped on September 28. This is active maintenance, while a combined queue of 1,030 issues and pull requests also tells you that the project is changing faster than a small team can casually absorb.
Version v3.48.0 moved most internal @claude-flow/* packages off their alpha line, but @claude-flow/embeddings remained alpha. The release also mentions guarded federation registration, SQL injection hardening, and smaller package tarballs. Those are useful changes. They sit beside current reports about plugin permission enforcement, federation messages being rejected, and verification artifacts missing. Pin the exact release, read its open defects, and rehearse rollback before placing Ruflo in a repository with production credentials.
One plugin is the sensible first purchase of complexity
Our 62-second failure makes the recommendation simple for commit fce8e6d: do not adopt the source tree until its frozen install is reproducible. If one Ruflo plugin solves a named problem, test that plugin in a disposable repository and keep the diff. If you cannot name the coordination problem yet, Claude Code or Codex alone is the cleaner system to debug.