setup-gbrain
An agent skill by garrytan, from garrytan/gstack. Tags: cli, local-workflow, mcp, setup.
What it does
Set up gbrain for this coding agent: install the CLI, initialize a local PGLite or Supabase brain, register MCP, capture per-remote trust policy. (gstack)
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add garrytan/gstack --skill setup-gbrainOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/setup-gbrain ~/.claude/skills/setup-gbrainSafety box score
Grade F, high risk: 91 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill sets up gbrain by running local install/init commands, registering Claude Code MCP access, and optionally connecting to Supabase or a remote brain. The main risks are broad networked access to your notes and transcripts, plus destructive account and filesystem operations like project deletion, config rewrites, and backup/move/delete flows.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 3 (high) | It shells out to many local commands and helper binaries, including `gbrain init`, `gbrain migrate`, `claude mcp add`, `curl`, `bun run ...`, and setup scripts under `~/.claude/skills/gstack/bin/`, so it can execute a wide command surface under the user's account. |
| Network access | 3 (high) | It sends data to Supabase, remote MCP endpoints, and private git remotes, including `https://api.supabase.com/v1/projects`, `claude mcp add --transport http`, and the artifacts/transcript sync path that pushes local content off-machine. |
| Filesystem reach | 3 (high) | It reads and writes user-home state and config files such as `~/.gbrain/config.json`, `~/.claude.json`, `~/.gstack/`, and `CLAUDE.md`, and it includes destructive recovery paths like moving or deleting `~/.gbrain/config.json` and `~/.gbrain/pglite/`. |
| Secrets & credentials | 3 (high) | It explicitly handles high-value secrets and sensitive content: Supabase PATs, DB passwords, bearer tokens, pooler URLs, and full session transcripts from `~/.claude/projects/*` and `~/.codex/sessions/*`. |
| Privilege & persistence | 2 (moderate) | It makes user-scope system changes like `claude mcp add --scope user`, may install dependencies with `brew install gitleaks` or `apt install gitleaks`, and rewrites per-user config, but it does not require sudo. |
| Instruction hijack surface | 3 (high) | It tells the agent to treat the skill file as executable instructions, honor instruction blocks from `gstack-skill-start`, and auto-choose recommendations in spawned/unattended sessions, which is a strong instruction-following override surface. |
| Irreversible actions | 3 (high) | It can create Supabase projects, delete orphan projects with `DELETE` calls, migrate brains, register MCP connections, and push sync data to remote storage, all of which are account- or data-moving actions with external effects. |
| Transparency | 2 (moderate) | The workflow depends on many external helper binaries and scripts by path, such as `gstack-gbrain-install`, `gstack-gbrain-provision`, `gstack-gbrain-mcp-verify`, and `gstack-skill-start`, whose implementations are not included in the supplied files. |
Before installing
- Read `sections/brain-init.md` and `memory.md` if you will paste a PAT, bearer token, or allow transcript ingest.
- Confirm you accept writes to `~/.gbrain/config.json`, `~/.claude.json`, and `~/.gstack/` before running it.
- If you might use Path 4 or `--cleanup-orphans`, verify the remote MCP/Supabase account is the one you expect.
- Decide now whether remote transcript and artifact sync is acceptable, because this skill can move session data off-machine.
Rated 2026-10-16 by an automated review of 7 files from the skill's repository.
Source
- Repository
- garrytan/gstack (all skills from this repository)
- Path
- setup-gbrain/SKILL.md
- Branch
- main
- Updated
- 2026-10-05
Related skills
- agents-get-started — Use when a developer wants to create a new agent project or get started with AgentCore.
- setup-devops-agent — Setup and diagnostics for the AWS DevOps Agent MCP connection.
- caveman — Terse caveman voice: answer first, fluff gone, every technical fact kept. Use for /caveman, "caveman mode", "talk like caveman", "be brief", "less tokens".
- caveman-stats — Show recorded output and cache-read token usage and mode attribution for the current Claude Code session, or locate the host's native usage report.
- devcontainers — Set up local development environments with production parity for DigitalOcean App Platform.
- megacave — Caveman in Classical Chinese: 文言文 register, far fewer characters, technical terms verbatim. Invoke only with /megacave or /caveman wenyan.