Infinum AI Stack

Why a stack: building with AI without a shared setup produces inconsistent, hard-to-maintain results. After two years of practice we've packaged that setup — a workflow, skills installed per repo, and a platform that defines what "correct" means before the agent builds, gates every pull request, and measures what AI costs and delivers — living alongside the code it works on.

What's in the stack

PSDD ↗

Pragmatic Spec Driven Development — the 4-step workflow. Depth scales with the work.

Skills marketplace

PRD authoring, security audits, UI validation, local PR review — each one a separate plugin.

Sandbox kits ↗

Reusable kits for a claude Docker Sandbox — one command brings up a sandbox with the Infinum plugins, house rules, Caliber, and MCP servers in place.

Caliber ↓New

Our AI delivery platform. Defines specs up front, assures quality with audits and a human sign-off on every PR, and measures what AI costs and delivers — through one MCP server.

One-time setup

Install the stack with one command

Idempotent — re-run any time to update rules or pick up new plugins

A single setup script registers the Infinum marketplace in Claude Code, lays down team rules and personalization stubs, and walks you through an interactive prompt to install the skills you want. Re-runnable; safe.

$ pnpm dlx github:infinum/ai

How and why to use pnpm?

Project-level over user-level. When configuration lives in the repo, improvements travel with the project — not just with the engineer. Also installable via the pnpm dlx --allow-build=skills-cli skills CLI for Cursor, Copilot, and Firebender.

The four parts, in detail

PSDD — the workflow ↗

Pragmatic Spec Driven Development

Workflow

Infinum's 4-step workflow for shipping features with AI. The same four steps apply to every task — depth scales with complexity and risk.

→Understand. Remove uncertainty before anything else. PRD, technical brief, or short prompt — depth scales with risk.

→Design. Agree on the technical direction. No code yet. Ask the model how it would build it.

→Plan. Turn the agreed design into an ordered, reviewable plan. Last clear checkpoint before code runs.

→Build. The agent runs. Because the upfront work is done, it stays aligned. Corrections are fast and targeted.

Three lanes: small / low-risk compresses all four steps into one prompt; purely technical work skips the PRD for a tight technical brief; large or high-risk work gets every step in full. Read the full guide at infinum.github.io/ai/psdd. Caliber's prd, brief, tech-spec, and plan commands (04) produce the artifacts of the Understand, Design and Plan steps.

Skills — per-repo plugins

Install only what the project needs

Skills

Each skill is a separate installable plugin. Engineers add only what they need, updates ship per-skill, and the configuration lives next to the repo it works on. Improvements travel with the project — not just with the engineer. A selection of what we ship today:

create-prd

Generates a structured PRD in Markdown. Guided flow with clarifying questions, iterative refinement, and a consistent structure — goals, non-goals, user stories, acceptance criteria, constraints.

claude-setup-audit

Security audit of an engineer's AI tooling. Scans the local Claude Code installation for vulnerabilities, malicious code, prompt injection, and risks across every extensibility point. We audit our tools the way we audit our codebases.

ui-validation

Figma-vs-implementation diff before QA gets involved. Snapshot tests plus a multimodal visual comparison loop — implement with shared components, snapshot, fetch Figma, compare, fix or stop-and-ask. Framework-agnostic.

pr-review-code-simplicity

Local agentic PR review before you push. Reviews against the six laws of software design from Code Simplicity (Max Kanat-Alexander). Findings focus on long-term maintenance cost, not style.

package-security-check

Supply-chain audit of a package before you update it. Layered checks across GitHub source, registry metadata, install scripts, known CVEs, maintainer changes, and the version diff.

This is a selection, not the full catalogue. The marketplace grows continuously. Current list and install commands live in the repo at github.com/infinum/ai.

Sandbox kits — preconfigured sandboxes ↗

The stack, ready inside an isolated agent run

Sandboxes

A kit packages what a Docker Sandboxes claude sandbox needs — tools to install, network rules to allow, instructions for the agent — so the sandbox comes up ready for Infinum work with one command. Set up once in the kit, not by hand in every sandbox.

→infinum-full. The base Infinum kit: disables commit and PR attribution, installs the Infinum plugins and house rules, installs the Caliber plugin, registers the Context7 MCP server, and allows egress only to the hosts those need.

→Mixins. A kit is applied at sandbox creation, or added to a running sandbox. Applying one twice is safe — what is already installed counts as done.

→Sign-ins stay human. The Caliber and Context7 MCP servers are registered by the kit; a person signs in once inside the sandbox.

Kits live in the repo at github.com/infinum/ai/tree/main/sandbox-kits, with usage and a README per kit.

Caliber — the delivery platform

Define, assure, measure — through one MCP server

Platform

Infinum's AI delivery platform for software built with coding agents. Your agent talks to it through a single MCP server; people use the portal. It carries a PSDD spec from Step 1 to a merged pull request, and tells you what AI cost and what it delivered.

/caliber:prd /caliber:brief /caliber:tech-spec /caliber:plan /caliber:open-pr /caliber:check /caliber:fix

→Define. PRD, technical brief, tech spec, and plan — written from the agent following PSDD, reviewed and approved by people in the portal before any code is built.

→Assure. Every pull request gets a Caliber status from the project's audits — code, security, spec conformance — plus a person's sign-off. Runs on push from your machine, by command, or in CI. Only findings leave the machine, never source files.

→Measure. AI cost and code activity per project, repository, team, and person; DORA; finding outcomes; tracked time. AI stats are part of Caliber, on its Insights pages.

→Agent-agnostic. Claude Code through the plugin; Cursor, Copilot, Codex, and others through the MCP URL. Each person signs in with their own account.

01 spec

The agent writes the PRD or brief, then the tech spec and plan. People approve in the portal.

02 build

The agent implements against the approved plan, in your repo.

03 check

Audits run on push or on command. Blocking findings get fixed with a test each.

04 PR

The pull request carries its Caliber status. A human signs off and merges.

Connect Claude Code once: /plugin marketplace add infinum/caliber-plugin, then /plugin install caliber@caliber, sign in via /mcp, and run /caliber:setup once per repository. Plugin repo: github.com/infinum/caliber-plugin.

Talk to us about Caliber More at caliber.infinum.com — reach out to see it in action or use it on your project.

Glossary

Terms used in the stack

The Stack

The packaged combination of workflow, skills, sandbox kits, and delivery platform that Infinum engineers install per-repo. Described in this document.

PSDD

Pragmatic Spec Driven Development — Infinum's 4-step workflow for building with AI. Full guide at infinum.github.io/ai/psdd.

Skill

A focused, reusable instruction set installed as a plugin. Defined in a SKILL.md file. Each Infinum skill ships as its own plugin so engineers install only what they need.

Sandbox kit

A Docker Sandboxes mixin that configures a claude sandbox at creation — tools, network rules, agent instructions. infinum-full is the base Infinum kit. Kits live at github.com/infinum/ai/tree/main/sandbox-kits.

Caliber

Infinum's AI delivery platform. Defines specs (Define), gates every pull request with audits and a human sign-off (Assure), and measures AI cost and delivery (Measure). Agents connect through one MCP server; Claude Code via infinum/caliber-plugin. More at caliber.infinum.com; talk to us to learn more.

InfinumAI Stack.

Infinum
AI Stack.