https://origin-main.com/wp-content/uploads/2026/08/feat-8813-1.png
🕒 6 Minute Read 📅 Date Published: August 9, 2026
AI coding agents write functional PHP fast, but speed isn’t the same as adherence. Left alone, an agent will happily produce verbose control flow, stale docblocks, and framework anti-patterns that any senior reviewer would bounce in code review. Spatie tackled this by packaging their production coding standards as spatie guidelines skills for Laravel Boost, a machine-readable format that agents like Claude Code, Cursor, and GitHub Copilot can load on demand instead of guessing at your team’s conventions.
This article is part of our wider AI Architecture Module coverage of agent tooling, where Laravel Boost and MCP infrastructure provide coding agents the context they need to ensure AI-generated code follows vendor-specified conventions, not just that it compiles.
If you haven’t wired up the transport layer yet, our guide to rolling out Boost across a Laravel 13 project covers the installation and agent registration steps this article assumes.
The skill activation pipeline
Why machine-readable skills beat static prompt files
A .cursorrules file or a bloated CLAUDE.md gets loaded into every single turn whether it’s relevant or not. That’s wasted context on a JavaScript formatting rule while you’re editing a migration. Skills packages solve this differently.
- Context on demand. Agents activate
spatie-laravel-phporspatie-securityonly when the file being touched matches, not on every prompt. - Team-wide consistency. Installing through Composer means every engineer, and every CI runner, pulls the identical ruleset. No copy-pasted markdown drifting between machines.
- One-command updates. Spatie ships changes to the package; your team pulls them with a single sync command instead of manually re-pasting guideline files.
[Architect’s Note] The distinction matters more than it sounds. A prompt file is advisory, the agent reads it and might follow it. A skill is conditional, it fires deterministically on file type and task. That’s the difference between a suggestion and a guardrail.
Installing Spatie’s guidelines skills via Laravel Boost
Laravel Boost is the primary transport for registering skill packages inside a Laravel 13 project. Install both dev dependencies through Composer:
composer require laravel/boost --dev composer require spatie/guidelines-skills --dev
Link the repository immediately, before you run anything else: spatie/guidelines-skills on GitHub. That’s the source of truth for the skill definitions you’re about to install, and it’s the first place to check when a rule looks off.
Running the installer
php artisan boost:install
Select Spatie guidelines from the vendor list, then choose your active coding agent. Boost writes the agent binding files, one skill per convention area: spatie-laravel-php, spatie-javascript, spatie-version-control, and spatie-security.
[Production Pitfall] Don’t skip
.boost/skills/in your.gitignoreby habit. Teams that treat generated agent config as disposable end up with every developer running a different skill version locally, which defeats the entire point of pulling this through Composer in the first place.
Running outside Laravel Boost: skills.sh and global Claude Code
Not every project runs Boost. A standalone JavaScript service, a non-Laravel PHP microservice, or a developer who just wants Spatie’s PHP conventions available everywhere still needs a path in.
Global Claude Code integration
To apply the conventions across every local repository without touching individual projects, register them in your user home directory:
mkdir -p ~/.claude && touch ~/.claude/CLAUDE.md curl -o ~/.claude/laravel-php-guidelines.md https://spatie.be/laravel-php-ai-guidelines.md echo -e '\n## Coding standards\nWhen working with Laravel/PHP projects, first read the coding guidelines at @~/.claude/laravel-php-guidelines.md' >> ~/.claude/CLAUDE.md
Runtime-agnostic install via skills.sh
For non-Laravel services, install through the cross-runtime skills.sh registry directly:
npx skills add spatie/guidelines-skills
This gets you the same four skills without a Composer dependency, and it’s the path that works across Claude Code, Cursor, Codex, and Copilot uniformly.
[Word to the Wise] If your team runs a mixed stack, decide up front which install method is canonical for which repo type. Having half your services pull skills through Boost and the other half through skills.sh isn’t wrong, but it does mean two update commands to remember, and someone will forget the second one.
Keeping guidelines current: Context7 and CI sync
Enforcing syntax conventions only solves half the problem. When an agent generates code against a specific Spatie package, spatie/laravel-permission, spatie/laravel-medialibrary, it needs accurate, current API signatures, not whatever the model’s training data happened to capture. That’s a separate failure mode from style drift, and it’s the one that produces confidently wrong method calls.
To close that gap, wire in the Context7 MCP server. For background on building or extending your own protocol gateways, see our guide on production MCP server infrastructure in Laravel.
{
"mcpServers": {
"context7": {
"command": "npx",
"args": ["-y", "@upstash/context7-mcp@latest"]
}
}
}
With this configured, an agent implementing a Spatie package feature queries Context7 for live documentation instead of relying on stale training data.
Automating the sync
Guidelines evolve. Keeping every developer’s local skill definitions current, and catching drift in CI before it ships, means treating the sync as a scripted step rather than a reminder in Slack:
{
"scripts": {
"update-ai-skills": [
"composer update spatie/guidelines-skills",
"php artisan boost:update"
]
}
}
Run composer run update-ai-skills during local setup and again as a pull-request check. This is the same discipline we cover in our CI pipeline guide for AI applications: the goal isn’t just passing tests, it’s guaranteeing the agent instructions in front of every contributor match the security and architectural rules currently in force.
[Efficiency Gain] Bundling
boost:updateinto the same CI step you already run for schema validation costs you nothing extra in pipeline time and removes an entire class of “works on my machine, why is the agent doing something different” tickets.
Operational guardrails for teams at scale
A few practices separate a clean rollout from one that quietly rots over six months.
- Prune unused skill drivers. If your application is a pure API backend, disable
spatie-javascript. Every active skill costs agent context; loading rules for code you don’t write is pure waste. - Audit generated output, don’t trust it blindly. Skills reduce style violations, they don’t eliminate the need for review. Check that agent-produced code actually respects PSR-12 and Spatie’s return-type conventions rather than assuming the skill fired correctly.
- Keep automated formatting as your final gate. AI guidelines catch structural and naming issues; a
vendor/bin/pintpre-commit hook is still your deterministic backstop for whitespace and formatting drift that skills won’t always reach. - Match your local environment to what CI enforces. If your team’s dev containers differ from what agents run against locally, guideline enforcement gets inconsistent fast. Our breakdown of a 2026 Laravel AI development stack covers keeping that parity intact.
[Edge Case Alert] Watch for skill collisions when a project pulls in guidelines from more than one vendor package. If a second guidelines package also defines a
spatie-laravel-php-equivalent skill, Boost doesn’t merge them, it’s whichever one installs last. Audit.boost/skills/after any multi-package install, not just after a single-package one.
Where this fits in your AI governance stack
Guidelines skills solve a narrower problem than most of what we cover in Production-Grade AI Architecture in Laravel: they’re about what the agent writes, not what it decides or how much it costs to run. But narrow doesn’t mean small. Style and convention drift is one of the quieter failure modes in agentic development, it doesn’t throw an exception, it just accumulates until a codebase written by five different agent sessions looks like it was written by five different developers who never talked to each other.
The pattern here generalizes past Spatie’s specific rules. Any team with an opinionated internal style guide can package it the same way: distilled into skills, distributed through Boost or skills.sh, kept current through Context7 and a CI sync step. The specific package changes. The architecture, deterministic, versioned, and enforced at the point of generation rather than the point of review, doesn’t.
Additional external references
– Laravel Boost documentation (https://spatie.be/guidelines/ai)
– Context7 MCP server on GitHub (https://github.com/upstash/context7)
Frequently Asked Questions
Does spatie/guidelines-skills replace spatie/boost-spatie-guidelines?
Yes. The older package was Boost-only; the new one works with both Boost and skills.sh, and covers everything the old package did.
Do I need Laravel Boost to use Spatie’s guidelines?
No. The skills.sh install path (npx skills add spatie/guidelines-skills) works independently of Boost, which matters for non-Laravel services in a polyglot stack.
Will these skills conflict with my own custom AI guideline files?
Not automatically, but they can collide if another package defines a similarly named skill. Audit .boost/skills/ after installing, especially in multi-package setups.
Does this replace code review?
No. Skills reduce the volume of style and convention violations an agent introduces; they don’t replace human review or your automated formatting gate (Pint).
Dewald Hugo
A software architect with 15+ years of experience in the PHP and Laravel ecosystem. Dewald created Origin Main to provide the engineering rigour required to integrate AI into professional, high-concurrency production systems. He writes for developers who care less about "getting it to work" and more about "getting it to last".
Laravel News Links



















