Build exactly what the current problem requires.

Install - 10 seconds, no dependencies

No hooks, no Node, no build step. Just copy one file.

curl -O https://raw.githubusercontent.com/alvindemesadev/boring-engineering/main/SKILL.md
mkdir -p .claude/skills/boring-engineering && cp SKILL.md .claude/skills/boring-engineering/

Same path for .cursor/skills, .opencode/skills, .codex/skills - see all 40+

A quick example - same result, less to maintain

You say "send an email on signup." Without boring, the agent anticipates a future with many providers. With boring, it checks: is that futures real? No. So it stays direct.

export async function sendSignupEmail(user) {
  await mailer.send({ to: user.email,
    subject: 'Welcome',
    html: welcomeTemplate(user) });
}

How it works

Four checks. Stops at the first no. ~100 tokens when idle, full check only on task.

Final check: Can this be simpler? Did I add anything not asked for? If yes, revise.

Benchmark — does boring stay correct while cutting code? · v1.1 · Aug 2026

Inspired by ponytail's honest agentic benchmark and its post-mortem on #126 — same two-axis structure (size + safety), all tasks/prompts/scorers our own. Full GitHub write-up →

12 tickets (6 LOC + 6 safety) × 5 arms × 5 tries = 300 runs · opencode-go/muse-spark-1.2-contributor (GO, unbiased, 300/300) · fresh sandbox per cell · honest limitations at bottom.

Tier S — size & correctness (6 tickets)

Mean of 5 runs. Each ticket tempts an over-build. "Works" = node test.mjs passes.

Reading it: boring is the only arm that stays 100% on 5 of 6 tasks. Yagni is smallest everywhere (1–4 lines) because it is the one-liner pressure — and pays in correctness (50% on 3 tasks). Caveman is terse talk, not tighter building, so it lands near baseline on LOC.

Tier S-safety — does boring cut a guard? (6 surgical tasks)

Each seeds a file, safety requirement left implicit. Scorer executes against adversarial input. n=5.

* safe-path throttled on free tier (170 s timeouts across all arms after ~270 sequential calls) — excluded from headline until cooled rerun.

Safety headline (5 tasks with signal, 25 runs/arm): boring 90% safe (18/20 on the 4 non-trivial + csv/cache) vs ponytail 50% vs baseline 18% vs yagni 54%. The 3 lines ponytail kept on formatJpy were not the guard — the guard yagni/ponytail cut is auth-token (HMAC) — boring keeps it (75% vs 0%).

* 11 tasks with signal (safe-path pending). LOC = block lines for Tier S; Tier A will be git diff. Yagni is smallest by far and least correct — that is the trade boring's "never simplify away validation" rule blocks.

import { formatMoney } from './utils.js';
export function priceWithTax(c,a){
 return formatMoney(Math.round(c*(1+a)));
}

import { formatMoney } from './utils.js';
export function priceWithTax(c,a){
 return formatMoney(Math.round(c*(1+a)));
}

import { formatMoney } from './utils.js';
export function priceWithTax(cents, taxRate){
 const t=Math.round(cents*(1+taxRate));
 return formatMoney(t);
}

export async function sendWelcomeEmail(m,u){
 await m.send({to:u.email,subject:'Welcome!',text:'Hi '+u.name});
}

export async function sendWelcomeEmail(m,u){
 await m.send({to:u.email,subject:'Welcome!',text:'Hi '+u.name});
}

async function sendWelcomeEmail(mailer, user){
 await mailer.send({
  to: user.email,
  subject: 'Welcome!',
  text: 'Hi '+user.name,
 });
}
// missing export

const MAX=3;
export async function retry(fn){
 let e; for(let i=0;i<MAX;i++){
  try{return await fn()}catch(x){e=x}
 } throw e;
}

export async function retry(fn,a=3){
 let e; for(let i=0;i<a;i++){
  try{return await fn()}catch(x){e=x}
 } throw e;
}

export const retry=async f=>{
 for(let i=0;i<3;i++)try{return await f()}catch{}
};