GStack: the Y Combinator pack for Claude Code

Y Combinator is not only a startup accelerator. It is also a huge machine for collecting methods: how to talk to users, how to audit a product, how to ship fast without breaking production, and how to make better decisions when everything moves quickly.

That is why gstack, released by Garry Tan, CEO of Y Combinator, is interesting. Not because it is magic, but because it puts a set of product-team reflexes directly into Claude Code.

The promise is simple: instead of using Claude Code like a solo developer, you give it a small team of roles and procedures.

What gstack is

GStack is an open source pack for Claude Code. It adds:

23 skills for recurring tasks
8 power tools to push Claude Code further
roles such as CEO, Engineering Manager, Designer, QA, Security, and Release Manager
workflows to audit, test, review, and prepare releases

In practice, it looks like context files, prompts, checklists, and conventions. That may sound basic.

But this is often where AI agents become truly useful: not in the raw model, but in the system around the model.

Why it is more interesting than a prompt pack

Most people still use Claude Code like this:

"Here is my problem, fix it."

That works for small bugs. But on a real SaaS, with security, payments, onboarding, technical debt, and regression risks, it is not enough.

GStack pushes Claude Code into a more team-like process:

Role	What it brings
Security	OWASP audit, threats, attack surfaces
QA	user flows, browser testing, regressions
Engineering Manager	planning, prioritization, technical tradeoffs
Designer	UX consistency, onboarding, product clarity
Release Manager	release prep, risks, checklist

It is not a real human team. But it creates a much stronger reasoning framework than a simple "improve my code" prompt.

My test on a production SaaS

To avoid staying theoretical, I tested it on my own production SaaS.

I asked gstack to analyze the product through several angles:

OWASP + STRIDE security audit
The goal was to identify classic risks: authentication, permissions, input validation, sensitive endpoints, and data exposure.
QA in a real Chromium browser
Not just reading code. The agent clicks through the interface, follows user journeys, and looks for places where the experience breaks.
Cross-model review with Claude + Codex
The idea is to avoid depending on one single point of view. Claude proposes, Codex challenges, then we compare conclusions.

The result was not perfect, but it was good enough to reveal concrete, prioritizable issues.

The real lesson: the agent alone is not enough

This test confirms an important point: the future of AI-assisted development is not only about "a better model".

A stronger model helps, of course. But what really changes the level is:

the context you give the agent
the roles you impose on it
the checklists it must follow
the tools it can access
how you verify its work

In other words, the developer who wins is not the one who writes the most prompts. It is the one who knows how to orchestrate.

Is gstack revolutionary?

I would be careful with the word "revolutionary".

Yes, part of gstack looks like prompts organized in Markdown files. But reducing it to "just prompts" misses the point.

In companies, a lot of value already lives in procedures: release checklists, security reviews, code standards, QA rituals, quality gates.

GStack shows how to turn those procedures into actionable context for an agent.

That is probably where dev teams are going: less magic, more systems.

Key takeaway

If you use Claude Code or Cursor on a real project, do not only look for the perfect prompt.

Build a system around your agent:

roles
rules
workflows
tests
cross-reviews
clear exit criteria

That is how you move from "AI helps me code" to "AI helps me ship properly".

I showed the full test in this video: https://mkc.sh/gstack?utm_source=blog

And if you want practical methods every week to become a better AI-assisted developer, I share them in The Agentic Dev: https://mkc.sh/the-agentic-dev?lead=gstack&utm_source=blog