gstack Review 2026: What Garry Tan's Stack Doesn't Cover

gstack — github.com/garrytan/gstack — is the most-starred Claude Code configuration on GitHub: 122,000+ stars since March 2026, MIT-licensed, actively maintained by Garry Tan, President and CEO of Y Combinator. The short verdict first: it is excellent at what it targets, and what it targets is the engineering workflow — planning, review, QA, release. What it deliberately does not touch is the business layer: growth, distribution, revenue automation, and the commerce-specific failure modes that cost real money. We operate a 4,000-product store end-to-end on Claude Code, so this is a field report from an operator — including where gstack is simply better than what we had, and where it stops.

What gstack is

gstack turns Claude Code into a virtual engineering team through 23 role definitions and a set of slash-command skills. The roles map to a startup org chart: a CEO who challenges the product plan (/plan-ceo-review), an engineering manager who locks architecture (/plan-eng-review), a designer with an explicit mandate to catch AI-generated visual slop, a reviewer (/review), a QA lead that drives a real browser against your staging URL (/qa), a Chief Security Officer running OWASP and STRIDE audits (/cso), and a release engineer (/ship, /canary). Everything is Markdown, everything installs in about thirty seconds, everything is free.

Tan's framing is the Karpathy line from the No Priors podcast — barely typing code anymore — and his own claimed numbers: three production services and forty-plus features shipped in sixty days, part-time, while running YC. Discount founder-math however you like; the repo's activity log is public and the cadence is real.

Where gstack genuinely shines

Three things stood out when we evaluated it against our own production setup.

The adversarial planning gauntlet. Running a feature idea through a CEO review, an engineering review, and a design review as separate opinionated passes catches a class of problem that a single planning prompt misses. This mirrors what we learned independently: our highest-leverage agent is an adversarial verifier whose only job is to break changes before they ship. Different implementations, same insight — separation of roles beats self-review.

QA that opens a real browser. /qa drives an actual browser session against staging. Most Claude Code setups — including many paid ones — verify by reading code. Reading code is not verification; we learned that the expensive way when a page returned HTTP 200 while streaming a 404 body, invisible to every monitor we had.

Change-control modes. /careful, /freeze, and /guard put explicit friction around risky changes. This is the same philosophy as our trust-boundary rule, which blocks any commit touching payment or auth code until a written security checklist is acknowledged. gstack generalizes the idea into a mode you can enter and leave.

The layer gstack deliberately doesn't cover

Read the role list again: CEO, eng manager, designer, reviewer, QA, security, release. Every one of them exists to ship code. None of them exists to sell what shipped. There is no SEO auditor, no analytics synthesis, no content pipeline, no conversion optimizer, no marketplace distribution, no revenue recovery, no competitive intelligence. That is not a flaw — Tan runs YC, not an e-commerce site. It is a scope decision, and it is exactly where an operator's needs diverge from an engineer's.

Concretely, here is what a business running on Claude Code needs that no engineering stack provides. An analytics agent with a hard output contract — three anomalies, three ship-now actions, numbers mandatory — because "traffic looks fine" is how declines hide for a month. An abandoned-cart recovery sequence, because the week we shipped ours it re-engaged buyers who had tried to pay four times and failed. Marketplace automation with drip caps and a circuit breaker wired into the code, because a platform once suspended an account after 190 automated posts that its API happily accepted — moderation policy and rate limits are different systems, and only one of them documents itself. And commerce-specific hard rules: never remove a payment method without explicit approval, never blanket-noindex a category, fail closed when a price fetch errors. Each of those sentences is a scar with a date attached.

Run both — the compose model

This is not a "gstack vs us" conclusion, because the honest answer is compose them. gstack owns the inner loop: plan, build, review, QA, release. The business layer owns the outer loop: what to build for revenue, how it gets found, how it converts, and what must never break. The two share one design principle — opinionated roles with output contracts beat blank prompts — and zero overlapping files.

That outer loop is what we packaged from our own operation: the AI Growth Team Pack is the 13-agent marketing department plus the production scripts it drives; the Claude Code Production Pack is the full operating system including the incident-derived rule files; the $9 rule pack is the two-minute version; and the MCP Builder Kit covers turning your own tooling into a sellable MCP server. The backstory of how that config grew scar by scar is in the launch post.

Should you install gstack?

If you write software: yes, with one caution. The installer rewrites your CLAUDE.md and asserts its own opinions — including replacing your browser tooling with its /browse skill. On a fresh setup that is a feature. On a tuned configuration with its own hard-won rules, install selectively: read the skills, take the patterns you lack, keep your own operating law. That is what we did — our takeaways were the retro discipline, the OWASP/STRIDE audit lens as a second security opinion, and the freeze-mode pattern for payment paths.

And if you also have to sell what you ship — pair it with a business layer. Ours is available at wowhow.cloud — pay once, ship forever.