Ruflo's install paths are two different products

Ruflo (formerly Claude Flow) is an open-source toolkit for coordinating AI agents around Claude Code and Codex. Its documented features include specialist agent roles, shared memory and automated workflows.

For a feature build, you could use it to organise planning, implementation and testing across agents, keeping context between steps. That is the appeal if you are already using coding agents and want repeatable teamwork. The next decision is how much of that system to install.

TL;DR: Ruflo's own quick-start table describes two installs with different authority. The plugin path can add commands and agent definitions without writing project files. The full CLI path adds project configuration, MCP, hooks and a daemon. Evaluate them as different products.

The choice is not lite versus complete

At the repository snapshot I reviewed on September 11, the plugin column says “zero” workspace files. The full npx ruflo init column lists .claude/, .claude-flow/, CLAUDE.md, helpers and settings, alongside an MCP server, hooks and a daemon. Those are not feature tiers on one trust boundary. They change what can persist, execute and reach credentials.

That distinction matters because Ruflo's maintainers published a critical security advisory on July 1. A default Docker Compose deployment before version 3.16.3 exposed an unauthenticated MCP bridge and MongoDB on all interfaces; version 3.16.3 is listed as patched. This does not mean the current release carries the flaw. It does mean that ports, tool gates and secret access are part of the product you are evaluating, not setup trivia.

My test would start smaller than the README's recommended full path. Pin the exact version you reviewed. Use a disposable repository with no production credentials. Inventory files, processes, ports and MCP tools before and after installing one plugin. Move to the full CLI only when a specific workflow needs its hooks, memory or background process. That is my proposed evaluation, not a test I ran on Ruflo.

Read the repository with its seams showing

The source is unusually useful because it names the two surfaces directly. It is also moving fast: the same README says both 98 and 100-plus agents, package.json reports version 3.41.2, while SECURITY.md still lists 3.5.x as the supported line. I would not use any of those counts as a buying metric.

I inspected the README, package metadata, security policy and maintainer advisory at commit df87b0d; I did not install or execute the code, reproduce the vulnerability, or independently test its security claims. For the broader loading-dock risk, see why agent frameworks magnify install risk.

Choose the authority envelope first; features come after you know what the install can write, run and reach.