Home
Softono
a

affaan-m

Professional software vendor delivering innovative solutions on the Softono platform. Specialized in both open-source and proprietary software development.

Total Products
2

Software by affaan-m

ECC
Open Source

ECC

**Language:** English | [Português (Brasil)](docs/pt-BR/README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md) | [日本語](docs/ja-JP/README.md) | [한국어](docs/ko-KR/README.md) | [Türkçe](docs/tr/README.md) | [Русский](docs/ru/README.md) | [Tiếng Việt](docs/vi-VN/README.md) | [ไทย](docs/th/README.md) | [Deutsch](docs/de-DE/README.md) | [Español](docs/es/README.md) # ECC ![ECC - the harness-native operator system for agentic work](assets/hero.png) [![Stars](https://img.shields.io/github/stars/affaan-m/ECC?style=flat)](https://github.com/affaan-m/ECC/stargazers) [![Forks](https://img.shields.io/github/forks/affaan-m/ECC?style=flat)](https://github.com/affaan-m/ECC/network/members) [![Contributors](https://img.shields.io/github/contributors/affaan-m/ECC?style=flat)](https://github.com/affaan-m/ECC/graphs/contributors) [![npm ecc-universal](https://img.shields.io/npm/dw/ecc-universal?label=ecc-universal%20weekly%20downloads&logo=npm)](https://www.npmjs.com/package/ecc-universal) [![npm ecc-agentshield](https://img.shields.io/npm/dw/ecc-agentshield?label=ecc-agentshield%20weekly%20downloads&logo=npm)](https://www.npmjs.com/package/ecc-agentshield) [![GitHub App Install](https://img.shields.io/badge/GitHub%20App-150%20installs-2ea44f?logo=github)](https://github.com/marketplace/ecc-tools) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) ![Shell](https://img.shields.io/badge/-Shell-4EAA25?logo=gnu-bash&logoColor=white) ![TypeScript](https://img.shields.io/badge/-TypeScript-3178C6?logo=typescript&logoColor=white) ![Python](https://img.shields.io/badge/-Python-3776AB?logo=python&logoColor=white) ![Go](https://img.shields.io/badge/-Go-00ADD8?logo=go&logoColor=white) ![Java](https://img.shields.io/badge/-Java-ED8B00?logo=openjdk&logoColor=white) ![Perl](https://img.shields.io/badge/-Perl-39457E?logo=perl&logoColor=white) ![Markdown](https://img.shields.io/badge/-Markdown-000000?logo=markdown&logoColor=white) > **182K+ stars** | **28K+ forks** | **170+ contributors** | **12+ language ecosystems** | **Cross-harness agent workflows** --- <div align="center"> **Language / 语言 / 語言 / Dil / Язык / Ngôn ngữ / Idioma** [**English**](README.md) | [Português (Brasil)](docs/pt-BR/README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md) | [日本語](docs/ja-JP/README.md) | [한국어](docs/ko-KR/README.md) | [Türkçe](docs/tr/README.md) | [Русский](docs/ru/README.md) | [Tiếng Việt](docs/vi-VN/README.md) | [ไทย](docs/th/README.md) | [Deutsch](docs/de-DE/README.md) | [Español](docs/es/README.md) </div> --- **The harness-native operator system for agentic work. Built from real-world multi-harness engineering workflows.** Not just configs. A complete system: skills, instincts, memory optimization, continuous learning, security scanning, and research-first development. Production-ready agents, skills, hooks, rules, MCP configurations, and legacy command shims evolved over 10+ months of intensive daily use building real products. Works across **Codex**, **Claude Code**, **Cursor**, **OpenCode**, **Gemini**, **Zed**, **GitHub Copilot**, and other AI agent harnesses. ECC v2.0.0-rc.1 adds the public Hermes operator story on top of that reusable layer: start with the [Hermes setup guide](docs/HERMES-SETUP.md), then review the [rc.1 release notes](docs/releases/2.0.0-rc.1/release-notes.md) and [cross-harness architecture](docs/architecture/cross-harness.md). --- <table> <tr> <td width="25%" align="center"> <a href="https://ecc.tools/pricing"> <strong> ECC Pro</strong><br /> <sub>Private repos · GitHub App · $19/seat/mo</sub> </a> </td> <td width="25%" align="center"> <a href="https://github.com/sponsors/affaan-m"> <strong> Sponsor</strong><br /> <sub>Fund the OSS · From $5/mo</sub> </a> </td> <td width="25%" align="center"> <a href="https://github.com/affaan-m/ECC/discussions"> <strong>Community</strong> <br /> <sub>Discussions · Q&amp;A · Show & Tell</sub> </a> </td> <td width="25%" align="center"> <a href="https://github.com/apps/ecc-tools"> <strong> GitHub App</strong><br /> <sub>Install · PR audits · Free tier</sub> </a> </td> </tr> </table> <sub>**OSS stays free.** This repo is MIT-licensed forever. ECC Pro is the hosted GitHub App for private repos. <a href="https://github.com/sponsors/affaan-m">Sponsors</a> and <a href="https://ecc.tools/pricing">Pro subscribers</a> fund the work — that's why a single maintainer ships weekly across 7 harnesses.</sub> --- ## The Guides This repo is the raw code only. The guides explain everything. <table> <tr> <td width="33%"> <a href="https://x.com/affaanmustafa/status/2012378465664745795"> <img src="./assets/images/guides/shorthand-guide.png" alt="The Shorthand Guide to ECC" /> </a> </td> <td width="33%"> <a href="https://x.com/affaanmustafa/status/2014040193557471352"> <img src="./assets/images/guides/longform-guide.png" alt="The Longform Guide to ECC" /> </a> </td> <td width="33%"> <a href="https://x.com/affaanmustafa/status/2033263813387223421"> <img src="./assets/images/security/security-guide-header.png" alt="The Shorthand Guide to Everything Agentic Security" /> </a> </td> </tr> <tr> <td align="center"><b>Shorthand Guide</b><br/>Setup, foundations, philosophy. <b>Read this first.</b></td> <td align="center"><b>Longform Guide</b><br/>Token optimization, memory persistence, evals, parallelization.</td> <td align="center"><b>Security Guide</b><br/>Attack vectors, sandboxing, sanitization, CVEs, AgentShield.</td> </tr> </table> | Topic | What You'll Learn | |-------|-------------------| | Token Optimization | Model selection, system prompt slimming, background processes | | Memory Persistence | Hooks that save/load context across sessions automatically | | Continuous Learning | Auto-extract patterns from sessions into reusable skills | | Verification Loops | Checkpoint vs continuous evals, grader types, pass@k metrics | | Parallelization | Git worktrees, cascade method, when to scale instances | | Subagent Orchestration | The context problem, iterative retrieval pattern | --- ## What's New ### v2.0.0-rc.1 — Surface Refresh, Operator Workflows, and ECC 2.0 Alpha (Apr 2026) - **Dashboard GUI** — New Tkinter-based desktop application (`ecc_dashboard.py` or `npm run dashboard`) with dark/light theme toggle, font customization, and project logo in header and taskbar. - **Public surface synced to the live repo** — metadata, catalog counts, plugin manifests, and install-facing docs now match the actual OSS surface: 64 agents, 261 skills, and 84 legacy command shims. - **Operator and outbound workflow expansion** — `brand-voice`, `social-graph-ranker`, `connections-optimizer`, `customer-billing-ops`, `ecc-tools-cost-audit`, `google-workspace-ops`, `project-flow-ops`, and `workspace-surface-audit` round out the operator lane. - **Media and launch tooling** — `manim-video`, `remotion-video-creation`, and upgraded social publishing surfaces make technical explainers and launch content part of the same system. - **Framework and product surface growth** — `nestjs-patterns`, richer Codex/OpenCode install surfaces, and expanded cross-harness packaging keep the repo usable beyond Claude Code alone. - **Itô prediction-market skill pack** — `ito-market-intelligence`, `ito-basket-compare`, `ito-trade-planner`, `ito-data-atlas-agent`, `prediction-market-oracle-research`, and `prediction-market-risk-review` add public, non-advisory market/basket workflows while keeping live Itô API access gated and separate from ECC Tools billing. - **Optimization skill pack** — `parallel-execution-optimizer`, `benchmark-optimization-loop`, `data-throughput-accelerator`, `latency-critical-systems`, and `recursive-decision-ledger` turn repeated speed/recursion prompts into bounded benchmark, throughput, and decision-ledger workflows. - **ECC 2.0 alpha is in-tree** — the Rust control-plane prototype in `ecc2/` now builds locally and exposes `dashboard`, `start`, `sessions`, `status`, `stop`, `resume`, and `daemon` commands. It is usable as an alpha, not yet a general release. - **Operator status snapshots** — `ecc status --markdown --write status.md` turns the local state store into a portable handoff covering readiness, active sessions, skill-run health, install health, pending governance events, and linked work items from Linear/GitHub/handoffs. Use `ecc work-items upsert ...` for manual entries, `ecc work-items sync-github --repo owner/repo` for PR/issue queue state, and `ecc status --exit-code` to fail automation when readiness needs attention. - **Ecosystem hardening** — AgentShield, ECC Tools cost controls, billing portal work, and website refreshes continue to ship around the core plugin instead of drifting into separate silos. ### v1.9.0 — Selective Install & Language Expansion (Mar 2026) - **Selective install architecture** — Manifest-driven install pipeline with `install-plan.js` and `install-apply.js` for targeted component installation. State store tracks what's installed and enables incremental updates. - **6 new agents** — `typescript-reviewer`, `pytorch-build-resolver`, `java-build-resolver`, `java-reviewer`, `kotlin-reviewer`, `kotlin-build-resolver` expand language coverage to 10 languages. - **New skills** — `pytorch-patterns` for deep learning workflows, `documentation-lookup` for API reference research, `bun-runtime` and `nextjs-turbopack` for modern JS toolchains, plus 8 operational domain skills and `mcp-server-patterns`. - **Session & state infrastructure** — SQLite state store with query CLI, session adapters for structured recording, skill evolution foundation for self-improving skills. - **Orchestration overhaul** — Harness audit scoring made deterministic, orchestration status and launcher compatibility hardened, observer loop prevention with 5-layer guard. - **Observer reliability** — Memory explosion fix with throttling and tail sampling, sandbox access fix, lazy-start logic, and re-entrancy guard. - **12 language ecosystems** — New rules for Java, PHP, Perl, Kotlin/Android/KMP, C++, and Rust join existing TypeScript, Python, Go, and common rules. - **Community contributions** — Korean and Chinese translations, biome hook optimization, video processing skills, operational skills, PowerShell installer, Antigravity IDE support. - **CI hardening** — 19 test failure fixes, catalog count enforcement, install manifest validation, and full test suite green. ### v1.8.0 — Harness Performance System (Mar 2026) - **Harness-first release** — ECC is now explicitly framed as an agent harness performance system, not just a config pack. - **Hook reliability overhaul** — SessionStart root fallback, Stop-phase session summaries, and script-based hooks replacing fragile inline one-liners. - **Hook runtime controls** — `ECC_HOOK_PROFILE=minimal|standard|strict` and `ECC_DISABLED_HOOKS=...` for runtime gating without editing hook files. - **New harness commands** — `/harness-audit`, `/loop-start`, `/loop-status`, `/quality-gate`, `/model-route`. - **NanoClaw v2** — model routing, skill hot-load, session branch/search/export/compact/metrics. - **Cross-harness parity** — behavior tightened across Claude Code, Cursor, OpenCode, and Codex app/CLI. - **997 internal tests passing** — full suite green after hook/runtime refactor and compatibility updates. ### v1.7.0 — Cross-Platform Expansion & Presentation Builder (Feb 2026) - **Codex app + CLI support** — Direct `AGENTS.md`-based Codex support, installer targeting, and Codex docs - **`frontend-slides` skill** — Zero-dependency HTML presentation builder with PPTX conversion guidance and strict viewport-fit rules - **5 new generic business/content skills** — `article-writing`, `content-engine`, `market-research`, `investor-materials`, `investor-outreach` - **Broader tool coverage** — Cursor, Codex, and OpenCode support tightened so the same repo ships cleanly across all major harnesses - **992 internal tests** — Expanded validation and regression coverage across plugin, hooks, skills, and packaging ### v1.6.0 — Codex CLI, AgentShield & Marketplace (Feb 2026) - **Codex CLI support** — New `/codex-setup` command generates `codex.md` for OpenAI Codex CLI compatibility - **7 new skills** — `search-first`, `swift-actor-persistence`, `swift-protocol-di-testing`, `regex-vs-llm-structured-text`, `content-hash-cache-pattern`, `cost-aware-llm-pipeline`, `skill-stocktake` - **AgentShield integration** — `/security-scan` skill runs AgentShield directly from Claude Code; 1282 tests, 102 rules - **GitHub Marketplace** — ECC Tools GitHub App live at [github.com/marketplace/ecc-tools](https://github.com/marketplace/ecc-tools) with free/pro/enterprise tiers - **30+ community PRs merged** — Contributions from 30 contributors across 6 languages - **978 internal tests** — Expanded validation suite across agents, skills, commands, hooks, and rules ### v1.4.1 — Bug Fix (Feb 2026) - **Fixed instinct import content loss** — `parse_instinct_file()` was silently dropping all content after frontmatter (Action, Evidence, Examples sections) during `/instinct-import`. ([#148](https://github.com/affaan-m/ECC/issues/148), [#161](https://github.com/affaan-m/ECC/pull/161)) ### v1.4.0 — Multi-Language Rules, Installation Wizard & PM2 (Feb 2026) - **Interactive installation wizard** — New `configure-ecc` skill provides guided setup with merge/overwrite detection - **PM2 & multi-agent orchestration** — 6 new commands (`/pm2`, `/multi-plan`, `/multi-execute`, `/multi-backend`, `/multi-frontend`, `/multi-workflow`) for managing complex multi-service workflows - **Multi-language rules architecture** — Rules restructured from flat files into `common/` + `typescript/` + `python/` + `golang/` directories. Install only the languages you need - **Chinese (zh-CN) translations** — Complete translation of all agents, commands, skills, and rules (80+ files) - **GitHub Sponsors support** — Sponsor the project via GitHub Sponsors - **Enhanced CONTRIBUTING.md** — Detailed PR templates for each contribution type ### v1.3.0 — OpenCode Plugin Support (Feb 2026) - **Full OpenCode integration** — 12 agents, 24 commands, 16 skills with hook support via OpenCode's plugin system (20+ event types) - **3 native custom tools** — run-tests, check-coverage, security-audit - **LLM documentation** — `llms.txt` for comprehensive OpenCode docs ### v1.2.0 — Unified Commands & Skills (Feb 2026) - **Python/Django support** — Django patterns, security, TDD, and verification skills - **Java Spring Boot skills** — Patterns, security, TDD, and verification for Spring Boot - **Session management** — `/sessions` command for session history - **Continuous learning v2** — Instinct-based learning with confidence scoring, import/export, evolution See the full changelog in [Releases](https://github.com/affaan-m/ECC/releases). --- ## Quick Start Get up and running in under 2 minutes: ### Pick one path only Most Claude Code users should use exactly one install path: - **Recommended default:** install the Claude Code plugin, then copy only the rule folders you actually want. - **Use the manual installer only if** you want finer-grained control, want to avoid the plugin path entirely, or your Claude Code build has trouble resolving the self-hosted marketplace entry. - **Do not stack install methods.** The most common broken setup is: `/plugin install` first, then `install.sh --profile full` or `npx ecc-install --profile full` afterward. If you already layered multiple installs and things look duplicated, skip straight to [Reset / Uninstall ECC](#reset--uninstall-ecc). ### Low-context / no-hooks path If hooks feel too global or you only want ECC's rules, agents, commands, and core workflow skills, skip the plugin and use the minimal manual profile: ```bash ./install.sh --profile minimal --target claude ``` ```powershell .\install.ps1 --profile minimal --target claude # or npx ecc-install --profile minimal --target claude ``` This profile intentionally excludes `hooks-runtime`. If you want the normal core profile but need hooks off, use: ```bash ./install.sh --profile core --without baseline:hooks --target claude ``` Add hooks later only if you want runtime enforcement: ```bash ./install.sh --target claude --modules hooks-runtime ``` ### Find the right components first If you are not sure which ECC profile or component to install, ask the packaged advisor from any project: ```bash npx ecc consult "security reviews" --target claude ``` It returns matching components, related profiles, and preview/install commands. Use the preview command before installing if you want to inspect the exact file plan. For production ML/MLOps workflows, keep the install opt-in and component-scoped: ```bash npx ecc consult "mlops training model deployment" --target claude npx ecc install --profile minimal --target claude --with capability:machine-learning ``` ### Step 1: Install the Plugin (Recommended) > NOTE: The plugin is convenient, but the OSS installer below is still the most reliable path if your Claude Code build has trouble resolving self-hosted marketplace entries. ```bash # Add marketplace /plugin marketplace add https://github.com/affaan-m/ECC # Install plugin /plugin install ecc@ecc ``` ### Naming + Migration Note ECC now has three public identifiers, and they are not interchangeable: - GitHub source repo: `affaan-m/ECC` - Claude marketplace/plugin identifier: `ecc@ecc` - npm package: `ecc-universal` This is intentional. Anthropic marketplace/plugin installs are keyed by a canonical plugin identifier, so ECC uses `ecc@ecc` to keep tool names and slash-command namespaces short enough for strict Desktop/API validators. Older posts may still show the former long marketplace identifier; treat that as a legacy alias only. Separately, the npm package stayed on `ecc-universal`, so npm installs and marketplace installs intentionally use different names. ### Step 2: Install Rules Only If You Need Them > WARNING: **Important:** Claude Code plugins cannot distribute `rules` automatically. > > If you already installed ECC via `/plugin install`, **do not run `./install.sh --profile full`, `.\install.ps1 --profile full`, or `npx ecc-install --profile full` afterward**. The plugin already loads ECC skills, commands, and hooks. Running the full installer after a plugin install copies those same surfaces into your user directories and can create duplicate skills plus duplicate runtime behavior. > > For plugin installs, manually copy only the `rules/` directories you want under `~/.claude/rules/ecc/`. Start with `rules/common` plus one language or framework pack you actually use. Do not copy every rules directory unless you explicitly want all of that context in Claude. > > Use the full installer only when you are doing a fully manual ECC install instead of the plugin path. > > If your local Claude setup was wiped or reset, that does not mean you need to repurchase ECC. Start with `node scripts/ecc.js list-installed`, then run `node scripts/ecc.js doctor` and `node scripts/ecc.js repair` before reinstalling anything. That usually restores ECC-managed files without rebuilding your setup. If the problem is account or marketplace access for ECC Tools, handle billing/account recovery separately. ```bash # Clone the repo first git clone https://github.com/affaan-m/ECC.git cd ECC # Install dependencies (pick your package manager) npm install # or: pnpm install | yarn install | bun install # Plugin install path: copy only ECC rules into an ECC-owned namespace mkdir -p ~/.claude/rules/ecc cp -R rules/common ~/.claude/rules/ecc/ cp -R rules/typescript ~/.claude/rules/ecc/ # Fully manual ECC install path (use this instead of /plugin install) # ./install.sh --profile full ``` ```powershell # Windows PowerShell # Plugin install path: copy only ECC rules into an ECC-owned namespace New-Item -ItemType Directory -Force -Path "$HOME/.claude/rules/ecc" | Out-Null Copy-Item -Recurse rules/common "$HOME/.claude/rules/ecc/" Copy-Item -Recurse rules/typescript "$HOME/.claude/rules/ecc/" # Fully manual ECC install path (use this instead of /plugin install) # .\install.ps1 --profile full # npx ecc-install --profile full ``` For manual install instructions see the README in the `rules/` folder. When copying rules manually, copy the whole language directory (for example `rules/common` or `rules/golang`), not the files inside it, so relative references keep working and filenames do not collide. ### Fully manual install (Fallback) Use this only if you are intentionally skipping the plugin path: ```bash ./install.sh --profile full ``` ```powershell .\install.ps1 --profile full # or npx ecc-install --profile full ``` If you choose this path, stop there. Do not also run `/plugin install`. ### Reset / Uninstall ECC If ECC feels duplicated, intrusive, or broken, do not keep reinstalling it on top of itself. - **Plugin path:** remove the plugin from Claude Code, then delete the specific rule folders you manually copied under `~/.claude/rules/ecc/`. - **Manual installer / CLI path:** from the repo root, preview removal first: ```bash node scripts/uninstall.js --dry-run ``` Then remove ECC-managed files: ```bash node scripts/uninstall.js ``` You can also use the lifecycle wrapper: ```bash node scripts/ecc.js list-installed node scripts/ecc.js doctor node scripts/ecc.js repair node scripts/ecc.js uninstall --dry-run ``` ECC only removes files recorded in its install-state. It will not delete unrelated files it did not install. If you stacked methods, clean up in this order: 1. Remove the Claude Code plugin install. 2. Run the ECC uninstall command from the repo root to remove install-state-managed files. 3. Delete any extra rule folders you copied manually and no longer want. 4. Reinstall once, using a single path. ### Step 3: Start Using ```bash # Skills are the primary workflow surface. # Existing slash-style command names still work while ECC migrates off commands/. # Plugin install uses the canonical namespaced form /ecc:plan "Add user authentication" # Manual install keeps the shorter slash form: # /plan "Add user authentication" # Check available commands /plugin list ecc@ecc ``` **That's it!** You now have access to 64 agents, 261 skills, and 84 legacy command shims. ### Dashboard GUI Launch the desktop dashboard to visually explore ECC components: ```bash npm run dashboard # or python3 ./ecc_dashboard.py ``` **Features:** - Tabbed interface: Agents, Skills, Commands, Rules, Settings - Dark/Light theme toggle - Font customization (family & size) - Project logo in header and taskbar - Search and filter across all components ### Multi-model commands require additional setup > WARNING: `multi-*` commands are **not** covered by the base plugin/rules install above. > > To use `/multi-plan`, `/multi-execute`, `/multi-backend`, `/multi-frontend`, and `/multi-workflow`, you must also install the `ccg-workflow` runtime. > > Initialize it with `npx ccg-workflow`. > > That runtime provides the external dependencies these commands expect, including: > - `~/.claude/bin/codeagent-wrapper` > - `~/.claude/.ccg/prompts/*` > > Without `ccg-workflow`, these `multi-*` commands will not run correctly. --- ## Cross-Platform Support This plugin now fully supports **Windows, macOS, and Linux**, alongside tight integration across major IDEs (Cursor, Zed, OpenCode, Antigravity) and CLI harnesses. All hooks and scripts have been rewritten in Node.js for maximum compatibility. ### Package Manager Detection The plugin automatically detects your preferred package manager (npm, pnpm, yarn, or bun) with the following priority: 1. **Environment variable**: `CLAUDE_PACKAGE_MANAGER` 2. **Project config**: `.claude/package-manager.json` 3. **package.json**: `packageManager` field 4. **Lock file**: Detection from package-lock.json, yarn.lock, pnpm-lock.yaml, or bun.lockb 5. **Global config**: `~/.claude/package-manager.json` 6. **Fallback**: First available package manager To set your preferred package manager: ```bash # Via environment variable export CLAUDE_PACKAGE_MANAGER=pnpm # Via global config node scripts/setup-package-manager.js --global pnpm # Via project config node scripts/setup-package-manager.js --project bun # Detect current setting node scripts/setup-package-manager.js --detect ``` Or use the `/setup-pm` command in Claude Code. ### Hook Runtime Controls Use runtime flags to tune strictness or disable specific hooks temporarily: ```bash # Hook strictness profile (default: standard) export ECC_HOOK_PROFILE=standard # Comma-separated hook IDs to disable export ECC_DISABLED_HOOKS="pre:bash:tmux-reminder,post:edit:typecheck" # Cap SessionStart additional context (default: 8000 chars) export ECC_SESSION_START_MAX_CHARS=4000 # Disable SessionStart additional context entirely for low-context/local-model setups export ECC_SESSION_START_CONTEXT=off # Session-tmp retention window in days (default: 30). # Set to 0, off, false, disabled, never, or none to keep all sessions (disable pruning). export ECC_SESSION_RETENTION_DAYS=14 # Keep context/scope/loop warnings but suppress API-rate cost estimates export ECC_CONTEXT_MONITOR_COST_WARNINGS=off ``` Windows PowerShell: ```powershell [Environment]::SetEnvironmentVariable('ECC_CONTEXT_MONITOR_COST_WARNINGS', 'off', 'User') [Environment]::SetEnvironmentVariable('ECC_SESSION_RETENTION_DAYS', '14', 'User') ``` ### Agent data home (multi-harness isolation) Memory persistence hooks (session summaries, learned skills, session aliases, metrics) store data under a single agent data root. By default that root is `~/.claude`. When you use ECC in both Claude Code and Cursor on the same machine, set a separate root for Cursor so the two environments do not overwrite each other's session files: ```bash # Cursor-only boundary (Claude Code keeps the default ~/.claude) export ECC_AGENT_DATA_HOME="$HOME/.cursor/ecc" ``` Paths resolved under that root include: - `$ECC_AGENT_DATA_HOME/session-data/` — session summaries - `$ECC_AGENT_DATA_HOME/skills/learned/` — learned skills from evaluate-session - `$ECC_AGENT_DATA_HOME/session-aliases.json` — session aliases - `$ECC_AGENT_DATA_HOME/metrics/` — cost and activity metrics See [affaan-m/ECC#2065](https://github.com/affaan-m/ECC/issues/2065). --- ## What's Inside This repo is a **Claude Code plugin** - install it directly or copy components manually. ``` ECC/ |-- .claude-plugin/ # Plugin and marketplace manifests | |-- plugin.json # Plugin metadata and component paths | |-- marketplace.json # Marketplace catalog for /plugin marketplace add | |-- agents/ # 64 specialized subagents for delegation | |-- planner.md # Feature implementation planning | |-- architect.md # System design decisions | |-- tdd-guide.md # Test-driven development | |-- code-reviewer.md # Quality and security review | |-- security-reviewer.md # Vulnerability analysis | |-- build-error-resolver.md | |-- e2e-runner.md # Playwright E2E testing | |-- refactor-cleaner.md # Dead code cleanup | |-- doc-updater.md # Documentation sync | |-- docs-lookup.md # Documentation/API lookup | |-- chief-of-staff.md # Communication triage and drafts | |-- loop-operator.md # Autonomous loop execution | |-- harness-optimizer.md # Harness config tuning | |-- cpp-reviewer.md # C++ code review | |-- cpp-build-resolver.md # C++ build error resolution | |-- fsharp-reviewer.md # F# functional code review | |-- go-reviewer.md # Go code review | |-- go-build-resolver.md # Go build error resolution | |-- python-reviewer.md # Python code review | |-- database-reviewer.md # Database/Supabase review | |-- typescript-reviewer.md # TypeScript/JavaScript code review | |-- java-reviewer.md # Java/Spring Boot code review | |-- java-build-resolver.md # Java/Maven/Gradle build errors | |-- kotlin-reviewer.md # Kotlin/Android/KMP code review | |-- kotlin-build-resolver.md # Kotlin/Gradle build errors | |-- harmonyos-app-resolver.md # HarmonyOS/ArkTS app development | |-- rust-reviewer.md # Rust code review | |-- rust-build-resolver.md # Rust build error resolution | |-- pytorch-build-resolver.md # PyTorch/CUDA training errors | |-- mle-reviewer.md # Production ML pipeline, eval, serving, and monitoring review | |-- skills/ # Workflow definitions and domain knowledge | |-- coding-standards/ # Language best practices | |-- clickhouse-io/ # ClickHouse analytics, queries, data engineering | |-- backend-patterns/ # API, database, caching patterns | |-- frontend-patterns/ # React, Next.js patterns | |-- frontend-slides/ # HTML slide decks and PPTX-to-web presentation workflows (NEW) | |-- article-writing/ # Long-form writing in a supplied voice without generic AI tone (NEW) | |-- content-engine/ # Multi-platform social content and repurposing workflows (NEW) | |-- market-research/ # Source-attributed market, competitor, and investor research (NEW) | |-- investor-materials/ # Pitch decks, one-pagers, memos, and financial models (NEW) | |-- investor-outreach/ # Personalized fundraising outreach and follow-up (NEW) | |-- continuous-learning/ # Legacy v1 Stop-hook pattern extraction | |-- continuous-learning-v2/ # Instinct-based learning with confidence scoring | |-- iterative-retrieval/ # Progressive context refinement for subagents | |-- strategic-compact/ # Manual compaction suggestions (Longform Guide) | |-- tdd-workflow/ # TDD methodology | |-- security-review/ # Security checklist | |-- eval-harness/ # Verification loop evaluation (Longform Guide) | |-- verification-loop/ # Continuous verification (Longform Guide) | |-- videodb/ # Video and audio: ingest, search, edit, generate, stream (NEW) | |-- golang-patterns/ # Go idioms and best practices | |-- golang-testing/ # Go testing patterns, TDD, benchmarks | |-- cpp-coding-standards/ # C++ coding standards from C++ Core Guidelines (NEW) | |-- cpp-testing/ # C++ testing with GoogleTest, CMake/CTest (NEW) | |-- django-patterns/ # Django patterns, models, views (NEW) | |-- django-security/ # Django security best practices (NEW) | |-- django-tdd/ # Django TDD workflow (NEW) | |-- django-verification/ # Django verification loops (NEW) | |-- laravel-patterns/ # Laravel architecture patterns (NEW) | |-- laravel-security/ # Laravel security best practices (NEW) | |-- laravel-tdd/ # Laravel TDD workflow (NEW) | |-- laravel-verification/ # Laravel verification loops (NEW) | |-- python-patterns/ # Python idioms and best practices (NEW) | |-- python-testing/ # Python testing with pytest (NEW) | |-- quarkus-patterns/ # Java Quarkus patterns (NEW) | |-- quarkus-security/ # Quarkus security (NEW) | |-- quarkus-tdd/ # Quarkus TDD (NEW) | |-- quarkus-verification/ # Quarkus verification (NEW) | |-- springboot-patterns/ # Java Spring Boot patterns (NEW) | |-- springboot-security/ # Spring Boot security (NEW) | |-- springboot-tdd/ # Spring Boot TDD (NEW) | |-- springboot-verification/ # Spring Boot verification (NEW) | |-- configure-ecc/ # Interactive installation wizard (NEW) | |-- security-scan/ # AgentShield security auditor integration (NEW) | |-- java-coding-standards/ # Java coding standards (NEW) | |-- jpa-patterns/ # JPA/Hibernate patterns (NEW) | |-- postgres-patterns/ # PostgreSQL optimization patterns (NEW) | |-- nutrient-document-processing/ # Document processing with Nutrient API (NEW) | |-- docs/examples/project-guidelines-template.md # Template for project-specific skills | |-- database-migrations/ # Migration patterns (Prisma, Drizzle, Django, Go) (NEW) | |-- api-design/ # REST API design, pagination, error responses (NEW) | |-- deployment-patterns/ # CI/CD, Docker, health checks, rollbacks (NEW) | |-- docker-patterns/ # Docker Compose, networking, volumes, container security (NEW) | |-- e2e-testing/ # Playwright E2E patterns and Page Object Model (NEW) | |-- content-hash-cache-pattern/ # SHA-256 content hash caching for file processing (NEW) | |-- cost-aware-llm-pipeline/ # LLM cost optimization, model routing, budget tracking (NEW) | |-- regex-vs-llm-structured-text/ # Decision framework: regex vs LLM for text parsing (NEW) | |-- swift-actor-persistence/ # Thread-safe Swift data persistence with actors (NEW) | |-- swift-protocol-di-testing/ # Protocol-based DI for testable Swift code (NEW) | |-- search-first/ # Research-before-coding workflow (NEW) | |-- skill-stocktake/ # Audit skills and commands for quality (NEW) | |-- liquid-glass-design/ # iOS 26 Liquid Glass design system (NEW) | |-- foundation-models-on-device/ # Apple on-device LLM with FoundationModels (NEW) | |-- swift-concurrency-6-2/ # Swift 6.2 Approachable Concurrency (NEW) | |-- mle-workflow/ # Production ML data contracts, evals, deployment, monitoring (NEW) | |-- perl-patterns/ # Modern Perl 5.36+ idioms and best practices (NEW) | |-- perl-security/ # Perl security patterns, taint mode, safe I/O (NEW) | |-- perl-testing/ # Perl TDD with Test2::V0, prove, Devel::Cover (NEW) | |-- autonomous-loops/ # Autonomous loop patterns: sequential pipelines, PR loops, DAG orchestration (NEW) | |-- plankton-code-quality/ # Write-time code quality enforcement with Plankton hooks (NEW) | |-- codehealth-mcp/ # Optional CodeScene Code Health MCP skill (opt-in; not enabled by default) (NEW) | |-- commands/ # Maintained slash-entry compatibility; prefer skills/ | |-- plan.md # /plan - Implementation planning | |-- code-review.md # /code-review - Quality review | |-- build-fix.md # /build-fix - Fix build errors | |-- refactor-clean.md # /refactor-clean - Dead code removal | |-- quality-gate.md # /quality-gate - Verification gate | |-- learn.md # /learn - Extract patterns mid-session (Longform Guide) | |-- learn-eval.md # /learn-eval - Extract, evaluate, and save patterns (NEW) | |-- checkpoint.md # /checkpoint - Save verification state (Longform Guide) | |-- setup-pm.md # /setup-pm - Configure package manager | |-- go-review.md # /go-review - Go code review (NEW) | |-- go-test.md # /go-test - Go TDD workflow (NEW) | |-- go-build.md # /go-build - Fix Go build errors (NEW) | |-- skill-create.md # /skill-create - Generate skills from git history (NEW) | |-- instinct-status.md # /instinct-status - View learned instincts (NEW) | |-- instinct-import.md # /instinct-import - Import instincts (NEW) | |-- instinct-export.md # /instinct-export - Export instincts (NEW) | |-- evolve.md # /evolve - Cluster instincts into skills | |-- prune.md # /prune - Delete expired pending instincts (NEW) | |-- pm2.md # /pm2 - PM2 service lifecycle management (NEW) | |-- multi-plan.md # /multi-plan - Multi-agent task decomposition (NEW) | |-- multi-execute.md # /multi-execute - Orchestrated multi-agent workflows (NEW) | |-- multi-backend.md # /multi-backend - Backend multi-service orchestration (NEW) | |-- multi-frontend.md # /multi-frontend - Frontend multi-service orchestration (NEW) | |-- multi-workflow.md # /multi-workflow - General multi-service workflows (NEW) | |-- sessions.md # /sessions - Session history management | |-- test-coverage.md # /test-coverage - Test coverage analysis | |-- update-docs.md # /update-docs - Update documentation | |-- update-codemaps.md # /update-codemaps - Update codemaps | |-- python-review.md # /python-review - Python code review (NEW) |-- legacy-command-shims/ # Opt-in archive for retired shims such as /tdd and /eval | |-- tdd.md # /tdd - Prefer the tdd-workflow skill | |-- e2e.md # /e2e - Prefer the e2e-testing skill | |-- eval.md # /eval - Prefer the eval-harness skill | |-- verify.md # /verify - Prefer the verification-loop skill | |-- orchestrate.md # /orchestrate - Prefer dmux-workflows or multi-workflow | |-- rules/ # Always-follow guidelines (copy to ~/.claude/rules/ecc/) | |-- README.md # Structure overview and installation guide | |-- common/ # Language-agnostic principles | | |-- coding-style.md # Immutability, file organization | | |-- git-workflow.md # Commit format, PR process | | |-- testing.md # TDD, 80% coverage requirement | | |-- performance.md # Model selection, context management | | |-- patterns.md # Design patterns, skeleton projects | | |-- hooks.md # Hook architecture, TodoWrite | | |-- agents.md # When to delegate to subagents | | |-- security.md # Mandatory security checks | |-- typescript/ # TypeScript/JavaScript specific | |-- python/ # Python specific | |-- golang/ # Go specific | |-- swift/ # Swift specific | |-- php/ # PHP specific (NEW) | |-- arkts/ # HarmonyOS / ArkTS specific | |-- hooks/ # Trigger-based automations | |-- README.md # Hook documentation, recipes, and customization guide | |-- hooks.json # All hooks config (PreToolUse, PostToolUse, Stop, etc.) | |-- memory-persistence/ # Session lifecycle hooks (Longform Guide) | |-- strategic-compact/ # Compaction suggestions (Longform Guide) | |-- scripts/ # Cross-platform Node.js scripts (NEW) | |-- lib/ # Shared utilities | | |-- utils.js # Cross-platform file/path/system utilities | | |-- package-manager.js # Package manager detection and selection | |-- hooks/ # Hook implementations | | |-- session-start.js # Load context on session start | | |-- session-end.js # Save state on session end | | |-- pre-compact.js # Pre-compaction state saving | | |-- suggest-compact.js # Strategic compaction suggestions | | |-- evaluate-session.js # Extract patterns from sessions | |-- setup-package-manager.js # Interactive PM setup | |-- tests/ # Test suite (NEW) | |-- lib/ # Library tests | |-- hooks/ # Hook tests | |-- run-all.js # Run all tests | |-- contexts/ # Dynamic system prompt injection contexts (Longform Guide) | |-- dev.md # Development mode context | |-- review.md # Code review mode context | |-- research.md # Research/exploration mode context | |-- examples/ # Example configurations and sessions | |-- CLAUDE.md # Example project-level config | |-- user-CLAUDE.md # Example user-level config | |-- saas-nextjs-CLAUDE.md # Real-world SaaS (Next.js + Supabase + Stripe) | |-- go-microservice-CLAUDE.md # Real-world Go microservice (gRPC + PostgreSQL) | |-- django-api-CLAUDE.md # Real-world Django REST API (DRF + Celery) | |-- laravel-api-CLAUDE.md # Real-world Laravel API (PostgreSQL + Redis) (NEW) | |-- rust-api-CLAUDE.md # Real-world Rust API (Axum + SQLx + PostgreSQL) (NEW) | |-- mcp-configs/ # MCP server configurations | |-- mcp-servers.json # GitHub, Supabase, Vercel, Railway, etc. | |-- ecc_dashboard.py # Desktop GUI dashboard (Tkinter) | |-- assets/ # Assets for dashboard | |-- images/ | |-- ecc-logo.png | |-- marketplace.json # Self-hosted marketplace config (for /plugin marketplace add) ``` --- ## Ecosystem Tools ### Skill Creator Two ways to generate Claude Code skills from your repository: #### Option A: Local Analysis (Built-in) Use the `/skill-create` command for local analysis without external services: ```bash /skill-create # Analyze current repo /skill-create --instincts # Also generate instincts for continuous-learning-v2 ``` This analyzes your git history locally and generates SKILL.md files. #### Option B: GitHub App (Advanced) For advanced features (10k+ commits, auto-PRs, team sharing): [Install GitHub App](https://github.com/apps/skill-creator) | [ecc.tools](https://ecc.tools) ```bash # Comment on any issue: /skill-creator analyze # Or auto-triggers on push to default branch ``` Both options create: - **SKILL.md files** - Ready-to-use skills for Claude Code - **Instinct collections** - For continuous-learning-v2 - **Pattern extraction** - Learns from your commit history ### AgentShield — Security Auditor > Built at the Claude Code Hackathon (Cerebral Valley x Anthropic, Feb 2026). 1282 tests, 98% coverage, 102 static analysis rules. Scan your Claude Code configuration for vulnerabilities, misconfigurations, and injection risks. ```bash # Quick scan (no install needed) npx ecc-agentshield scan # Auto-fix safe issues npx ecc-agentshield scan --fix # Deep analysis with three Opus 4.6 agents npx ecc-agentshield scan --opus --stream # Generate secure config from scratch npx ecc-agentshield init ``` **What it scans:** CLAUDE.md, settings.json, MCP configs, hooks, agent definitions, and skills across 5 categories — secrets detection (14 patterns), permission auditing, hook injection analysis, MCP server risk profiling, and agent config review. **The `--opus` flag** runs three Claude Opus 4.6 agents in a red-team/blue-team/auditor pipeline. The attacker finds exploit chains, the defender evaluates protections, and the auditor synthesizes both into a prioritized risk assessment. Adversarial reasoning, not just pattern matching. **Output formats:** Terminal (color-graded A-F), JSON (CI pipelines), Markdown, HTML. Exit code 2 on critical findings for build gates. Use `/security-scan` in Claude Code to run it, or add to CI with the [GitHub Action](https://github.com/affaan-m/agentshield). [GitHub](https://github.com/affaan-m/agentshield) | [npm](https://www.npmjs.com/package/ecc-agentshield) ### Continuous Learning v2 The instinct-based learning system automatically learns your patterns: ```bash /instinct-status # Show learned instincts with confidence /instinct-import <file> # Import instincts from others /instinct-export # Export your instincts for sharing /evolve # Cluster related instincts into skills ``` See `skills/continuous-learning-v2/` for full documentation. Keep `continuous-learning/` only when you explicitly want the legacy v1 Stop-hook learned-skill flow. --- ## Requirements ### Claude Code CLI Version **Minimum version: v2.1.0 or later** This plugin requires Claude Code CLI v2.1.0+ due to changes in how the plugin system handles hooks. Check your version: ```bash claude --version ``` ### Important: Hooks Auto-Loading Behavior > WARNING: **For Contributors:** Do NOT add a `"hooks"` field to `.claude-plugin/plugin.json`. This is enforced by a regression test. Claude Code v2.1+ **automatically loads** `hooks/hooks.json` from any installed plugin by convention. Explicitly declaring it in `plugin.json` causes a duplicate detection error: ``` Duplicate hooks file detected: ./hooks/hooks.json resolves to already-loaded file ``` **History:** This has caused repeated fix/revert cycles in this repo ([#29](https://github.com/affaan-m/ECC/issues/29), [#52](https://github.com/affaan-m/ECC/issues/52), [#103](https://github.com/affaan-m/ECC/issues/103)). The behavior changed between Claude Code versions, leading to confusion. We now have a regression test to prevent this from being reintroduced. --- ## Installation ### Option 1: Install as Plugin (Recommended) The easiest way to use this repo - install as a Claude Code plugin: ```bash # Add this repo as a marketplace /plugin marketplace add https://github.com/affaan-m/ECC # Install the plugin /plugin install ecc@ecc ``` Or add directly to your `~/.claude/settings.json`: ```json { "extraKnownMarketplaces": { "ecc": { "source": { "source": "github", "repo": "affaan-m/ECC" } } }, "enabledPlugins": { "ecc@ecc": true } } ``` This gives you instant access to all commands, agents, skills, and hooks. > **Note:** The Claude Code plugin system does not support distributing `rules` via plugins ([upstream limitation](https://code.claude.com/docs/en/plugins-reference)). You need to install rules manually: > > ```bash > # Clone the repo first > git clone https://github.com/affaan-m/ECC.git > cd ECC > > # Option A: User-level rules (applies to all projects) > mkdir -p ~/.claude/rules/ecc > cp -r rules/common ~/.claude/rules/ecc/ > cp -r rules/typescript ~/.claude/rules/ecc/ # pick your stack > cp -r rules/python ~/.claude/rules/ecc/ > cp -r rules/golang ~/.claude/rules/ecc/ > cp -r rules/php ~/.claude/rules/ecc/ > > # Option B: Project-level rules (applies to current project only) > mkdir -p .claude/rules/ecc > cp -r rules/common .claude/rules/ecc/ > cp -r rules/typescript .claude/rules/ecc/ # pick your stack > ``` --- ### Option 2: Manual Installation If you prefer manual control over what's installed: ```bash # Clone the repo git clone https://github.com/affaan-m/ECC.git cd ECC # Copy agents to your Claude config cp agents/*.md ~/.claude/agents/ # Copy rules directories (common + language-specific) mkdir -p ~/.claude/rules/ecc cp -r rules/common ~/.claude/rules/ecc/ cp -r rules/typescript ~/.claude/rules/ecc/ # pick your stack cp -r rules/python ~/.claude/rules/ecc/ cp -r rules/golang ~/.claude/rules/ecc/ cp -r rules/php ~/.claude/rules/ecc/ cp -r rules/arkts ~/.claude/rules/ecc/ # Copy skills first (primary workflow surface) # Recommended (new users): core/general skills only mkdir -p ~/.claude/skills cp -r .agents/skills/* ~/.claude/skills/ cp -r skills/search-first ~/.claude/skills/ # Claude Code loads skills only from direct children of ~/.claude/skills. # Do not nest manual installs under ~/.claude/skills/ecc/. # Optional: add niche/framework-specific skills only when needed # for s in django-patterns django-tdd laravel-patterns springboot-patterns quarkus-patterns; do # cp -r skills/$s ~/.claude/skills/ # done # Optional: keep maintained slash-command compatibility during migration mkdir -p ~/.claude/commands cp commands/*.md ~/.claude/commands/ # Retired shims live in legacy-command-shims/commands/. # Copy individual files from there only if you still need old names such as /tdd. ``` #### Install hooks Do not copy the raw repo `hooks/hooks.json` into `~/.claude/settings.json` or `~/.claude/hooks/hooks.json`. That file is plugin/repo-oriented and is meant to be installed through the ECC installer or loaded as a plugin, so raw copying is not a supported manual install path. Use the installer to install only the Claude hook runtime so command paths are rewritten correctly: ```bash # macOS / Linux bash ./install.sh --target claude --modules hooks-runtime ``` ```powershell # Windows PowerShell pwsh -File .\install.ps1 --target claude --modules hooks-runtime ``` That writes resolved hooks to `~/.claude/hooks/hooks.json` and leaves any existing `~/.claude/settings.json` untouched. If you installed ECC via `/plugin install`, do not copy those hooks into `settings.json`. Claude Code v2.1+ already auto-loads plugin `hooks/hooks.json`, and duplicating them in `settings.json` causes duplicate execution and cross-platform hook conflicts. Windows note: the Claude config directory is `%USERPROFILE%\\.claude`, not `~/claude`. #### Configure MCPs Claude plugin installs intentionally do not auto-enable ECC's bundled MCP server definitions. This avoids overlong plugin MCP tool names on strict third-party gateways while keeping manual MCP setup available. Use Claude Code's `/mcp` command or CLI-managed MCP setup for live Claude Code server changes. Use `/mcp` for Claude Code runtime disables; Claude Code persists those choices in `~/.claude.json`. For repo-local MCP access, copy desired MCP server definitions from `mcp-configs/mcp-servers.json` into a project-scoped `.mcp.json`. If you already run your own copies of ECC-bundled MCPs, set: ```bash export ECC_DISABLED_MCPS="github,context7,exa,playwright,sequential-thinking,memory" ``` ECC-managed install and Codex sync flows will skip or remove those bundled servers instead of re-adding duplicates. `ECC_DISABLED_MCPS` is an ECC install/sync filter, not a live Claude Code toggle. **Important:** Replace `YOUR_*_HERE` placeholders with your actual API keys. --- ## Key Concepts ### Agents Subagents handle delegated tasks with limited scope. Example: ```markdown --- name: code-reviewer description: Reviews code for quality, security, and maintainability tools: ["Read", "Grep", "Glob", "Bash"] model: opus --- You are a senior code reviewer... ``` ### Skills Skills are the primary workflow surface. They can be invoked directly, suggested automatically, and reused by agents. ECC still ships maintained `commands/` during migration, while retired short-name shims live under `legacy-command-shims/` for explicit opt-in only. New workflow development should land in `skills/` first. ```markdown # TDD Workflow 1. Define interfaces first 2. Write failing tests (RED) 3. Implement minimal code (GREEN) 4. Refactor (IMPROVE) 5. Verify 80%+ coverage ``` ### Hooks Hooks fire on tool events. Example - warn about console.log: ```json { "matcher": "tool == \"Edit\" && tool_input.file_path matches \"\\\\.(ts|tsx|js|jsx)$\"", "hooks": [{ "type": "command", "command": "#!/bin/bash\ngrep -n 'console\\.log' \"$file_path\" && echo '[Hook] Remove console.log' >&2" }] } ``` ### Rules Rules are always-follow guidelines, organized into `common/` (language-agnostic) + language-specific directories: ``` rules/ common/ # Universal principles (always install) typescript/ # TS/JS specific patterns and tools python/ # Python specific patterns and tools golang/ # Go specific patterns and tools swift/ # Swift specific patterns and tools php/ # PHP specific patterns and tools arkts/ # HarmonyOS / ArkTS patterns and constraints ``` See [`rules/README.md`](rules/README.md) for installation and structure details. --- ## Which Agent Should I Use? Not sure where to start? Use this quick reference. Skills are the canonical workflow surface; maintained slash entries stay available for command-first workflows. | I want to... | Use this surface | Agent used | |--------------|-----------------|------------| | Plan a new feature | `/ecc:plan "Add auth"` | planner | | Design system architecture | `/ecc:plan` + architect agent | architect | | Write code with tests first | `tdd-workflow` skill | tdd-guide | | Review code I just wrote | `/code-review` | code-reviewer | | Fix a failing build | `/build-fix` | build-error-resolver | | Run end-to-end tests | `e2e-testing` skill | e2e-runner | | Find security vulnerabilities | `/security-scan` | security-reviewer | | Remove dead code | `/refactor-clean` | refactor-cleaner | | Update documentation | `/update-docs` | doc-updater | | Review Go code | `/go-review` | go-reviewer | | Review Python code | `/python-review` | python-reviewer | | Review F# code | *(invoke `fsharp-reviewer` directly)* | fsharp-reviewer | | Review TypeScript/JavaScript code | *(invoke `typescript-reviewer` directly)* | typescript-reviewer | | Develop HarmonyOS apps | *(invoke `harmonyos-app-resolver` directly)* | harmonyos-app-resolver | | Audit database queries | *(auto-delegated)* | database-reviewer | | Review production ML changes | `mle-workflow` skill + `mle-reviewer` agent | mle-reviewer | ### Common Workflows Slash forms below are shown where they remain part of the maintained command surface. Retired short-name shims such as `/tdd` and `/eval` live in `legacy-command-shims/` for explicit opt-in only. **Starting a new feature:** ``` /ecc:plan "Add user authentication with OAuth" → planner creates implementation blueprint tdd-workflow skill → tdd-guide enforces write-tests-first /code-review → code-reviewer checks your work ``` **Fixing a bug:** ``` tdd-workflow skill → tdd-guide: write a failing test that reproduces it → implement the fix, verify test passes /code-review → code-reviewer: catch regressions ``` **Preparing for production:** ``` /security-scan → security-reviewer: OWASP Top 10 audit e2e-testing skill → e2e-runner: critical user flow tests /test-coverage → verify 80%+ coverage ``` --- ## FAQ <details> <summary><b>How do I check which agents/commands are installed?</b></summary> ```bash /plugin list ecc@ecc ``` This shows all available agents, commands, and skills from the plugin. </details> <details> <summary><b>My hooks aren't working / I see "Duplicate hooks file" errors</b></summary> This is the most common issue. **Do NOT add a `"hooks"` field to `.claude-plugin/plugin.json`.** Claude Code v2.1+ automatically loads `hooks/hooks.json` from installed plugins. Explicitly declaring it causes duplicate detection errors. See [#29](https://github.com/affaan-m/ECC/issues/29), [#52](https://github.com/affaan-m/ECC/issues/52), [#103](https://github.com/affaan-m/ECC/issues/103). </details> <details> <summary><b>Can I use ECC with Claude Code on a custom API endpoint or model gateway?</b></summary> Yes. ECC does not hardcode Anthropic-hosted transport settings. It runs locally through Claude Code's normal CLI/plugin surface, so it works with: - Anthropic-hosted Claude Code - Official Claude Code gateway setups using `ANTHROPIC_BASE_URL` and `ANTHROPIC_AUTH_TOKEN` - Compatible custom endpoints that speak the Anthropic API Claude Code expects Minimal example: ```bash export ANTHROPIC_BASE_URL=https://your-gateway.example.com export ANTHROPIC_AUTH_TOKEN=your-token claude ``` If your gateway remaps model names, configure that in Claude Code rather than in ECC. ECC's hooks, skills, commands, and rules are model-provider agnostic once the `claude` CLI is already working. Official references: - [Claude Code LLM gateway docs](https://docs.anthropic.com/en/docs/claude-code/llm-gateway) - [Claude Code model configuration docs](https://docs.anthropic.com/en/docs/claude-code/model-config) </details> <details> <summary><b>My context window is shrinking / Claude is running out of context</b></summary> Too many MCP servers eat your context. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k. SessionStart context is capped at 8000 characters by default; lower it with `ECC_SESSION_START_MAX_CHARS=4000` or disable it with `ECC_SESSION_START_CONTEXT=off` for local-model or low-context setups. **Fix:** Disable unused MCPs from Claude Code with `/mcp`. Claude Code writes those runtime choices to `~/.claude.json`; `.claude/settings.json` and `.claude/settings.local.json` are not reliable toggles for already-loaded MCP servers. Keep under 10 MCPs enabled and under 80 tools active. </details> <details> <summary><b>Can I use only some components (e.g., just agents)?</b></summary> Yes. Use Option 2 (manual installation) and copy only what you need: ```bash # Just agents cp agents/*.md ~/.claude/agents/ # Just rules mkdir -p ~/.claude/rules/ecc/ cp -r rules/common ~/.claude/rules/ecc/ ``` Each component is fully independent. </details> <details> <summary><b>Does this work with Cursor / OpenCode / Codex / Antigravity / GitHub Copilot?</b></summary> Yes. ECC is cross-platform: - **Cursor**: Pre-translated configs in `.cursor/`. See [Cursor IDE Support](#cursor-ide-support). - **Gemini CLI**: Experimental project-local support via `.gemini/GEMINI.md` and shared installer plumbing. - **OpenCode**: Full plugin support in `.opencode/`. See [OpenCode Support](#opencode-support). - **Codex**: First-class support for both macOS app and CLI, with adapter drift guards and SessionStart fallback. See PR [#257](https://github.com/affaan-m/ECC/pull/257). - **GitHub Copilot (VS Code)**: Instruction and prompt layer via `.github/copilot-instructions.md`, `.vscode/settings.json`, and `.github/prompts/`. See [GitHub Copilot Support](#github-copilot-support). - **Antigravity**: Tightly integrated setup for workflows, skills, and flattened rules in `.agent/`. See [Antigravity Guide](docs/ANTIGRAVITY-GUIDE.md). - **JoyCode / CodeBuddy**: Project-local selective install adapters for commands, agents, skills, and flattened rules. See [JoyCode Adapter Guide](docs/JOYCODE-GUIDE.md). - **Qwen CLI**: Home-directory selective install adapter for commands, agents, skills, rules, and Qwen config. See [Qwen CLI Adapter Guide](docs/QWEN-GUIDE.md). - **Zed**: Project-local selective install adapter for `.zed/settings.json`, flattened rules, commands, agents, and skills. - **Non-native harnesses**: Manual fallback path for Grok and similar interfaces. See [Manual Adaptation Guide](docs/MANUAL-ADAPTATION-GUIDE.md). - **Claude Code**: Native — this is the primary target. </details> <details> <summary><b>How do I contribute a new skill or agent?</b></summary> See [CONTRIBUTING.md](CONTRIBUTING.md). The short version: 1. Fork the repo 2. Create your skill in `skills/your-skill-name/SKILL.md` (with YAML frontmatter) 3. Or create an agent in `agents/your-agent.md` 4. Submit a PR with a clear description of what it does and when to use it </details> --- ## Running Tests The plugin includes a comprehensive test suite: ```bash # Run all tests node tests/run-all.js # Run individual test files node tests/lib/utils.test.js node tests/lib/package-manager.test.js node tests/hooks/hooks.test.js ``` --- ## Contributing **Contributions are welcome and encouraged.** This repo is meant to be a community resource. If you have: - Useful agents or skills - Clever hooks - Better MCP configurations - Improved rules Please contribute! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. ### Ideas for Contributions - Language-specific skills (Rust, C#, Kotlin, Java) — Go, Python, Perl, Swift, TypeScript, and HarmonyOS/ArkTS already included - Framework-specific configs (Rails, FastAPI) — Django, NestJS, Spring Boot, and Laravel already included - DevOps agents (Kubernetes, Terraform, AWS, Docker) - Testing strategies (different frameworks, visual regression) - Domain-specific knowledge (ML, data engineering, mobile) ### Community Ecosystem Notes These are not bundled with ECC and are not audited by this repo, but they are worth knowing about if you are exploring the broader Claude Code skills ecosystem: - [claude-seo](https://github.com/AgriciDaniel/claude-seo) — SEO-focused skill and agent collection - [claude-ads](https://github.com/AgriciDaniel/claude-ads) — Ad-audit and paid-growth workflow collection - [claude-cybersecurity](https://github.com/AgriciDaniel/claude-cybersecurity) — Security-oriented skill and agent collection --- ## Cursor IDE Support ECC provides Cursor IDE support with hooks, rules, agents, skills, commands, and MCP configs adapted for Cursor's project layout. ### Quick Start (Cursor) ```bash # macOS/Linux ./install.sh --target cursor typescript ./install.sh --target cursor python golang swift php ``` ```powershell # Windows PowerShell .\install.ps1 --target cursor typescript .\install.ps1 --target cursor python golang swift php ``` ### What's Included | Component | Count | Details | |-----------|-------|---------| | Hook Events | 15 | sessionStart, beforeShellExecution, afterFileEdit, beforeMCPExecution, beforeSubmitPrompt, and 10 more | | Hook Scripts | 16 | Thin Node.js scripts delegating to `scripts/hooks/` via shared adapter | | Rules | 34 | 9 common (alwaysApply) + 25 language-specific (TypeScript, Python, Go, Swift, PHP) | | Agents | 48 | `.cursor/agents/ecc-*.md` when installed; prefixed to avoid collisions with user or marketplace agents | | Skills | Shared + Bundled | `.cursor/skills/` for translated additions | | Commands | Shared | `.cursor/commands/` if installed | | MCP Config | Shared | `.cursor/mcp.json` if installed | ### Cursor Loading Notes ECC does not install root `AGENTS.md` into `.cursor/`. Cursor treats nested `AGENTS.md` files as directory context, so copying ECC's repo identity into a host project would pollute that project. Cursor-native loading behavior can vary by Cursor build. ECC installs agents as `.cursor/agents/ecc-*.md`; if your Cursor build does not expose project agents, those files still work as explicit reference definitions instead of hidden global prompt context. ### Memory and data isolation (Cursor + Claude Code) ECC memory hooks reuse the same `scripts/hooks/*.js` as Claude Code. For Cursor, ECC tries to keep memory **out of `~/.claude` automatically**: 1. **Cursor `sessionStart` hook** (installed to `.cursor/hooks.json` on `--target cursor`) injects `ECC_AGENT_DATA_HOME` for the whole composer session. 2. **Hook runtime default** — when `CURSOR_VERSION` or `CURSOR_PROJECT_DIR` is present, hooks default to `~/.cursor/ecc` if the env var is unset. 3. **Project config** — `.cursor/ecc-agent-data.json` documents and overrides the path (`agentDataHome`). 4. **Always-on rule** — `.cursor/rules/ecc-agent-data-home.mdc` reminds the agent where memory lives. You can still override explicitly: ```bash export ECC_AGENT_DATA_HOME="$HOME/.cursor/ecc" ``` To **share** memory with Claude Code on purpose, set `ECC_AGENT_DATA_HOME=~/.claude` in the shell or in `.cursor/ecc-agent-data.json`. Continuous learning v2 instincts remain separate under `CLV2_HOMUNCULUS_DIR` (default `~/.local/share/ecc-homunculus`). ### Hook Architecture (DRY Adapter Pattern) Cursor has **more hook events than Claude Code** (20 vs 8). The `.cursor/hooks/adapter.js` module transforms Cursor's stdin JSON to Claude Code's format, allowing existing `scripts/hooks/*.js` to be reused without duplication. ``` Cursor stdin JSON → adapter.js → transforms → scripts/hooks/*.js (shared with Claude Code) ``` Key hooks: - **beforeShellExecution** — Blocks dev servers outside tmux (exit 2), git push review - **afterFileEdit** — Auto-format + TypeScript check + console.log warning - **beforeSubmitPrompt** — Detects secrets (sk-, ghp_, AKIA patterns) in prompts - **beforeTabFileRead** — Blocks Tab from reading .env, .key, .pem files (exit 2) - **beforeMCPExecution / afterMCPExecution** — MCP audit logging ### Rules Format Cursor rules use YAML frontmatter with `description`, `globs`, and `alwaysApply`: ```yaml --- description: "TypeScript coding style extending common rules" globs: ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"] alwaysApply: false --- ``` --- ## Codex macOS App + CLI Support ECC provides **first-class Codex support** for both the macOS app and CLI, with a reference configuration, Codex-specific AGENTS.md supplement, and shared skills. ### Quick Start (Codex App + CLI) ```bash # Run Codex CLI in the repo — AGENTS.md and .codex/ are auto-detected codex # Automatic setup: sync ECC assets (AGENTS.md, skills, MCP servers) into ~/.codex npm install && bash scripts/sync-ecc-to-codex.sh # or: pnpm install && bash scripts/sync-ecc-to-codex.sh # or: yarn install && bash scripts/sync-ecc-to-codex.sh # or: bun install && bash scripts/sync-ecc-to-codex.sh # Or manually: copy the reference config to your home directory cp .codex/config.toml ~/.codex/config.toml ``` The sync script safely merges ECC MCP servers into your existing `~/.codex/config.toml` using an **add-only** strategy — it never removes or modifies your existing servers. Run with `--dry-run` to preview changes, or `--update-mcp` to force-refresh ECC servers to the latest recommended config. For Context7, ECC uses the canonical Codex section name `[mcp_servers.context7]` while still launching the `@upstash/context7-mcp` package. If you already have a legacy `[mcp_servers.context7-mcp]` entry, `--update-mcp` migrates it to the canonical section name. Codex macOS app: - Open this repository as your workspace. - The root `AGENTS.md` is auto-detected. - `.codex/config.toml` and `.codex/agents/*.toml` work best when kept project-local. - The reference `.codex/config.toml` intentionally does not pin `model` or `model_provider`, so Codex uses its own current default unless you override it. - Optional: copy `.codex/config.toml` to `~/.codex/config.toml` for global defaults; keep the multi-agent role files project-local unless you also copy `.codex/agents/`. ### What's Included | Component | Count | Details | |-----------|-------|---------| | Config | 1 | `.codex/config.toml` — top-level approvals/sandbox/web_search, MCP servers, notifications, profiles | | AGENTS.md | 2 | Root (universal) + `.codex/AGENTS.md` (Codex-specific supplement) | | Skills | 32 | `.agents/skills/` — SKILL.md + agents/openai.yaml per skill | | MCP Servers | 6 | GitHub, Context7, Exa, Memory, Playwright, Sequential Thinking (7 with Supabase via `--update-mcp` sync) | | Profiles | 2 | `strict` (read-only sandbox) and `yolo` (full auto-approve) | | Agent Roles | 3 | `.codex/agents/` — explorer, reviewer, docs-researcher | ### Skills Skills at `.agents/skills/` are auto-loaded by Codex: Canonical Anthropic skills such as `claude-api`, `frontend-design`, and `skill-creator` are intentionally not re-bundled here. Install those from [`anthropics/skills`](https://github.com/anthropics/skills) when you want the official versions. | Skill | Description | |-------|-------------| | agent-introspection-debugging | Debug agent behavior, routing, and prompt boundaries | | agent-sort | Sort agent catalogs and assignment surfaces | | api-design | REST API design patterns | | article-writing | Long-form writing from notes and voice references | | backend-patterns | API design, database, caching | | brand-voice | Source-derived writing style profiles from real content | | bun-runtime | Bun as runtime, package manager, bundler, and test runner | | coding-standards | Universal coding standards | | codehealth-mcp | Optional — Code Health MCP (opt-in server + token); structural review and commit/PR gates | | content-engine | Platform-native social content and repurposing | | crosspost | Multi-platform content distribution across X, LinkedIn, Threads | | deep-research | Multi-source research with synthesis and source attribution | | dmux-workflows | Multi-agent orchestration using tmux pane manager | | documentation-lookup | Up-to-date library and framework docs via Context7 MCP | | e2e-testing | Playwright E2E tests | | eval-harness | Eval-driven development | | everything-claude-code | Development conventions and patterns for the project | | exa-search | Neural search via Exa MCP for web, code, company research | | fal-ai-media | Unified media generation for images, video, and audio | | frontend-patterns | React/Next.js patterns | | frontend-slides | HTML presentations, PPTX conversion, visual style exploration | | investor-materials | Decks, memos, models, and one-pagers | | investor-outreach | Personalized outreach, follow-ups, and intro blurbs | | market-research | Source-attributed market and competitor research | | mcp-server-patterns | Build MCP servers with Node/TypeScript SDK | | nextjs-turbopack | Next.js 16+ and Turbopack incremental bundling | | product-capability | Translate product goals into scoped capability maps | | security-review | Comprehensive security checklist | | strategic-compact | Context management | | tdd-workflow | Test-driven development with 80%+ coverage | | verification-loop | Build, test, lint, typecheck, security | | video-editing | AI-assisted video editing workflows with FFmpeg and Remotion | | x-api | X/Twitter API integration for posting and analytics | ### Key Limitation Codex does **not yet provide Claude-style hook execution parity**. ECC enforcement there is instruction-based via `AGENTS.md`, optional `model_instructions_file` overrides, and sandbox/approval settings. ### Multi-Agent Support Current Codex builds support stable multi-agent workflows. - Enable `features.multi_agent = true` in `.codex/config.toml` - Define roles under `[agents.<name>]` - Point each role at a file under `.codex/agents/` - Use `/agent` in the CLI to inspect or steer child agents ECC ships three sample role configs: | Role | Purpose | |------|---------| | `explorer` | Read-only codebase evidence gathering before edits | | `reviewer` | Correctness, security, and missing-test review | | `docs_researcher` | Documentation and API verification before release/docs changes | --- ## Zed Support ECC provides Zed project support through a conservative `.zed` adapter for project-local settings, flattened rules, agents, commands, and skills. ```bash ./install.sh --profile minimal --target zed ``` ```powershell .\install.ps1 --profile minimal --target zed ``` The adapter writes ECC-managed files under `.zed/` and keeps BYOK/OpenRouter credentials out of the repo. Configure Zed account or API keys through Zed's own settings UI or your local user settings. --- ## OpenCode Support ECC provides **full OpenCode support** including plugins and hooks. ### Quick Start ```bash # Install OpenCode npm install -g opencode # Run in the repository root opencode ``` The configuration is automatically detected from `.opencode/opencode.json`. ### Feature Parity | Feature | Claude Code | OpenCode | Status | |---------|---------------------|----------|--------| | Agents | PASS: 64 agents | PASS: 12 agents | **Claude Code leads** | | Commands | PASS: 84 commands | PASS: 35 commands | **Claude Code leads** | | Skills | PASS: 261 skills | PASS: 37 skills | **Claude Code leads** | | Hooks | PASS: 8 event types | PASS: 11 events | **OpenCode has more!** | | Rules | PASS: 29 rules | PASS: 13 instructions | **Claude Code leads** | | MCP Servers | PASS: 14 servers | PASS: Full | **Full parity** | | Custom Tools | PASS: Via hooks | PASS: 6 native tools | **OpenCode is better** | ### Hook Support via Plugins OpenCode's plugin system is MORE sophisticated than Claude Code with 20+ event types: | Claude Code Hook | OpenCode Plugin Event | |-----------------|----------------------| | PreToolUse | `tool.execute.before` | | PostToolUse | `tool.execute.after` | | Stop | `session.idle` | | SessionStart | `session.created` | | SessionEnd | `session.deleted` | **Additional OpenCode events**: `file.edited`, `file.watcher.updated`, `message.updated`, `lsp.client.diagnostics`, `tui.toast.show`, and more. ### Maintained Slash Entries | Command | Description | |---------|-------------| | `/plan` | Create implementation plan | | `/code-review` | Review code changes | | `/build-fix` | Fix build errors | | `/refactor-clean` | Remove dead code | | `/learn` | Extract patterns from session | | `/checkpoint` | Save verification state | | `/quality-gate` | Run the maintained verification gate | | `/update-docs` | Update documentation | | `/update-codemaps` | Update codemaps | | `/test-coverage` | Analyze coverage | | `/go-review` | Go code review | | `/go-test` | Go TDD workflow | | `/go-build` | Fix Go build errors | | `/python-review` | Python code review (PEP 8, type hints, security) | | `/multi-plan` | Multi-model collaborative planning | | `/multi-execute` | Multi-model collaborative execution | | `/multi-backend` | Backend-focused multi-model workflow | | `/multi-frontend` | Frontend-focused multi-model workflow | | `/multi-workflow` | Full multi-model development workflow | | `/pm2` | Auto-generate PM2 service commands | | `/sessions` | Manage session history | | `/skill-create` | Generate skills from git | | `/instinct-status` | View learned instincts | | `/instinct-import` | Import instincts | | `/instinct-export` | Export instincts | | `/evolve` | Cluster instincts into skills | | `/promote` | Promote project instincts to global scope | | `/projects` | List known projects and instinct stats | | `/prune` | Delete expired pending instincts (30d TTL) | | `/learn-eval` | Extract and evaluate patterns before saving | | `/setup-pm` | Configure package manager | | `/harness-audit` | Audit harness reliability, eval readiness, and risk posture | | `/loop-start` | Start controlled agentic loop execution pattern | | `/loop-status` | Inspect active loop status and checkpoints | | `/quality-gate` | Run quality gate checks for paths or entire repo | | `/model-route` | Route tasks to models by complexity and budget | ### Plugin Installation **Option 1: Use directly** ```bash cd ECC opencode ``` **Option 2: Install as npm package** ```bash npm install ecc-universal ``` Then add to your `opencode.json`: ```json { "plugin": ["ecc-universal"] } ``` That npm plugin entry enables ECC's published OpenCode plugin module (hooks/events and plugin tools). It does **not** automatically add ECC's full command/agent/instruction catalog to your project config. For the full ECC OpenCode setup, either: - run OpenCode inside this repository, or - copy the bundled `.opencode/` config assets into your project and wire the `instructions`, `agent`, and `command` entries in `opencode.json` ### Documentation - **Migration Guide**: `.opencode/MIGRATION.md` - **OpenCode Plugin README**: `.opencode/README.md` - **Consolidated Rules**: `.opencode/instructions/INSTRUCTIONS.md` - **LLM Documentation**: `llms.txt` (complete OpenCode docs for LLMs) --- ## GitHub Copilot Support ECC provides **GitHub Copilot support** for VS Code via Copilot Chat's native instruction and prompt file system — no extra tooling required. ### What's Included | Component | File | Purpose | |-----------|------|---------| | Core instructions | `.github/copilot-instructions.md` | Always-loaded rules: coding style, security, testing, git workflow | | VS Code settings | `.vscode/settings.json` | Per-task instruction files for code gen, test gen, review, and commit messages | | Plan prompt | `.github/prompts/plan.prompt.md` | Phased implementation planning | | TDD prompt | `.github/prompts/tdd.prompt.md` | Red-Green-Improve cycle | | Code review prompt | `.github/prompts/code-review.prompt.md` | Quality and security review | | Security review prompt | `.github/prompts/security-review.prompt.md` | Deep OWASP-aligned security analysis | | Build fix prompt | `.github/prompts/build-fix.prompt.md` | Systematic build and CI error resolution | | Refactor prompt | `.github/prompts/refactor.prompt.md` | Dead code cleanup and simplification | ### Quick Start (GitHub Copilot) The files are already in place — open any repo that contains this project and GitHub Copilot Chat will automatically pick up `.github/copilot-instructions.md`. The committed `.vscode/settings.json` enables `chat.promptFiles` so VS Code can load the reusable prompts from `.github/prompts/`. To use the workflow prompts in Copilot Chat: 1. Open the Copilot Chat panel in VS Code. 2. Click the **paperclip / attach** icon and select **Prompt...**, or type `/` and choose a prompt. 3. Select the prompt (e.g. `plan`, `tdd`, `code-review`). ### How It Works GitHub Copilot in VS Code reads two types of files automatically: - **`.github/copilot-instructions.md`** — repository-level instructions, always injected into every Copilot Chat request. Contains ECC's core coding standards, security checklist, testing requirements, and git workflow. - **`.github/prompts/*.prompt.md`** — reusable prompt files users invoke on demand. Each prompt walks Copilot through a specific ECC workflow (plan → TDD → review → ship). The **`.vscode/settings.json`** adds per-task instruction overlays so Copilot receives the right context depending on whether you are generating code, writing tests, reviewing a selection, or drafting a commit message. ### Feature Coverage | ECC Feature | Copilot equivalent | |-------------|-------------------| | Coding standards | Always-on via `copilot-instructions.md` | | Security checklist | Always-on + `security-review` prompt | | Testing / TDD | Always-on + `tdd` prompt | | Implementation planning | `plan` prompt | | Code review | `code-review` prompt | | Build error resolution | `build-fix` prompt | | Refactoring | `refactor` prompt | | Commit message format | Per-task instruction in `settings.json` | | Hooks / automation | Not supported (Copilot has no hook system) | | Agents / delegation | Not supported (Copilot has no subagent API) | ### Limitations GitHub Copilot does not have a hook system or a subagent API, so ECC's hook automations (auto-format, TypeScript check, session persistence, dev-server guard) and agent delegation are unavailable. The instruction and prompt layer still brings the full ECC coding philosophy — standards, security, TDD, and workflow — into every Copilot Chat session. --- ## Cross-Tool Feature Parity ECC is the **first plugin to maximize every major AI coding tool**. Here's how each harness compares: | Feature | Claude Code | Cursor IDE | Codex CLI | OpenCode | GitHub Copilot | |---------|-----------------------|------------|-----------|----------|----------------| | **Agents** | 64 | Shared (AGENTS.md) | Shared (AGENTS.md) | 12 | N/A | | **Commands** | 84 | Shared | Instruction-based | 35 | 6 prompts | | **Skills** | 261 | Shared | 10 (native format) | 37 | Via instructions | | **Hook Events** | 8 types | 15 types | None yet | 11 types | None | | **Hook Scripts** | 20+ scripts | 16 scripts (DRY adapter) | N/A | Plugin hooks | N/A | | **Rules** | 34 (common + lang) | 34 (YAML frontmatter) | Instruction-based | 13 instructions | 1 always-on file | | **Custom Tools** | Via hooks | Via hooks | N/A | 6 native tools | N/A | | **MCP Servers** | 14 | Shared (mcp.json) | 7 (auto-merged via TOML parser) | Full | N/A | | **Config Format** | settings.json | hooks.json + rules/ | config.toml | opencode.json | copilot-instructions.md + settings.json | | **Context File** | CLAUDE.md + AGENTS.md | AGENTS.md | AGENTS.md | AGENTS.md | copilot-instructions.md | | **Secret Detection** | Hook-based | beforeSubmitPrompt hook | Sandbox-based | Hook-based | Instruction-based | | **Auto-Format** | PostToolUse hook | afterFileEdit hook | N/A | file.edited hook | N/A | | **Version** | Plugin | Plugin | Reference config | 2.0.0-rc.1 | Instruction layer | **Key architectural decisions:** - **AGENTS.md** at root is the universal cross-tool file (read by Claude Code, Cursor, Codex, and OpenCode — GitHub Copilot uses `.github/copilot-instructions.md` instead) - **DRY adapter pattern** lets Cursor reuse Claude Code's hook scripts without duplication - **Skills format** (SKILL.md with YAML frontmatter) works across Claude Code, Codex, and OpenCode - Codex's lack of hooks is compensated by `AGENTS.md`, optional `model_instructions_file` overrides, and sandbox permissions --- ## Background I've been using Claude Code since the experimental rollout. Won the Anthropic x Forum Ventures hackathon in Sep 2025 with [@DRodriguezFX](https://x.com/DRodriguezFX) — built [zenith.chat](https://zenith.chat) entirely using Claude Code. These configs are battle-tested across multiple production applications. --- ## Token Optimization Claude Code usage can be expensive if you don't manage token consumption. These settings significantly reduce costs without sacrificing quality. ### Recommended Settings Add to `~/.claude/settings.json`: ```json { "model": "sonnet", "env": { "MAX_THINKING_TOKENS": "10000", "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "50" } } ``` | Setting | Default | Recommended | Impact | |---------|---------|-------------|--------| | `model` | opus | **sonnet** | ~60% cost reduction; handles 80%+ of coding tasks | | `MAX_THINKING_TOKENS` | 31,999 | **10,000** | ~70% reduction in hidden thinking cost per request | | `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE` | 95 | **50** | Compacts earlier — better quality in long sessions | | `ECC_CONTEXT_MONITOR_COST_WARNINGS` | on | **off for subscription users** | Suppresses agent-facing API-rate estimate warnings while keeping context/scope/loop warnings | Switch to Opus only when you need deep architectural reasoning: ``` /model opus ``` ### Daily Workflow Commands | Command | When to Use | |---------|-------------| | `/model sonnet` | Default for most tasks | | `/model opus` | Complex architecture, debugging, deep reasoning | | `/clear` | Between unrelated tasks (free, instant reset) | | `/compact` | At logical task breakpoints (research done, milestone complete) | | `/cost` | Monitor token spending during session | If you use a Claude subscription and the context monitor's API-rate estimates are not useful, set `ECC_CONTEXT_MONITOR_COST_WARNINGS=off`. This only suppresses the agent-facing cost warnings; it does not disable context exhaustion, scope, or loop warnings. ### Strategic Compaction The `strategic-compact` skill (included in this plugin) suggests `/compact` at logical breakpoints instead of relying on auto-compaction at 95% context. See `skills/strategic-compact/SKILL.md` for the full decision guide. **When to compact:** - After research/exploration, before implementation - After completing a milestone, before starting the next - After debugging, before continuing feature work - After a failed approach, before trying a new one **When NOT to compact:** - Mid-implementation (you'll lose variable names, file paths, partial state) ### Context Window Management **Critical:** Don't enable all MCPs at once. Each MCP tool description consumes tokens from your 200k window, potentially reducing it to ~70k. - Keep under 10 MCPs enabled per project - Keep under 80 tools active - Use `/mcp` to disable unused Claude Code MCP servers; those runtime choices persist in `~/.claude.json` - Use `ECC_DISABLED_MCPS` only to filter ECC-generated MCP configs during install/sync flows ### Agent Teams Cost Warning Agent Teams spawns multiple context windows. Each teammate consumes tokens independently. Only use for tasks where parallelism provides clear value (multi-module work, parallel reviews). For simple sequential tasks, subagents are more token-efficient. --- ## WARNING: Important Notes ### Token Optimization Hitting daily limits? See the **[Token Optimization Guide](docs/token-optimization.md)** for recommended settings and workflow tips. Quick wins: ```json // ~/.claude/settings.json { "model": "sonnet", "env": { "MAX_THINKING_TOKENS": "10000", "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "50", "CLAUDE_CODE_SUBAGENT_MODEL": "haiku" } } ``` Use `/clear` between unrelated tasks, `/compact` at logical breakpoints, and `/cost` to monitor spending. ### Customization These configs work for my workflow. You should: 1. Start with what resonates 2. Modify for your stack 3. Remove what you don't use 4. Add your own patterns --- ## Community Projects Projects built on or inspired by ECC: | Project | Description | |---------|-------------| | [EVC](https://github.com/SaigonXIII/evc) | Marketing agent workspace — 42 commands for content operators, brand governance, and multi-channel publishing. [Visual overview](https://saigonxiii.github.io/evc). | | [trading-skills](https://github.com/VictorVVedtion/trading-skills) | 68 trading-themed Claude Code skills with pre-trade review prompts and risk gates inspired by market operators. | Built something with ECC? Open a PR to add it here. --- ## Sponsors This project is free and open source. Sponsors help keep it maintained and growing. [**Become a Sponsor**](https://github.com/sponsors/affaan-m) | [Sponsor Tiers](SPONSORS.md) | [Sponsorship Program](SPONSORING.md) --- ## Star History [![Star History Chart](https://api.star-history.com/svg?repos=affaan-m/ECC&type=Date)](https://star-history.com/#affaan-m/ECC&Date) --- ## Links - **Shorthand Guide (Start Here):** [The Shorthand Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2012378465664745795) - **Longform Guide (Advanced):** [The Longform Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2014040193557471352) - **Security Guide:** [Security Guide](./the-security-guide.md) | [Thread](https://x.com/affaanmustafa/status/2033263813387223421) - **Follow:** [@affaanmustafa](https://x.com/affaanmustafa) --- ## License MIT - Use freely, modify as needed, contribute back if you can. --- **Star this repo if it helps. Read both guides. Build something great.**

Developer Tools AI Tools AI Agents
211.3K Github Stars
agentshield
Open Source

agentshield

<div align="center"> <img src="./assets/agentshield-logo.png" alt="AgentShield" width="180" /> # AgentShield **Security auditor for AI agent configurations** Scans Claude Code setups for hardcoded secrets, permission misconfigs,<br/> hook injection, MCP server risks, and agent prompt injection vectors.<br/> Available as CLI, GitHub Action, and [GitHub App](https://github.com/apps/ecc-tools) integration. [![npm version](https://img.shields.io/npm/v/ecc-agentshield)](https://www.npmjs.com/package/ecc-agentshield) [![npm downloads](https://img.shields.io/npm/dm/ecc-agentshield)](https://www.npmjs.com/package/ecc-agentshield) [![tests](https://img.shields.io/badge/tests-passing-brightgreen)]() [![coverage](https://img.shields.io/badge/coverage-v8-blue)]() [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [Quick Start](#quick-start) · [What It Catches](#what-it-catches) · [API Reference](#api-reference) · [Opus Pipeline](#opus-46-deep-analysis---opus) · [GitHub Action](#github-action) · [Distribution](#distribution) · [MiniClaw](#miniclaw) · [Changelog](./CHANGELOG.md) </div> --- ## Why The AI agent ecosystem is growing faster than its security tooling. In January 2026 alone: - **12%** of a major agent skill marketplace was malicious (341 of 2,857 community skills) - A **CVSS 8.8** CVE exposed 17,500+ internet-facing instances to one-click RCE - The Moltbook breach compromised **1.5M API tokens** across 770,000 agents Developers install community skills, connect MCP servers, and configure hooks without any automated way to audit the security of their setup. AgentShield scans your `.claude/` directory and flags vulnerabilities before they become exploits. Built at the [Claude Code Hackathon](https://cerebralvalley.ai/e/claude-code-hackathon) (Cerebral Valley x Anthropic, Feb 2026). Part of the [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) ecosystem (42K+ stars). ## Quick Start ```bash # Scan your Claude Code config (no install required) npx ecc-agentshield scan # Or install globally npm install -g ecc-agentshield agentshield scan ``` That's it. AgentShield auto-discovers your `~/.claude/` directory, scans all config files, and prints a graded security report. Discovery intentionally skips common generated directories such as `node_modules`, build output, and `.dmux` worktree mirrors so transient copies do not duplicate findings. ``` AgentShield Security Report Grade: F (0/100) Score Breakdown Secrets ░░░░░░░░░░░░░░░░░░░░ 0 Permissions ░░░░░░░░░░░░░░░░░░░░ 0 Hooks ░░░░░░░░░░░░░░░░░░░░ 0 MCP Servers ░░░░░░░░░░░░░░░░░░░░ 0 Agents ░░░░░░░░░░░░░░░░░░░░ 0 ● CRITICAL Hardcoded Anthropic API key CLAUDE.md:13 Evidence: sk-ant-a...cdef Fix: Replace with environment variable reference [auto-fixable] ● CRITICAL Overly permissive allow rule: Bash(*) settings.json Evidence: Bash(*) Fix: Restrict to specific commands: Bash(git *), Bash(npm *), Bash(node *) Summary Files scanned: 6 Findings: 73 total — 19 critical, 29 high, 15 medium, 4 low, 6 info Auto-fixable: 8 (use --fix) ``` ### More commands ```bash # Scan a specific directory agentshield scan --path /path/to/.claude # Auto-fix safe issues (replaces hardcoded secrets with env var references) agentshield scan --fix # JSON output for CI pipelines agentshield scan --format json # Generate an HTML executive security report agentshield scan --format html > report.html # Generate a portable audit bundle agentshield scan --evidence-pack ./agentshield-evidence # Three-agent Opus 4.6 adversarial analysis (requires ANTHROPIC_API_KEY) agentshield scan --opus --stream # Generate a secure baseline config agentshield init ``` JSON reports now expose `findings[].runtimeConfidence` when AgentShield can distinguish active runtime config from project-local settings, template/example inventories, installed Claude plugin caches, declarative plugin manifests, and manifest-resolved non-shell hook implementations. Reports also include local harness adapter evidence for Claude Code, OpenCode, Codex, Gemini, Zed, VS Code, dmux, terminal-agent wrappers, and project-local templates when matching markers are present. ## What It Catches **102 rules** across 5 categories, graded A–F with a 0–100 numeric score. ### Secrets Detection | What | Examples | |------|----------| | API keys | Anthropic (`sk-ant-`), OpenAI (`sk-proj-`/`sk-`), xAI (`xai-`), AWS (`AKIA`), Google/Gemini (`AIza`), Stripe (`sk_test_`/`sk_live_`) | | Tokens | GitHub PATs (`ghp_`/`github_pat_`), Linear (`lin_api_`), Cloudflare (`CF_API_TOKEN=`), Slack (`xox[bprs]-`), JWTs (`eyJ...`), Bearer tokens | | Credentials | Hardcoded passwords, database connection strings (postgres/mongo/mysql/redis), private key material | | Env leaks | Secrets passed through environment variables in configs, `echo $SECRET` in hooks | ### Permission Audit (10 rules) | What | Examples | |------|----------| | Wildcard access | `Bash(*)`, `Write(*)`, `Edit(*)` — unrestricted tool permissions | | Missing deny lists | No deny rules for `rm -rf`, `sudo`, `chmod 777` | | Dangerous flags | `--dangerously-skip-permissions` usage | | Mutable tool exposure | All mutable tools (Write, Edit, Bash) allowed without scoping | | Destructive git | `git push --force`, `git reset --hard` in allowed commands | | Unrestricted network | `curl *`, `wget`, `ssh *`, `scp *` in allow list without scope | ### Hook Analysis (34 rules) | What | Examples | |------|----------| | Command injection | `${file}` interpolation in shell commands — attacker-controlled filenames become code | | Data exfiltration | `curl -X POST` with variable interpolation sending data to external URLs | | Silent errors | `2>/dev/null`, `\|\| true` — failing security hooks that silently pass | | Missing hooks | No PreToolUse hooks, no Stop hooks for session-end validation | | Network exposure | Unthrottled network requests in hooks, sensitive file access without filtering | | Session startup | SessionStart hooks that download and execute remote scripts | | Package installs | Global `npm install -g`, `pip install`, `gem install`, `cargo install` in hooks | | Container escape | Docker `--privileged`, `--pid=host`, `--network=host`, root volume mounts | | Credential access | macOS Keychain, GNOME Keyring, /etc/shadow reads | | Reverse shells | `/dev/tcp`, `mkfifo + nc`, Python/Perl socket shells | | Clipboard access | `pbcopy`, `xclip`, `xsel`, `wl-copy` — exfiltration via clipboard | | Log tampering | `journalctl --vacuum`, `rm /var/log`, `history -c` — anti-forensics | ### MCP Server Security (23 rules) | What | Examples | |------|----------| | High-risk servers | Shell/command MCPs, filesystem with root access, database MCPs, browser automation | | Supply chain | `npx -y` auto-install without confirmation — typosquatting vector | | Hardcoded secrets | API tokens in MCP environment config instead of env var references | | Remote transport | MCP servers connecting to remote URLs (SSE/streamable HTTP) | | Shell metacharacters | `&&`, `\|`, `;` in MCP server command arguments | | Missing metadata | No version pin, no description, excessive server count | | Sensitive file args | `.env`, `.pem`, `credentials.json` passed as server arguments | | Network exposure | Binding to `0.0.0.0` instead of localhost | | Auto-approve | `autoApprove` settings that skip user confirmation for tool calls | | Missing timeouts | High-risk servers without timeout — resource exhaustion risk | Supply-chain verification (`agentshield scan --supply-chain`) extracts MCP package references plus root `package.json` and `package-lock.json` dependency evidence, then reports provenance counts for npm vs git, pinned vs unpinned, known-good packages, and npm-registry-backed metadata. Add `--supply-chain-online` to query npm for downloads, maintainers, postinstall scripts, deprecation, and package age. Package-manager hardening checks also scan `.npmrc`, `.yarnrc.yml`, and `pnpm-workspace.yaml` for plaintext registry credentials, explicit dependency lifecycle-script enablement, and missing or weak release-age cooldowns where the package manager supports them. npm configs are checked for lifecycle-script blocking and unsupported release-age keys that can create false confidence; use pnpm `minimumReleaseAge` / `minimum-release-age`, Yarn `npmMinimalAgeGate`, or an external package-manager policy wrapper for cooldown enforcement. AgentShield also scans AI developer-tool persistence surfaces used by recent npm and PyPI campaign payloads, including Claude Code hook settings, `.claude/router_runtime.js`, VS Code `tasks.json` folder-open automation, Zed project `tasks.json`, `.vscode/setup.mjs`, `.zed/setup.mjs`, GitHub workflow drop-ins, LaunchAgent/systemd dead-man switch artifacts, `gh-token-monitor` token-store files, metadata-service credential targets, and reported exfiltration or second-stage network indicators. These indicators are emitted as critical hook findings so CI can fail fast even after the malicious package has been uninstalled. #### MCP Confidence Notes AgentShield scans both active MCP config and repository-shipped MCP templates. - Findings from `mcp.json`, `.claude/mcp.json`, `.claude.json`, and active `settings.json` should be treated as the highest-confidence runtime exposure. - Findings from `settings.local.json` are emitted as `runtimeConfidence: project-local-optional`. - Findings from locations such as `mcp-configs/`, `config/mcp/`, or `configs/mcp/` indicate risky MCP definitions present in repository templates, not guaranteed active runtime enablement. - JSON, markdown, terminal, and HTML outputs now expose source context via `runtimeConfidence: active-runtime | project-local-optional | template-example | docs-example | plugin-cache | plugin-manifest | hook-code`. - Non-secret `template-example` MCP findings are score-weighted at `0.25x`, and one template file is capped at `10` deduction points per score category so a single MCP catalog cannot score like dozens of enabled servers. - In template files, findings such as risky server type, remote URL transport, `npx -y`, unpinned packages, and environment inheritance are still valuable, but they should be interpreted as "this repo ships a risky MCP template" rather than "this MCP is definitely enabled right now." - Aggregate findings like large MCP server counts are especially likely to overstate runtime exposure when the source file is a template catalog. ### Agent Config Review (25 rules) | What | Examples | |------|----------| | Unrestricted tools | Agents with Bash access, no `allowedTools` restriction | | Prompt injection surface | Agents processing external/user-provided content without defenses | | Auto-run instructions | `CLAUDE.md` containing "Always run", "without asking", "automatically install" | | Hidden instructions | Unicode zero-width characters, HTML comments, base64-encoded directives | | URL execution | `CLAUDE.md` instructing agents to fetch and execute remote URLs | | Time bombs | Delayed execution instructions triggered by time or absence conditions | | Data harvesting | Bulk collection of passwords, credentials, or database dumps | | Prompt reflection | `ignore previous instructions`, `you are now`, DAN jailbreak, fake system prompts | | Output manipulation | `always report ok`, `remove warnings from output`, suppress security findings | Structured JSON under `.claude/subagents/` and `.claude/slash-commands/` is analyzed like agent config when it declares `allowedTools` or similar tool metadata. Freeform `skill-md` prompt text still has narrower security coverage than `agent-md` and `CLAUDE.md`. #### Scanner Accuracy Notes - Live audit notes and follow-up items are tracked in [`false-positive-audit.md`](./false-positive-audit.md). - The most useful operator guidance is in the audit's [`Triage Rules For Current Reports`](./false-positive-audit.md#triage-rules-for-current-reports) section. - The audit doc also includes a reusable [`False-Positive Taxonomy`](./false-positive-audit.md#false-positive-taxonomy), [`Repo Audit Worksheet`](./false-positive-audit.md#repo-audit-worksheet), and [`Release Gate For Accuracy Changes`](./false-positive-audit.md#release-gate-for-accuracy-changes). - Cross-file hook-manifest awareness now suppresses settings-only `hooks-no-pretooluse` when a companion `hooks/hooks.json` manifest defines PreToolUse hooks. - Manifest-referenced hook implementations are now discovered from `hooks/hooks.json`-style indirection; shell targets continue through hook rules, and non-shell `hook-code` targets now emit targeted findings for explicit `output(...)` context injection, transcript input access, and remote shell payloads executed via child-process wrappers. - Current known high-signal caveats are broader non-shell hook execution that still needs language-aware analysis beyond those current `hook-code` signals, and `skill-md` prompt text that still bypasses most agent/injection rules. - `runtimeConfidence` now appears on MCP findings, `settings.local.json`, docs/examples, installed Claude plugin caches, plugin manifests, and manifest-resolved non-shell hook code. Scoring discounts non-secret `template-example` and `docs-example` findings at `0.25x`, non-secret `project-local-optional` findings at `0.75x`, and non-secret `plugin-cache` / `plugin-manifest` findings at `0.5x`. Non-secret `template-example` findings are also capped at `10` deduction points per file and score category so one catalog file cannot dominate the grade. `hook-code` findings currently stay at full weight, but the active rules there are narrow language-aware implementation signals. - Practical reading rule: `template-example` means "repo ships this risky template", not "this is definitely enabled right now." - Practical reading rule: `docs-example` means "repo ships risky sample guidance", not "this example is active runtime config." - Practical reading rule: `plugin-cache` means "installed plugin content is present on disk", not "this file is top-level runtime config"; real secrets still stay critical. - Practical reading rule: `plugin-manifest` means "the repo declares this hook behavior", while `hook-code` means "the scanner reached the referenced non-shell implementation." - Current edge case: docs-only example trees now re-add the standalone `CLAUDE.md` example file for scanning, but still suppress the rest of the nested example subtree unless a runtime companion exists. - Current edge case: tutorial/example bundles outside the current `docs/`, `commands/`, `examples/`, `samples/`, `demo/`, `tutorial/`, `guide/`, `cookbook/`, and `playground/` heuristics can still be treated as live config until broader example-root classification lands. - Docs-only nested `CLAUDE.md` roots under `docs/` are now skipped unless runtime config companions exist in the same subtree. - Exact `Bash(curl https://...)` and `Bash(wget https://...)` allow entries with pinned literal URLs no longer trigger the generic `permissions-permissive-*` finding; wildcard and dynamic network permissions still do. - Exact `Bash(node scripts/foo.js ...)` and `Bash(python3 ./tools/audit.py ...)` wrapper commands no longer trigger the generic interpreter-access finding; inline eval forms such as `node -e` and `python -c` still do. - Exact read-only Docker inventory commands such as `Bash(docker ps)` and `Bash(docker image ls)` no longer trigger the generic Docker-access finding; execution-oriented forms such as `docker run` and `docker exec` still do. - Exact `settings.local.json` allowlists now downgrade `permissions-no-deny-list` from high to medium when every allow entry is fully specified; wildcard or dynamic project-local permissions still keep the higher severity. - Exact local-only `settings.local.json` allowlists now also downgrade `hooks-no-pretooluse` from medium to low; broader or network-capable project-local configs still keep the higher severity. - Comment-only shell-hook lines are now ignored by the hook exfiltration, sensitive-path, and silent-fail regex rules, so inline remediation notes and commented examples no longer look like live hook behavior. - Narrow specialist agents, subagents, and slash commands now downgrade generic Bash-access and escalation-chain findings from high to medium; broader generalist workflows still keep the higher severity. - Repo-scoped filesystem MCP servers using relative paths like `./` now grade lower than unrestricted root/home filesystem access; root-level filesystem exposure still stays high. - Defensive agent-review content that mentions patterns like ``fetch(userProvidedUrl)`` no longer triggers `agents-injection-surface`; direct instructions to fetch/process external content still do. - `agents-explorer-write` now uses role metadata and the lead agent intro instead of any later workflow/example text, so procedural `search for ...` steps in normal worker prompts no longer get mislabeled as explorer-style agents. Example: `chief-of-staff.md` no longer trips that rule just because it contains `gog gmail search ...`. - `agents-oversized-prompt` now measures effective prompt size instead of raw file length, discounting fenced code blocks and Markdown tables. Example-heavy agents like `chief-of-staff.md` and `planner.md` no longer trip the rule, while prose-heavy agents still do. - Markdown example/test passwords in example-like paths such as `docs/`, `commands/`, `examples/`, `tutorials/`, and `demos/` are now suppressed when the surrounding context is clearly instructional; that suppression does not apply to normal agent/config markdown. #### False-Positive Audit Workflow Use this workflow when a repo scan looks noisy or when you are tuning AgentShield rules. 1. Start with JSON output so you can inspect file paths, `runtimeConfidence`, and score impact directly. 2. Separate active runtime findings from lower-confidence source kinds before changing any rules. 3. Validate suspected false positives against at least one real repo and one minimal synthetic fixture. 4. Prefer source-aware reclassification and wording changes before adding blanket suppression. 5. Keep real secrets and explicit execution paths visible even inside examples, manifests, or templates. 6. Re-run targeted tests, then the full gate, before changing release behavior. Recommended commands: ```bash agentshield scan --path /repo --format json > report.json jq '.findings | group_by(.runtimeConfidence // "none") | map({ runtimeConfidence: (.[0].runtimeConfidence // "none"), count: length })' report.json jq '.findings | group_by(.file) | map({ file: .[0].file, count: length }) | sort_by(-.count)[:20]' report.json ``` Confidence-first triage commands: ```bash # Highest-signal findings first: active runtime + project-local jq '.findings | map(select((.runtimeConfidence // "active-runtime") | IN("active-runtime","project-local-optional"))) | map(select(.severity | IN("critical","high","medium"))) | map({file, severity, runtimeConfidence, title})' report.json # Lower-confidence inventory that usually needs interpretation, not suppression jq '.findings | map(select((.runtimeConfidence // "") | IN("template-example","docs-example","plugin-cache","plugin-manifest"))) | map({file, severity, runtimeConfidence, title})' report.json ``` Recommended audit order: - `active-runtime` and `project-local-optional`: treat as highest-signal findings first. - `template-example`, `docs-example`, and `plugin-cache`: confirm whether the repo or installed plugin cache is shipping risky guidance versus actually enabling it. - `plugin-manifest`: confirm whether the risk is in declarative hook wiring or the referenced implementation. - `hook-code`: confirm whether the implementation actually injects context, reads transcripts, or shells out in a risky way. Rule-design guidelines: - Prefer source-aware labeling over suppression. If a finding is real but lower confidence, keep it visible and say why. - Prefer cross-file context over single-file guesses. Companion manifests and referenced hook implementations usually matter more than isolated config. - Prefer narrow, behavior-based `hook-code` rules over generic wrapper heuristics. `spawnSync("bash", ["-lc", "curl ... | bash"])` is high-signal; ordinary `spawnSync("prettier", ...)` is not. - Do not downgrade real secrets just because they appear in docs or examples. Structural findings can be downgraded; committed credentials should stay critical. - Keep example-root heuristics evidence-based. Today the scanner treats `docs/`, `commands/`, `examples/`, `example/`, `samples/`, `sample/`, `demo/`, `demos/`, `tutorial/`, `tutorials/`, `guide/`, `guides/`, `cookbook/`, and `playground/` as example-like paths. When you change rule accuracy, update both: - [`false-positive-audit.md`](./false-positive-audit.md) with the new baseline and remaining gaps - the targeted regression tests for the specific rule family you changed - `agentshield scan --corpus-gate` in CI so the built-in attack corpus must stay fully detected; failed corpus gates now include a prioritized accuracy improvement plan by category, missing rule, and missed config - the corpus now includes an env proxy/DNS exfiltration fixture so proxy hijack, runtime import mutation, env-token exfiltration, credential-store access, and clipboard access stay covered together - if you are filing a scanner-noise bug, start from the audit doc's [`False-Positive Issue Template`](./false-positive-audit.md#false-positive-issue-template) #### Reducing False Positives In Practice The current scan profile is not dominated by broken matchers. It is mostly dominated by lower-confidence source kinds that need different interpretation. Current patterns from the latest live scans: - template MCP inventory is still the biggest noise source by count in `everything-claude-code` - example/tutorial config needs example-aware wording and weighting, not blanket suppression - declarative hook manifests and executable hook implementations need different handling - many remaining agent findings are policy findings about intentionally privileged agents, not obvious rule bugs - the latest alert review reduced specialist agent-capability severity inflation, repo-scoped filesystem MCP inflation, and template-catalog score inflation; remaining noise is now mostly template count/interpretation and active-runtime remote MCP URLs Recurring pattern signatures to recognize: - one template file dominating the report usually means confidence/weighting work, not a broken matcher - broad `agents-*` clusters across files with explicit tool metadata usually mean policy review, not false-positive suppression - very small `project-local-optional` clusters usually mean scope is already modeled and only severity may need tuning - a repo-scoped filesystem MCP with relative-path args should not be treated like root/home filesystem access When to open a false-positive issue instead of just triaging the report: - the same finding pattern reproduces across at least one real repo and one minimal synthetic fixture - the finding is wrong for its own source kind, not just lower-confidence than `active-runtime` - the fix needs matcher changes, not just better wording, score weighting, or cross-file context - the finding would still be misleading even after reading `runtimeConfidence` Recommended operating model: - Start with `runtimeConfidence` before changing any rule. Separate `active-runtime` from `template-example`, `docs-example`, `plugin-cache`, `plugin-manifest`, and `project-local-optional`. - Reclassify before suppressing. If the finding is real but lower confidence, keep it visible and adjust wording or score weight instead of hiding it. - Keep secrets on a stricter standard. Real credentials should stay critical even in docs, examples, plugin caches, or manifests. - Use cross-file context whenever possible. Settings, manifests, and referenced hook implementations usually need to be read together. - For `hook-code`, add only narrow language-aware rules for explicit risky behavior. Avoid broad wrapper heuristics. - For agent rules, anchor on role metadata and lead instructions before matching arbitrary later prose. Repo conventions that help AgentShield scan accurately: - put reusable MCP catalogs under template paths such as `mcp-configs/` instead of live runtime config files - keep local-only overrides in `settings.local.json` - keep tutorials and examples under example-like paths such as `docs/`, `examples/`, `tutorials/`, `demos/`, or `guides/` - keep `hooks/hooks.json` declarative and put the implementation in separate hook script files - keep large agent examples inside fenced code blocks so prompt-size and role heuristics stay accurate Current high-value places to audit first: - files with the highest finding count - files with `runtimeConfidence: template-example` or `plugin-cache` - `settings.local.json` findings that may be project-local rather than repo-wide - `plugin-manifest` findings that need confirmation in the referenced implementation - `hook-code` findings that involve context injection, transcript access, or child-process execution ## Features ### Auto-Fix Engine (`--fix`) Automatically applies safe fixes: - Replaces hardcoded secrets with `${ENV_VAR}` references - Tightens wildcard permissions (`Bash(*)` → scoped `Bash(git *)`, `Bash(npm *)`) Only fixes marked `auto: true` are applied. Permission changes require human review. ### Secure Init (`agentshield init`) Generates a hardened `.claude/` directory with scoped permissions, safety hooks, and security best practices. Existing files are never overwritten. ### Opus 4.6 Deep Analysis (`--opus`) Three-agent adversarial pipeline powered by Claude Opus 4.6: 1. **Red Team (Attacker)** — finds exploitable attack vectors and multi-step chains 2. **Blue Team (Defender)** — evaluates existing protections and recommends hardening 3. **Auditor** — synthesizes both perspectives into a prioritized risk assessment The Attacker finds that `curl` hooks with `${file}` interpolation + `Bash(*)` = command injection pivot. The Defender notes no PreToolUse hooks exist to stop it. The Auditor chains them into a prioritized action list. ```bash agentshield scan --opus # Red + Blue run in parallel agentshield scan --opus --stream # Sequential with real-time output agentshield scan --opus --stream -v # Verbose — see full agent reasoning ``` ``` ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Phase 1a: ATTACKER (Red Team) ┃ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ ✓ Attacker analysis complete (4521 tokens) ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Phase 1b: DEFENDER (Blue Team) ┃ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ ✓ Defender analysis complete (3892 tokens) ┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Phase 2: AUDITOR ┃ ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛ Risk Level: CRITICAL Opus Score: █████░░░░░░░░░░░░░░░ 15/100 ``` Requires `ANTHROPIC_API_KEY` environment variable. ### Output Formats | Format | Flag | Use Case | |--------|------|----------| | Terminal | `--format terminal` (default) | Interactive use | | JSON | `--format json` | CI pipelines, programmatic access | | Markdown | `--format markdown` | Documentation, PRs | | HTML | `--format html` | Executive report with risk posture and priorities | | Evidence pack | `--evidence-pack <dir>` | Audit and buyer reviews | | Remediation plan | `--remediation-plan <path>` | Stable-fingerprint fix queue for CI and ticketing | Evidence packs write a deterministic directory containing `manifest.json`, `README.md`, `agentshield-report.json`, `agentshield-report.html`, `agentshield-results.sarif`, `policy-evaluation.json`, `baseline-comparison.json`, `supply-chain.json`, and `ci-context.json`, and `remediation-plan.json`. The manifest records SHA-256 digests and byte counts for bundle artifacts plus a bundle digest over the machine-readable evidence. `ci-context.json` records whitelisted GitHub Actions workflow, commit, run, and runner provenance without copying arbitrary environment variables into the bundle. Redaction is enabled by default for local paths, usernames, emails, and token-shaped strings; use `--no-evidence-redact` only for private internal bundles. Remediation plans write a JSON queue of findings with stable hashed fingerprints, severity, file, fixability, ordered workflow phases, and the recommended next command. The workflow phases route safe auto-fixes first, manual-review findings second, and verification last so maintainers can attach the plan to CI tickets without turning every finding into a separate thread. They intentionally omit raw evidence and fix before/after values so teams can attach the plan to tickets without copying token-shaped strings. Verify a saved evidence pack before attaching it to CI artifacts or customer handoffs: ```bash agentshield evidence-pack verify ./agentshield-evidence agentshield evidence-pack verify ./agentshield-evidence --json ``` Inspect a verified evidence pack when a downstream GitHub App, Linear sync, or security-review workflow needs a compact readback without opening every artifact: ```bash agentshield evidence-pack inspect ./agentshield-evidence agentshield evidence-pack inspect ./agentshield-evidence --json ``` Aggregate multiple verified evidence packs when an operator needs fleet-level routing across repos, teams, or harnesses. The JSON output includes `operatorReadback` for promotion status/digest checks and `reviewItems` with source evidence paths and owner-ready recommendations for packs that need follow-up: ```bash agentshield evidence-pack fleet ./repo-a-evidence ./repo-b-evidence agentshield evidence-pack fleet ./repo-a-evidence ./repo-b-evidence --json ``` `operatorReadback` is the stable field for downstream GitHub App, Linear, or ECC Tools routing. It reports `ready`, `status`, `digest`, owner counts, blocking review counts, approval routes, deterministic `approvalIds`, and the next operator action so fleet promotion can be gated without parsing terminal prose. Each review item also carries the same `approvalId` plus a Linear-friendly ticket `externalId`, allowing sync jobs to dedupe owner approval threads across reruns. ### JSON Report Shape `agentshield scan --format json` is the supported machine-readable scanner interface today. ```json { "timestamp": "2026-03-13T19:42:00.000Z", "targetPath": "/repo/.claude", "score": { "grade": "C", "numericScore": 66, "breakdown": { "secrets": 100, "permissions": 70, "hooks": 80, "mcp": 35, "agents": 45 } }, "summary": { "totalFindings": 29, "critical": 1, "high": 7, "medium": 8, "low": 10, "info": 3, "filesScanned": 17, "autoFixable": 2 }, "findings": [ { "id": "mcp-risky-filesystem", "severity": "medium", "category": "mcp", "title": "Template defines risky MCP server: filesystem", "description": "Repository template includes a high-risk filesystem MCP server.", "file": "mcp-configs/mcp-servers.json", "runtimeConfidence": "template-example" } ] } ``` Notes: - `runtimeConfidence` is emitted for active runtime config, `settings.local.json`, docs/examples, installed Claude plugin caches, plugin manifests, and manifest-resolved non-shell hook code. - `harnessAdapters` is local marker evidence only. It does not call external services or imply a hosted/team entitlement. - Adapter `confidence` is `strong` when a primary harness marker exists, and `partial` when only supporting directories or secondary markers are present. - `active-runtime` means active config such as `mcp.json`, `.claude/mcp.json`, `.claude.json`, or active `settings.json`. - `project-local-optional` means project-local settings such as `settings.local.json`. - `template-example` means template/catalog files such as `mcp-configs/` or `config/mcp/`. - `docs-example` means docs/tutorial/example content such as `docs/guide/settings.json` or `commands/*.md`. - `plugin-cache` means installed Claude plugin cache content such as `.claude/plugins/cache/...`. - `plugin-manifest` means declarative hook manifests such as `hooks/hooks.json`. - `hook-code` means a manifest-resolved non-shell implementation such as `scripts/hooks/session-start.js`. - Score weighting discounts non-secret `template-example` and `docs-example` findings to `0.25x`, non-secret `project-local-optional` findings to `0.75x`, and non-secret `plugin-cache` / `plugin-manifest` findings to `0.5x`; committed secrets still count at full weight. Non-secret `template-example` findings are also capped at `10` deduction points per file and score category. See [`false-positive-audit.md`](./false-positive-audit.md). ## API Reference AgentShield currently has three distinct automation surfaces: - CLI: `agentshield scan`, `agentshield init`, and `agentshield miniclaw start` - Scanner report JSON/SARIF: `agentshield scan --format json` or `agentshield scan --format sarif --output agentshield.sarif` - Organization policy gate: `agentshield scan --policy agentshield-policy.json` - MiniClaw package + HTTP API: `ecc-agentshield/miniclaw` Important packaging note: - The npm package root export currently points at the CLI entrypoint, not a semver-stable scanner library module. - Internal scanner modules such as `src/scanner/index.ts` and `src/reporter/score.ts` are useful for contributors, but they should not be documented as supported `import` paths for package consumers yet. - If you need automation around scanner results today, prefer the JSON report format over importing scanner internals from the package root. Detailed request/response and schema notes live in [`API.md`](./API.md). ## GitHub Action ```yaml - name: AgentShield Security Scan uses: affaan-m/agentshield@v1 with: path: "." min-severity: "medium" fail-on-findings: "true" ``` **Inputs:** | Input | Default | Description | |-------|---------|-------------| | `path` | `.` | Path to scan | | `min-severity` | `medium` | Minimum severity: critical, high, medium, low, info | | `fail-on-findings` | `true` | Fail the action if findings meet severity threshold | | `format` | `terminal` | Output format: terminal, json, markdown, sarif | | `sarif-output` | `agentshield-results.sarif` | SARIF output path when `format` is `sarif` | | `baseline` | `""` | Optional AgentShield baseline JSON path for drift comparison | | `save-baseline` | `""` | Optional path to write the current scan as a new baseline | | `policy` | `""` | Optional organization policy JSON path | | `fail-on-policy` | `true` | Fail the action if the organization policy is non-compliant | | `supply-chain` | `true` | Verify MCP npm/git package provenance and known malicious package risk | | `supply-chain-online` | `false` | Query npm registry metadata during supply-chain verification | | `fail-on-supply-chain` | follows `fail-on-findings` | Fail the action when supply-chain verification finds critical or high package risks | | `evidence-pack` | `""` | Optional directory for a portable audit evidence bundle | | `verify-evidence-pack` | `true` | Verify evidence-pack artifact hashes after writing | | `policy-promotion-manifest` | `""` | Optional policy export manifest to verify and promote or dry-run | | `policy-promotion-pack` | `""` | Policy pack id when the manifest contains multiple packs | | `policy-promotion-output` | `.agentshield/policy.json` | Active policy path to write when promotion dry-run is disabled | | `policy-promotion-dry-run` | `true` | Verify promotion review evidence without writing the active policy | | `fail-on-policy-promotion` | `false` | Fail when promotion review items still require action | **Outputs:** `score` (0–100), `grade` (A–F), `total-findings`, `critical-count`, `sarif-path`, `baseline-path`, `baseline-status`, `new-findings`, `resolved-findings`, `unchanged-findings`, `score-delta`, `policy-status`, `policy-violations`, `policy-promotion-status`, `policy-promotion-pack`, `policy-promotion-review-items`, `policy-promotion-action-required-count`, `policy-promotion-digest`, `supply-chain-status`, `supply-chain-risky-packages`, `supply-chain-critical-count`, `supply-chain-high-count`, `package-manager-hardening-status`, `package-manager-hardening-findings`, `package-manager-hardening-critical-count`, `package-manager-hardening-high-count`, `package-manager-hardening-registry-credentials`, `package-manager-hardening-lifecycle-scripts`, `package-manager-hardening-release-age-gates`, `evidence-pack-path`, `evidence-pack-status`, `evidence-pack-digest` The action writes a markdown job summary and emits GitHub annotations inline on affected files. When `format: sarif` is set, it also writes a SARIF 2.1.0 report that can be uploaded to GitHub code scanning with `github/codeql-action/upload-sarif`. When `baseline` is set, the action appends a baseline drift summary, emits regression annotations for new findings, and reports `baseline-status` as `passed`, `failed`, `missing`, or `not-run`. When `policy` is set, the SARIF report includes organization-policy violations as `agentshield-policy/*` code-scanning results, appends the organization policy result to the job summary, emits policy violation annotations, and fails by default unless `fail-on-policy: "false"` is set. When `policy-promotion-manifest` is set, the action verifies the selected policy export digest, emits promotion review-item counts, appends the owner/protected-rollout/runtime-smoke review items to the job summary, and marks runtime smoke as verified when the same job also scans with the promoted policy. Supply-chain verification runs offline by default for MCP package references, appends package-risk evidence to the job summary, writes real `supply-chain.json` evidence packs, and fails on critical/high package risk whenever the action is in failing mode unless `fail-on-supply-chain: "false"` is set. Package-manager hardening outputs and job-summary evidence separately count plaintext registry credentials, lifecycle-script drift, and release-age gate drift so CI and hosted consumers can route supply-chain configuration risk even when the main finding gate is collecting evidence only. Baseline drift gate: ```yaml - name: AgentShield Drift Gate uses: affaan-m/agentshield@v1 with: path: "." baseline: ".github/agentshield-baseline.json" fail-on-findings: "false" ``` Use `fail-on-findings: "false"` when the workflow should fail only on drift from the baseline. Keep the default `fail-on-findings: "true"` when any current finding at or above `min-severity` should still fail the action. ## CLI Reference ``` agentshield scan [options] Scan configuration directory -p, --path <path> Path to scan (default: ~/.claude or cwd) -f, --format <format> Output: terminal, json, markdown, html, sarif -o, --output <path> Write the primary report output to a file --fix Auto-apply safe fixes --opus Enable Opus 4.6 multi-agent analysis --stream Stream Opus analysis in real-time --injection Run active prompt injection testing --sandbox Execute hooks in a sandbox and observe behavior --taint Run taint analysis (data flow tracking) --deep Run injection + sandbox + taint + opus together --log <path> Write structured scan logs to a file --log-format <format> Log format: ndjson or json --corpus Run built-in attack corpus benchmark --corpus-gate Fail if the built-in attack corpus regresses --baseline <path> Compare against a baseline file --save-baseline <path> Save current scan results as a baseline file --gate Fail on new critical/high findings or score drop --supply-chain Verify MCP package provenance and risk --supply-chain-online Include npm registry metadata --policy <path> Validate against an organization policy --evidence-pack <dir> Write portable evidence bundle --remediation-plan <path> Write stable-fingerprint JSON remediation plan --no-evidence-redact Disable evidence-pack redaction --min-severity <severity> Filter: critical, high, medium, low, info -v, --verbose Show detailed output agentshield init Generate secure baseline config agentshield baseline write Write a scan baseline JSON file agentshield evidence-pack fleet Summarize multiple evidence packs for routing agentshield evidence-pack inspect Verify and summarize an evidence bundle agentshield evidence-pack verify Verify artifact and bundle digests agentshield policy export Export policy packs plus checksum manifest agentshield policy init Generate an organization policy preset agentshield policy promote Verify and promote an exported policy ``` Baseline write: ```bash agentshield baseline write --path .claude --output .github/agentshield-baseline.json agentshield baseline write --path .claude --output baseline.json --json ``` The baseline command is a first-class wrapper around the existing scan baseline format. New baselines store stable hashed evidence fingerprints and omit raw evidence values, so teams can keep baseline snapshots in CI without copying token-shaped strings into long-lived artifacts. Existing raw-evidence baselines remain comparable during migration. Use it to create the accepted snapshot, then compare future scans with `agentshield scan --baseline .github/agentshield-baseline.json --gate`. Runtime monitor lifecycle: ```bash # Install the PreToolUse runtime monitor agentshield runtime install # Check whether the hook, policy, and log path are healthy agentshield runtime status --check # Back up invalid runtime files and restore a healthy install agentshield runtime repair ``` Organization policy files support enterprise metadata and temporary exceptions: ```bash agentshield policy init --pack enterprise --owner [email protected] agentshield policy init --pack regulated --name "Acme Regulated Policy" agentshield policy export --output-dir .github/agentshield-policies --owner [email protected] agentshield policy export --pack ci-enforcement --name-prefix "Acme" --json agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --output .agentshield/policy.json agentshield policy promote --manifest .github/agentshield-policies/manifest.json --pack ci-enforcement --dry-run --json ``` Policy pack presets are starter baselines, not hidden SaaS policy. `oss` keeps public repos permissive while requiring destructive-command deny entries; `team` adds the runtime hook; `enterprise` raises score gates and blocks broad tool allowlists; `regulated` disallows critical/high findings and bans broader MCP/tool surfaces; `high-risk-hooks-mcp` focuses on hook/MCP-heavy repos; and `ci-enforcement` is tuned for branch-protection evidence. Policy export writes one JSON policy file per selected pack plus a `manifest.json` containing SHA-256 digests. This gives platform teams a stable artifact bundle for branch-protection review, audit attachment, or downstream policy promotion without relying on generated console output. Policy promotion is the review gate for those exported bundles. It reads the export manifest, verifies the selected policy file digest, validates the policy schema, and only then writes the active policy path. Use `--dry-run --json` in review workflows to prove the exact pack, source file, output path, owner list, and digest before a protected branch or operator copies the policy into place. Promotion results also include `reviewItems` for owner approval, protected PR rollout, and the runtime smoke test needed before enabling an enforcing CI gate. ```json { "version": 1, "name": "Acme Corp Security Policy", "policy_pack": "enterprise", "owners": ["[email protected]"], "min_score": 85, "max_severity": "high", "required_deny_list": ["Bash(rm -rf"], "exceptions": [ { "id": "AS-EX-001", "rule": "required_hooks", "owner": "[email protected]", "reason": "Legacy repository migration window", "expires_at": "2026-06-30T23:59:59.000Z", "scope": "agentshield", "ticket": "SEC-1234" } ] } ``` Policy evaluation now includes an exception lifecycle audit in terminal output and GitHub Action summaries: total exceptions, active exceptions, exceptions expiring within seven days, expired exceptions, owners, tickets, scopes, and days until expiry. This keeps temporary waivers visible in branch-protection evidence instead of letting them become silent permanent bypasses. Exit codes: - `0`: scan completed without critical findings - `1`: CLI usage or runtime error - `2`: scan completed and found at least one critical issue ## Security Rules Summary | Category | Rules | Patterns | Severity Range | |----------|-------|----------|----------------| | Secrets | 10 | 14 | Critical -- Medium | | Permissions | 10 | -- | Critical -- Medium | | Hooks | 34 | -- | Critical -- Low | | MCP Servers | 23 | -- | Critical -- Info | | Agents | 25 | -- | Critical -- Info | | **Total** | **102** | **14** | | ## Architecture ``` src/ ├── index.ts CLI entry point (commander) ├── action.ts GitHub Action entry point ├── types.ts Type system + Zod schemas ├── scanner/ │ ├── discovery.ts Config file discovery │ └── index.ts Scan orchestrator ├── rules/ │ ├── index.ts Rule registry │ ├── secrets.ts Secret detection (10 rules, 14 patterns) │ ├── permissions.ts Permission audit (10 rules) │ ├── mcp.ts MCP server security (23 rules) │ ├── hooks.ts Hook analysis (34 rules) │ └── agents.ts Agent config review (25 rules) ├── reporter/ │ ├── score.ts Scoring engine (A-F grades) │ ├── terminal.ts Color terminal output │ ├── json.ts JSON + Markdown output │ └── html.ts Self-contained HTML report ├── fixer/ │ ├── transforms.ts Fix transforms (secret, permission, generic) │ └── index.ts Fix engine orchestrator ├── init/ │ └── index.ts Secure config generator └── opus/ ├── prompts.ts Attacker/Defender/Auditor system prompts ├── pipeline.ts Three-agent Opus 4.6 pipeline └── render.ts Opus analysis rendering ``` ## MiniClaw MiniClaw is a minimal, sandboxed AI agent runtime bundled with AgentShield. Where typical agent platforms expose many attack surfaces (Telegram, Discord, email, community plugins), MiniClaw presents a **single HTTP endpoint** backed by an **isolated sandbox**. ```bash # Start with secure defaults (localhost:3847, no network, safe tools only) npx ecc-agentshield miniclaw start # Custom configuration npx ecc-agentshield miniclaw start --port 4000 --network localhost --rate-limit 20 ``` Or use as a library: ```typescript import { startMiniClaw } from 'ecc-agentshield/miniclaw'; const { server, stop } = startMiniClaw(); // Listening on http://localhost:3847 ``` MiniClaw-specific package exports and HTTP endpoints are documented in [`src/miniclaw/README.md`](./src/miniclaw/README.md) and summarized in [`API.md`](./API.md). The React dashboard source lives in [`src/miniclaw/dashboard.tsx`](./src/miniclaw/dashboard.tsx), but it is not yet published as a separate npm subpath. ### Security Model Four independently enforced layers: ``` Request → [Rate Limit] → [CORS] → [Size Cap] → [Sanitize Prompt] ↓ [Tool Whitelist] ↓ [Sandbox FS] ↓ [Filter Output] → Response ``` - **Server** — Rate limiting (10 req/min/IP), CORS, 10KB request cap, localhost-only binding - **Prompt Router** — Strips 12+ injection pattern categories (system prompt overrides, identity reassignment, jailbreaks, data exfiltration URLs, zero-width Unicode, base64 payloads) - **Tool Whitelist** — Three tiers: Safe (read/search/list), Guarded (write/edit), Restricted (bash/network — disabled by default) - **Sandbox** — Isolated filesystem per session, path traversal blocked, symlink escape detection, extension whitelist, 10MB file cap, 5-min timeout, no network by default ### HTTP API | Method | Endpoint | Description | |--------|----------|-------------| | `POST` | `/api/prompt` | Send a prompt | | `POST` | `/api/session` | Create a sandboxed session | | `GET` | `/api/session` | Session info | | `DELETE` | `/api/session/:id` | Destroy session + cleanup | | `GET` | `/api/events/:sessionId` | Security audit events | | `GET` | `/api/health` | Health check | MiniClaw has **zero external runtime dependencies** — Node.js built-ins only (`http`, `fs`, `path`, `crypto`). The optional React dashboard requires React 18+ as a peer dependency. ## Development ```bash npm install # Install dependencies npm run dev # Development mode npm test # Run tests npm run test:coverage # Coverage report npm run typecheck # Type check npm run build # Build npm run scan:demo # Demo scan against vulnerable examples ``` ## Distribution AgentShield is available through multiple channels: | Channel | Use Case | Install | |---------|----------|---------| | **Standalone CLI** | Direct scanning from your terminal | `npm install -g ecc-agentshield` or `npx ecc-agentshield scan` | | **GitHub Action** | Automated security checks on PRs in CI/CD | `uses: affaan-m/agentshield@v1` | | **ECC Plugin** | Claude Code users via the ECC skill ecosystem | Install through [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) | | **ECC Tools GitHub App** | Integrated scanning across your GitHub org | Install at [github.com/apps/ecc-tools](https://github.com/apps/ecc-tools) | | **ECC Tools Pro** | GitHub App with automated repo analysis, Stripe billing ($19/seat/mo) | [Install](https://github.com/apps/ecc-tools) | ## License MIT --- <div align="center"> Built by [@affaanmustafa](https://x.com/affaanmustafa) · Part of [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) </div>

AI Agents Testing & QA Vulnerability Scanning
829 Github Stars