Wire a first governed, recorded action into a codebase (/strix-governance:strix-wire — one read-only analysis authorization, then separate explicit approvals for the source change and the sandbox execution), and onboard a client organization through the reference workflow (/strix-governance:strix-onboard — tenant, systems, capabilities, policies, credential references, connectivity, one governed smoke test, then an external verifier's verdict; readiness is derived from that verdict, never asserted). Plugin skills are namespaced /strix-governance:<skill>. Both run with zero Strix account (Sandbox or Offline Mode). This plugin ships these two skills only — the three SGRF review lenses (runtime-governance-review, govern-pr, release-readiness) live in the upstream Strixgov/skills marketplace and are not included here.
Records each web route's protection intent in a .route.json sidecar whenever an AI agent creates or changes a route. Annotate-only by default; it enforces nothing.
One reported bug, reproduced on the unchanged build, re-run blind by a second agent, fixed at its invariant with a failing-first regression test and a single signed-off local commit, then proven on baseline, patched and reverted worktrees by yet another agent. Records, receipts and hash manifests stay in $TMPDIR; nothing is pushed.
Secure defaults and a write-time check while generating code, an audit that cites real incidents, and a blocking pre-deploy gate. Built from 2016-2026 breach analysis.
Findings-to-Fix builds on Checkmarx One Triage Assist and Remediation Assist. Triage Assist has already evaluated the findings on the platform using Attackability-based context (reachability, exploitability, code context, policy) and confirmed the ones that require action. The plugin takes only those confirmed findings, asks Remediation Assist to generate the review-ready fix, and brings it into the developer's editor. The agent proposes; the developer approves. Run /cx-findings-to-fix:fix in the project you want to fix.
Independently verify Strix governance artifacts — signed evidence, approvals, quorums, agent-swarm runs, tool-gateway receipts, and CT proofs. Run the namespaced skill /strix-verifier:strix-verify or the strix_verify MCP tool; Ed25519 + JWKS, offline-capable, no Strix account. The verdict is reproducible locally or fully offline.
Detect grooming, bullying, CSAM, self-harm, deepfakes and fraud across text, voice, image and video. Around 80 moderation and compliance tools over MCP.
Onboard a repository's AI agents and MCP servers to forgebench through the hosted forgebench MCP server, with workspace default budgets and browser-only credential reveal.
A fail-closed hook that asks Immiscible before every Bash command, file edit, web fetch and MCP call; the Immiscible MCP server; and an analyst that explains decisions, approvals and spend.
Ask your coding tool "is this safe to ship?": scans for leaked keys, open routes, database rules, dependencies and settings, with a fix for each finding. Includes guard hooks that stop destructive database commands.
Put okgate in front of this project's MCP servers and read what an agent run did or would have done. /okgate:init runs `npx -p @agentwares/agentguard okgate init`; /okgate:report explains the dry-run report; /okgate:audit shows which CLAUDE.md / AGENTS.md rules your coding agents broke; /okgate:hooks sets up hook mode.