secret-shield

One live line per running subagent above the prompt: time, tool count, what it's doing

Pin one goal for the session: it sits above the prompt with a timer, and Claude is told to stay on it and flag unrelated work instead of drifting.

A hidden git snapshot at the start of every turn; /undo-turn rolls back what Claude did

A seatbelt for YOLO mode: blocks catastrophic shell commands (rm -rf ~, mkfs, dd to a disk, fork bombs) and asks before risky ones (force-push, reset --hard, DROP TABLE, curl | sh), even with permissions bypassed.

Holds risky shell commands and shows what they'd change, with Proceed and Cancel buttons

Failing tests spawn a pixel boss; every fix lands a hit, and zero failures is a KO

Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.

hooks

Agentic QE (external: maintained in proffesor-for-testing/agentic-qe, pinned to v3.15.17): a quality-engineering fleet with 11 QE agents, 9 skills, 9 commands, the agentic-qe MCP server pinned to the plugin version, and the aqe-mod guard that refuses destructive operations on AQE learning data

9 skills · 9 commands · 11 agents · 1 MCP server

Claude Code mod: watch Headroom snip tokens off every request, with an animated band, a /headroom log and a running total.

Connect Claude Code directly to your CockroachDB clusters for hands-on database work — explore schemas, write optimized SQL, debug queries, and manage distributed database clusters. This plugin provides 14 tools across two active MCP backends (self-hosted MCP Toolbox and managed CockroachDB Cloud MCP Server), three specialized agents (DBA, Developer, Operator), 32 skills across 6 operational domains, and built-in safety hooks.

34 skills · 3 agents · 3 MCP servers · hooks

Independent auditing for AI agents, open source. Claude discovers your setup, confirms the cost, and audits your agent against the one question other tools skip: is it doing the job it's supposed to do, given your business rules and org structure? Test any model (Anthropic, OpenAI, Gemini, Azure, Bedrock, …) graded by self, one independent judge, or a cross-vendor panel; each provider is billed to its own account via a key in your settings, never the command line. Results render as an interactive artifact (with a static-report fallback).

1 skill · hooks

SOC2, HIPAA, and GDPR compliance validation, secrets scanning, compliance checklists, and regulatory documentation

1 command · 1 agent