Plugin marketplace
Last-mile GRC engineering plugins for Claude Code and Codex: AI inventory, privacy data maps, infrastructure checks and change control, recorded in Noru.
Add this marketplace
Then install any plugin below by name — each page has its exact command.
Run consolidated branch reviews across independently installed GRC pieces, summarize live Noru work requiring attention with read scopes only, and check shared connection and repository context.
1 skill · 5 commands · 1 MCP server
Install, plan, apply, and verify enforceable GitHub merge gates for the GRC Engineering workflow without granting the Noru hub administration rights.
1 skill · 6 commands
Scan a repository for the AI systems, model providers and oversight points it actually contains, review the manifest in a PR, and land it in Noru as assets, vendors and evidence.
1 skill · 3 commands · 1 MCP server
Assemble the evidence bundle, sampling and workpapers an auditor asks for — for one framework over one audit window — from Noru's graph plus the local files an integration cannot reach, and land the tested conclusion for each control back in Noru.
1 skill · 3 commands · 1 MCP server
Who wrote each change, who approved it, who merged it and who deployed it, for one window — with every separation that did not hold owned by a named person, and the forge configuration that was supposed to keep them apart.
1 skill · 3 commands · 1 MCP server
Inventory the coding agents, MCP servers and plugins a repository's development process depends on, decide with the user which organization stands behind each one, and land them in Noru as vendors plus one evidence record for the window — never anything per person.
1 skill · 3 commands · 1 MCP server
Work Noru's own evidence queue: see which catalogue expectations are unmet, stage local artifacts against them, and upload with control mappings.
1 skill · 3 commands · 1 MCP server
Ingest the SARIF and OSV-Scanner results that never reach a forge alert store, decide with the user what each one means here, and land them in Noru as security findings filed against risks the organization already carries — closing the ones no longer reported.
1 skill · 3 commands · 1 MCP server
File the records of human decisions in Noru: minutes, ISMS scope, statement of applicability, internal audit plans and reports, findings and corrective action plans, each attributed and dated.
1 skill · 3 commands · 1 MCP server
Scan the Terraform, CloudFormation, Kubernetes and CI configuration a repository actually contains, decide what each finding means in this environment, and land the result in Noru as security findings — closing the ones that no longer reproduce.
1 skill · 3 commands · 1 MCP server
Read the schemas a repository actually contains — ORM models, migrations, SQL DDL, API contracts — classify the personal data in them against the Fideslang taxonomy, review the result in a pull request, and land the data map in Noru.
1 skill · 3 commands · 1 MCP server
Turn a periodic review of machine output — access, rules, baselines, assets, physical access, vendors — into a named, dated, expiring sign-off in Noru.
1 skill · 3 commands · 1 MCP server
Read the threat models a repository keeps in the Open Threat Model format, decide with the user what each threat means here, and land them in Noru's risk register linked to the organization's own controls — flagging the components other pieces found that the model leaves out.
1 skill · 3 commands · 1 MCP server
Claude Code and Codex plugin that guides SOC 2, ISO 27001 and other framework work through Noru's MCP server. For Noru customers.
1 skill · 1 MCP server
Shows how many plugins this repo ships, and links here.