code-auditor-agent
Version: 4.1.1
License: MIT
Author: Emasoft
Ultracode code-review engine for Claude Code. ONE deterministic map → filter → reduce
workflow (scripts/workflows/caa-engine.js, run by the Workflow tool) drives every
operation over swarms of opus agents: pre-commit gating, whole-codebase or scoped scans,
delta rechecks, scan-and-fix with per-fix adversarial verification, and GitHub PR review
with claim-verification, cross-layer, and skeptical whole-diff lenses — plus 21 distilled
domain lenses (docker, solidity, iOS, GraphQL, elixir, frontend, monorepo, i18n, l10n,
JWT, prompt-injection, logging, MCP-server, API design, type design, assumptions,
function contracts, pre-mortem, architecture consistency, scenario-walk, skeptical).
Every finding is adversarially verified by a second, independent reviewer before it is
reported — refuted and downgraded findings are listed with the evidence that killed
them, never silently dropped.
Table of Contents
Installation
Requirements: Claude Code v2.1.154 or later (the Workflow tool) with uv/uvx and opus
access at session effort xhigh or max for the ultracode path. Without the Workflow tool
(ultracode disabled in settings/env), or with CAA_ULTRACODE=0, the commands fall back to a
simple inline scan at any effort — same reports, lower fidelity (no agent swarm). See
Ultracode vs. simple-scan fallback.
Install from the emasoft-plugins marketplace:
/plugin install code-auditor-agent@emasoft-plugins
After installing, run /reload-plugins to activate without restarting.
| Scope | Command | Use case |
|---|
| User (default) | /plugin install code-auditor-agent@emasoft-plugins | Personal use across all projects |
| Project | claude plugin install code-auditor-agent@emasoft-plugins --scope project | Shared with team via .claude/settings.json |
| Local | claude plugin install code-auditor-agent@emasoft-plugins --scope local | Project-specific, gitignored |
For local development, launch Claude Code with the plugin directory:
claude --plugin-dir /path/to/code-auditor-agent
Team Setup
Add the marketplace to your project's .claude/settings.json so team members get
prompted to install it automatically:
{
"extraKnownMarketplaces": {
"emasoft-plugins": {
"source": {
"source": "github",
"repo": "Emasoft/emasoft-plugins"
}
}
},
"enabledPlugins": {
"code-auditor-agent@emasoft-plugins": true
}
}
Usage
Raise the session effort first — the engine is opus-only and every command halts below
xhigh:
/effort max
Then pick the command that matches the job:
| You want to… | Command |
|---|
| Gate the STAGED files before a commit (PASS/FAIL verdict) | /caa-precommit |
| Audit the whole repo, or an explicit path/glob, scan-only | /caa-scan [paths...] |
| Recheck only the files changed since a git ref (+ dependents) | /caa-delta [ref] [deps] |
| Audit AND apply root-cause fixes (in place, fix-verified) | /caa-scan-and-fix [paths...] |
| Review a GitHub PR (ready-to-post review comment) | /caa-pr-review <pr-number> |
| Audit a codebase against a spec / requirements doc (MISSING + VIOLATING) | /caa-spec-audit <spec> [paths...] |
| Compare candidate implementations of one task against a fixed input | /caa-impl-compare <input> <impl...> |
Examples:
/caa-precommit
/caa-scan scripts/ skills/ min-severity=MAJOR
/caa-scan src/chat component=chat-audit lenses=docs/invariants.md
/caa-delta origin/main deps
/caa-scan-and-fix scripts/foo.py
/caa-pr-review 206
/caa-spec-audit design/requirements/PRRD.md src/
/caa-impl-compare bench/contract.md impls/v1.py impls/v2.py
Shared knobs (all commands): conc=N concurrent auditors (default 6, max 16);
component=NAME sub-folder for the reports; min-severity=SEV body filter;
lenses=p1,p2 extra project rule files every auditor must apply; template=path
report template; no-project-lenses to skip the automatic CLAUDE.md +
.claude/rules/*.md ingestion.
